2.4 Cloud Governance, End-User Computing & AIS Process Improvement
Key Takeaways
- End-user devices — laptops, tablets, phones and the spreadsheets and desktop databases running on them — are an explicit component of IT architecture in the ISC blueprint, and end-user computing (EUC) files that feed the general ledger are treated as Information Produced by the Entity requiring completeness and accuracy testing.
- COSO's Enterprise Risk Management for Cloud Computing applies the five ERM components to cloud decisions, so cloud adoption is governed as a strategy-and-performance risk rather than delegated to IT procurement.
- A cloud service provider's responsibilities are fixed by the service model and the contract: the CSP always owns the physical facility, hardware and hypervisor, and never owns the customer's data classification, user authorization or regulatory accountability.
- Robotic process automation (RPA) bots are software workers that need the same identity governance as humans — named bot credentials, least-privilege entitlements, a human owner of record, and segregation-of-duties analysis across everything the bot can touch.
- When evaluating a proposed accounting information system improvement, the CPA compares the three levers named in the blueprint — robotic process automation, outsourcing, and system changes — against the control risk each introduces, not merely against cost savings.
Cloud Governance, End-User Computing & AIS Process Improvement
Quick Answer: IT architecture does not stop at the data center. The ISC blueprint names end-user devices alongside operating systems, servers and network infrastructure, and end-user computing files are a persistent source of financial misstatement. Cloud adoption is a governance decision that COSO addresses through Enterprise Risk Management for Cloud Computing, applying the same five ERM components used for any strategic risk. And when management proposes to improve an accounting information system, the blueprint names exactly three levers — robotic process automation, outsourcing, and system changes — each of which redraws the control environment.
1. End-User Devices as an Architecture Component
The first Area I representative task asks candidates to "explain the purpose and recognize examples of key components of IT architecture (e.g., operating systems, servers, network infrastructure, end-user devices)." End-user devices are the endpoints where authorized people actually touch financial data:
| Device Class | Examples | Why the Auditor Cares |
|---|---|---|
| Managed workstations | Corporate laptops and desktops joined to the enterprise directory | Carry the ERP client, local caches of exported reports, and the local administrator rights that malware needs |
| Mobile devices | Company phones and tablets; BYOD handsets enrolled in mobile device management | Approve workflows (invoices, journal entries) and receive multi-factor push prompts; lost devices are lost credentials |
| Thin clients / virtual desktops | VDI sessions to a hosted desktop | Shift data off the endpoint entirely; a strong compensating control where physical device theft is the dominant risk |
| Peripherals and kiosks | Point-of-sale terminals, badge readers, warehouse scanners, network printers | Capture transactions at the source; unpatched embedded operating systems are a common lateral-movement foothold |
The control set for endpoints is standard and testable: full-disk encryption, screen-lock timeouts, centrally managed patching, endpoint detection and response agents, removable-media restrictions, and remote wipe on loss or termination.
End-User Computing (EUC) Risk
The higher-impact issue for a CPA is not the hardware but the spreadsheets, desktop databases and analyst-built scripts that live on those endpoints and feed the financial statements — the allowance-for-credit-losses model, the lease schedule, the revenue-allocation workbook, the consolidation template.
An EUC file has none of the ITGCs that protect the ERP. There is no change advisory board for a workbook. So auditors treat material EUC files as Information Produced by the Entity (IPE) and test them directly:
- Inventory and rate the population. Maintain a register of EUC files that affect financial reporting, rated by materiality and complexity.
- Access. Store the file in a controlled repository with restricted write access rather than a personal drive or email chain.
- Change control. Version the file, lock formula cells, and require an independent review of any formula or logic change.
- Input integrity. Trace the source data back to the system query that produced it and re-perform the extract.
- Output review. Require an independent recalculation or an analytical reasonableness check before the number posts.
Exam framing: When a scenario says the controller "downloads the aging report into Excel and calculates the reserve," you are looking at an IT-dependent manual control built on an EUC file. Testing the controller's signature alone is a deficiency; the automated report logic and the workbook's formulas both have to be tested.
2. Cloud Service Provider Roles and Responsibilities
The blueprint asks candidates to "summarize the role and responsibilities of cloud service providers." The CSP's obligations are set by two things: the service model (which physical and logical layers the CSP operates) and the contract (what the CSP has actually committed to).
Always the CSP's responsibility, in every service model:
- Physical facility security, power, cooling and fire suppression
- Hardware procurement, maintenance and decommissioning (including media sanitization)
- The hypervisor and the tenant-isolation boundary between customers
- Availability of the underlying platform to the contracted service level
Never the CSP's responsibility, in any service model:
- Classifying the customer's data and deciding what may be stored in the cloud at all
- Deciding which named users are authorized and revoking them on termination
- The customer's regulatory accountability under HIPAA, GDPR or a state breach statute
- Determining whether the customer's own financial reporting controls are effective
Contract terms the CPA reads before relying on anything: the service level agreement and its remedies (service credits are a refund, not a recovery); data location and residency commitments; the CSP's right to subcontract to further subservice organizations; breach notification timing; audit and SOC report rights; and the exit clause — the format, timing and cost of getting the data back, which is the single most commonly omitted term.
