Auditing the Cloud: Risks, Frameworks, and Real Value

Oct 9, 2025

Ask episode

Chapters

Transcript

Episode notes

The Institute of Internal Auditors Presents: All Things Internal Audit Tech Sponsored by Grant Thornton Cloud security has become a top board-level concern and a permanent fixture on audit plans. In this companion episode to the Global Best Practices’ A Roadmap to Auditing Cloud Security, Adam Ross talks with Vik Rai and Aadesh Gandhre about the challenges of auditing in multi-cloud environments, regulatory requirements, and the importance of governance and shared responsibility. They explore skill gaps, third-party risk, frameworks, and practical approaches to building a phased cloud security audit program, helping internal auditors strengthen resilience and provide real value.

HOST: Adam Ross, CIA, CISA Partner, Grant Thornton Advisors, LLC

GUEST:Vik Rai, CISSP, CISA Managing Director, Grant Thornton Advisors, LLC

Aadesh Gandhre, CISA, CAMS (Sanctions), ITIL 4, Certified Cryptocurrency Auditor, Certified in Cybersecurity Chief Audit Executive, DTCC

KEY POINTS:

Introduction [00:00–00:00:47]
Why Cloud Security Matters Now [00:00:51–00:03:10]
Board-Level Visibility and Audit’s Role [00:03:12–00:05:51]
Regulatory Expectations and Frameworks [00:05:54–00:10:28]
Skills and Governance at the Board Level [00:11:14–00:13:49]
Shared Responsibility and Security Models [00:14:05–00:17:51]
Resiliency, Outages, and Accountability [00:17:13–00:18:57]
Starting a Cloud Security Audit [00:19:08–00:21:46]
Upskilling Auditors for Cloud Environments [00:22:14–00:23:05]
Cloud Security Posture Management (CSPM) [00:23:15–00:27:54]
Phased and Risk-Based Audit Planning [00:29:07–00:35:42]
Final Thoughts [00:37:02–00:40:43]
Closing [00:41:28–00:41:46]

IIA RELATED CONTENT: Interested in this topic? Visit the links below for more resources:

Visit The IIA's website or YouTube channel for related topics and more.

Follow All Things Internal Audit: Apple Podcasts Spotify Libsyn Deezer