Harry Jones, CEO of Halifax Inc., has recently heard a lot about big data analytics, and wants to initiate a data analytics program in the company, which has a substantial volume of historic structured and unstructured data that the company has never properly exploited. Because Halifax lacks the computing infrastructure to conduct meaningful analysis in-house, the CEO has decided to contract with a cloud service provider to do the analysis and submit the resulting information. George Smith, the internal auditor at Halifax, is hesitant to outsource corporate data and has concerns about the internal controls  security measures at the service provider’s facilities. Jones, however, dismisses the auditor’s concerns on the grounds that data involved do not pertain to the firm’s financial statements and therefore not an internal control matter

Required
Write a memo from the internal auditor to the CEO addressing the following:
1) Describe the CEO’s perception risks.
2) Describe the nature of the risks associated with outsourcing.
3) Explain how the internal auditor can resolve his concerns about the service provider’s internal controls.