Although very closely related with audits-which are a key mechanism to support assure. and demonstrate compliance-there is more to compliance than audits and more to audits than using them to assure regulatory compliance.
Reference: CSA Security Guidelines V.4 (reproduced here for the educational purpose)

Malicious actors may leverage cloud computing resources to target users, Organizations or other cloud providers. Examples of misuse of cloud service-based resources include launching DDoS attacks, email spam and phishing campaigns; "mining" for digital currency; large-scale automated click fraud; brute- force compute attacks of stolen credential databases; and hosting of malicious or pirated content.

It is the customer who is ultimately responsible for any type of data loss or breaches

Sufficient Identity and Access Management practice should be followed in cloud environment.
Weakness in Identity, Credential and Access Management can lead to all types of threats as a compromised credential opens door to complete internal infrastructure.

It is false. Platform security is a shared responsibility between cloud service provider and cloud service customer in Platform as a Service(PaaS) model.