Control Vs Ownership: Auditors Dilemma
As the computing traveled from virtual age to Cloud Computing, the work of auditors has gotten tougher. With physical location becoming irrelevant in Cloud Computing, it has become tougher to define control and ownership of data for the auditors.
Previously control was determined by ownership, which meant physical asset like computer hardware. With virtualization physical asset became irrelevant and Cloud Computing broke the link between ownership and control completely since location and application became independent of each other.
We are rapidly moving from location centric model to identity-and-data centric model. In former model the location, ownership and control where bound within physical parameters. The latter made physical boundary irrelevant, therefore links between the three elements requires revision.
Control does not require total ownership or fixed location. With a private key the control of information can be exerted from anywhere without having rest of infrastructure. In Cloud Computing, the control can be exerted through combination of encryption, contracts and imposition of minimum security levels. Cloud computing environment can be made secure, compliant and trusted with these measures in place. The auditors can adapt to the new technology with clearer definition and links between control, location and ownership of data.
