The potential variation and innovation in the cloud environment can make configuration more challenging than for an on-premises network. Correct configuration is essential for a mixed network of cloud and legacy systems to interoperate and communicate efficiently and securely. Smaller organisations are less likely to have sufficient expertise and capacity to manage configuration of new systems. Such organisations will need a robust plan in place to manage business as usual at the same time as managing the change.
Questions audit committees could ask:
• Is there a strong governance and project management plan in place? What commitment is there from the provider to work collaboratively on systems configuration? Is there a full range of senior representatives from across the relevant areas of the business in the programme governance?
• Have infrastructure, applications and data been prepared for the move? If legacy data is poor quality, should it be transferred in its existing state into the new system? Are other systems sufficiently up to date to integrate with the new cloud service?
• Is the organisation overly reliant on third-party resource? Is there sufficient resilience in the in-house team to maintain a robust corporate memory? Will the post-implementation in-house team understand how the system has been configured?
• Is the organisation following configuration best practice? Is the move to the cloud being clearly documented to ensure that any changes, for example in data categories or business processes, are understood? Has pre-implementation testing been completed and documented prior to go-live?
• Will people be ready for the new systems? Have users been engaged throughout? Have there been clear communications about the changeover dates? Are people confident about the systems they should use and their own responsibilities for maximising the chances of a smooth transition?