Managing Financial, Human and IT Resources
5 minutes
5 Questions
In the CIA Challenge Exam, resource management falls under managing the internal audit function. The Global Internal Audit Standards address it in Principle 10, Manage Resources. The chief audit executive (CAE) must ensure that resources are appropriate, sufficient and effectively deployed to fulfill the internal audit charter and carry out the risk-based audit plan. Appropriate refers to the right mix of knowledge, skills and competencies. Sufficient refers to the quantity of resources. Effective deployment means using resources in a way that best achieves the plan. Financial resources (Standard 10.1): The CAE develops a budget that supports the internal audit strategy and plan. The budget typically covers salaries, training, travel, technology, co-sourcing and outsourcing. The CAE seeks board approval and senior management support for the budget. If funding is inadequate, the CAE must communicate the impact of the shortfall to the board and senior management. Examples include risks left unaudited or reduced assurance coverage. Human resources (Standard 10.2): The CAE establishes an approach to recruit, develop and retain qualified auditors. Key activities include competency assessments, defined job descriptions, training plans, certifications, mentoring and performance evaluations. When internal staff lack specific expertise, the CAE may use guest auditors, co-sourcing or outsourced service providers. In those cases, the CAE still retains responsibility for the quality of the work. Staffing gaps that limit the plan must be reported to the board. Technological resources (Standard 10.3): The CAE ensures that the function has suitable technology. This includes audit management software, data analytics tools, continuous auditing capabilities and secure information storage. The CAE also evaluates emerging tools such as automation and artificial intelligence. Staff must be trained to use these tools effectively, and technology limitations should be communicated to the board. Link to the audit plan: Resource planning is integrated with the risk-based audit plan. The CAE compares the resources required for planned engagements with the resources available. Significant resource limitations, and their effect on coverage, must be communicated, and the CAE requests board input on how to address them.
Managing Internal Audit Resources: Financial, Human and IT Resources (CIA Challenge Exam Guide)
Introduction
Managing internal audit resources is a core responsibility of the Chief Audit Executive (CAE). It is tested in the CIA Challenge Exam under Internal Audit Operations and the Audit Plan. The Global Internal Audit Standards (2024) cover it mainly in Domain IV: Managing the Internal Audit Function, under Principle 10: Manage Resources. Principle 10 has three standards:
• Standard 10.1: Financial Resource Management
• Standard 10.2: Human Resources Management
• Standard 10.3: Technological Resources
Candidates familiar with the older IPPF (2017) will recognise this content from Standard 2030 – Resource Management. That standard required resources to be appropriate, sufficient and effectively deployed to achieve the approved plan.
Why Managing Internal Audit Resources Is Important
• Delivering the audit plan: A risk-based plan only works if the function has the money, people and tools to carry it out. Without enough resources, high-risk areas may go unaudited and assurance gaps appear.
• Protecting quality and conformance: Under-resourced teams cut corners, miss risks and may fail to conform with the Standards.
• Supporting independence: Board oversight of the budget means management cannot quietly starve internal audit of funds to limit its scope. The board, with input from senior management, should approve the resource plan.
• Building credibility: A competent, well-equipped team that uses modern technology earns the trust of the board and senior management.
• Responding to emerging risks: Cybersecurity, AI, ESG and digital transformation demand new skills and tools. Strong resource management lets the function adapt.
• Accountability: The CAE must use the organization's resources efficiently and show value for money.
What It Is: The Three Resource Pillars
1. Financial Resource Management (Standard 10.1)
The CAE must manage the internal audit budget so that the function can fulfil its mandate and achieve the plan. Key elements include:
• Preparing a budget based on the risk-based audit plan. The budget covers staff costs, training, travel, technology, co-sourcing or outsourcing fees, and quality assessments.
• Presenting the budget to the board for discussion and approval, with senior management input.
• Monitoring actual spending against budget and explaining significant variances.
• Telling the board promptly when funding is insufficient, and explaining the impact on coverage and assurance.
• Seeking more funding, or reprioritising the plan, when risks change.
2. Human Resources Management (Standard 10.2)
The CAE must build and maintain a team with the right mix of knowledge, skills and abilities. Key elements include:
• Workforce planning: Matching staff numbers and skills to the plan, and finding skill gaps.