3. How the COSO Frameworks Address Cloud Computing Governance
The blueprint contains a discrete task: "Explain how the COSO frameworks address cloud computing governance." COSO's Enterprise Risk Management for Cloud Computing does not invent a cloud-specific framework. It applies the five components of COSO ERM to cloud decisions, which is the point: cloud is a strategic risk decision that belongs in the enterprise risk process, not an IT purchasing decision.
| COSO ERM Component | Applied to Cloud Computing |
|---|---|
| Governance and Culture | The board and executive management — not the CIO alone — set who may approve a cloud migration, define cloud roles and responsibilities, and establish the tone that shadow IT is unacceptable |
| Strategy and Objective-Setting | Cloud adoption is evaluated against enterprise strategy and stated risk appetite: which workloads may move, which data classifications may leave the premises, which jurisdictions are acceptable |
| Performance | Cloud-specific risks are identified, assessed and prioritized — multi-tenancy and isolation failure, vendor lock-in, data residency and sovereignty, concentration risk from a single hyperscaler, loss of direct audit access — and a response is chosen (accept, avoid, reduce, share) |
| Review and Revision | Cloud risk is re-evaluated as services change: new regions, new subservice organizations, renegotiated SLAs, and shifts in the threat landscape |
| Information, Communication and Reporting | Cloud risk metrics — SOC report status, SLA attainment, configuration drift, shadow-IT discoveries — are reported to the board alongside other enterprise risks |
COSO's parallel publication Managing Cyber Risk in a Digital Age performs the same translation for cyber risk generally, and Blockchain and Internal Control: The COSO Perspective does it for distributed ledgers. In every case the message is identical: the existing COSO components are sufficient; the technology changes the risks, not the framework.
4. Improving an Accounting Information System: RPA, Outsourcing, System Changes
The blueprint asks candidates to "determine potential changes to business processes to improve the performance of an accounting information system (e.g., robotic process automation, outsourcing, system changes)." Each lever trades one risk profile for another.
Robotic Process Automation (RPA)
RPA is software that drives an application's user interface the way a person would — logging in, opening screens, copying fields, clicking approve. It is best suited to processes that are high volume, rule-based, stable, and built on structured digital inputs: three-way-match exception clearing, bank reconciliation matching, intercompany journal preparation, vendor master data updates from an approved feed.
- Attended bots run on a user's desktop and are triggered by that user.
- Unattended bots run on a server against a schedule with no human present — these are the ones that matter for segregation of duties.
Control implications auditors test:
- Bot identity. Each bot has a named, non-human account — never a shared or borrowed employee credential. If a bot runs under an accountant's login, the audit trail is destroyed and the accountant inherits everything the bot did.
- Least privilege and SoD. A bot's combined entitlements are analyzed against the SoD matrix exactly like a human's. A bot that can both create a vendor and release a payment is a toxic combination regardless of the fact that it is software.
- Human owner of record. Every bot has an accountable business owner who authorizes its logic and reviews its exceptions.
- Change control over bot logic. Bot scripts are code. They belong under the same change management ITGC as any other production program.
- Exception handling. The bot must route what it cannot process to a human queue rather than silently skipping or force-fitting records.
- Brittleness. RPA is tied to screen layouts. A vendor's user interface update can break a bot mid-cycle, so monitoring for failed or partially completed runs is a required operational control.
Outsourcing
Outsourcing moves execution to a service organization but never moves accountability. The control consequence is a shift from testing controls yourself to monitoring someone else's controls: obtaining and evaluating a SOC 1 or SOC 2 report, implementing the complementary user entity controls the report depends on, and retaining internal reconciliations that would detect a service organization failure.
System Changes
Configuring or replacing the system itself — enabling an automated three-way match instead of a manual review, adding workflow approval thresholds, replacing a bolt-on with a native module — usually produces the strongest control improvement because the control becomes programmatic and consistent. It is also the most expensive and drags the full System Development Life Cycle and data migration risk behind it.
| Lever | Typical Benefit | Primary New Risk | First Control the Auditor Looks For |
|---|---|---|---|
| RPA | Speed and consistency on high-volume clerical work without changing the underlying system | Unmonitored bot privileges; silent failures; SoD violations embedded in bot entitlements | Named bot credentials with an owner of record and an SoD review of bot entitlements |
| Outsourcing | Access to specialist capability and scale at variable cost | Loss of direct visibility; reliance on a third party's control environment | A current SOC report covering the right period and scope, plus implemented CUECs |
| System change | Control becomes automated, consistent and evidenced by the system | Implementation and data-migration risk; configuration errors that scale instantly | Documented UAT sign-off by the business process owner and pre/post migration reconciliation |
A controller downloads an accounts receivable aging report from the ERP each month into a spreadsheet, applies a loss-rate model built with nested formulas, and posts the resulting allowance for credit losses. What is the auditor's obligation with respect to the spreadsheet?
An unattended robotic process automation bot has been configured to clear accounts payable match exceptions overnight. During an entitlement review, the auditor finds the bot executes under a shared credential belonging to the accounts payable supervisor and holds permissions to both create vendor master records and release payment runs. Which finding is most significant?
According to COSO's guidance on cloud computing governance, how does COSO address the risks an organization assumes when it migrates financial systems to a public cloud provider?