• Recruitment: Hiring people with relevant qualifications, experience and ethical values. Common credentials include CIA, CPA, CISA and CFE.
• Training and development: Supporting continuing professional development, certifications and on-the-job coaching.
• Performance evaluation: Setting objectives, giving feedback and recognising good work.
• Retention and succession planning: Keeping critical knowledge and preparing future leaders.
• Alternative sourcing: Using co-sourcing, outsourcing, guest auditors, rotational programs or subject matter experts to fill gaps.
• Collective competency: Not every auditor needs every skill. The team as a whole must have the competencies to deliver the plan.
3. Technological Resources (Standard 10.3)
The CAE must make sure the function has technology that supports the audit process. Key elements include:
• Audit management software for planning, workpapers, issue tracking and reporting.
• Data analytics and computer-assisted audit techniques (CAATs) for testing full populations.
• Continuous auditing and monitoring tools.
• Emerging tools such as robotic process automation, AI and visualisation dashboards.
• Training staff to use these tools well.
• Protecting data security and confidentiality when using technology.
• Regularly reviewing whether current tools still meet the function's needs.
• Telling the board about technology limits that affect the function's effectiveness.
How It Works in Practice
Step 1: Start with the risk-based audit plan
Resource needs come from the plan. The CAE estimates the hours, skills and tools each engagement requires.
Step 2: Perform a gap analysis
The CAE compares needs with what is available:
• Headcount and hours
• Skill sets
• Technology
• Budget
Step 3: Decide how to close gaps
Options include:
• Hiring permanent staff
• Training existing staff
• Co-sourcing or outsourcing specialised work, such as IT or actuarial audits
• Using guest auditors from the business, while managing independence and objectivity risks
• Investing in technology to boost efficiency
• Reprioritising or deferring lower-risk engagements
Step 4: Communicate and obtain approval
The CAE presents the plan, budget and resource needs to senior management and the board. The CAE must explain how any resource limits affect the plan.
Step 5: Deploy resources effectively
The right people are assigned to the right engagements. This means matching expertise to engagement risk and avoiding conflicts of interest, such as an auditor reviewing an area they recently worked in.
Step 6: Monitor and adjust
The CAE tracks budget use, staff utilisation, skills development and technology performance. The plan and resources are updated as risks change.
Step 7: Report
The CAE regularly reports resource sufficiency to the board. This includes the effect of any shortfall on the function's ability to give assurance.
Key Concepts to Remember
• Appropriate: The right mix of knowledge, skills and competencies.
• Sufficient: Enough quantity to complete the plan.
• Effectively deployed: Used in a way that best achieves the plan.
• Outsourcing: The organization may outsource internal audit, but responsibility for an effective function stays with the organization. Board oversight remains required.
• Using external service providers: The CAE must assess the provider's competence, independence and objectivity before relying on its work.
• Guest auditors: They bring business knowledge but create objectivity risks. They should not audit areas they were recently responsible for.
• Resource limitations: Significant limits must be communicated to the board. The CAE should not just quietly reduce scope.
Exam Tips: Answering Questions on Managing Financial, Human and IT Resources
Tip 1: Link resources back to the risk-based plan.
The correct answer usually ties resource decisions to the audit plan and organizational risk. If an option says resources should be based on prior-year headcount or management preference, it is likely wrong.
Tip 2: When resources are insufficient, communicate to the board.
This is one of the most heavily tested points. If the CAE lacks enough budget, staff or technology, the best response is to tell the board about the impact on the plan and assurance coverage. Silently cutting scope or lowering quality is never the best answer.
Tip 3: The board approves; senior management provides input.
For budget and resource plan questions, pick the answer where the board approves and senior management consults. This protects independence.
Tip 4: Collective competency beats individual perfection.
Questions may ask whether every auditor must be an IT expert. They need not. The function as a whole must have the needed competencies, through staff, training or external providers.
Tip 5: Know the order of preferred actions for skill gaps.
For a specialised engagement the team cannot handle, acceptable options include training staff, hiring, co-sourcing, or using an external specialist. Declining the engagement or performing it without competence is generally wrong. If the gap cannot be filled, the CAE should communicate the limitation.
Tip 6: Watch for independence and objectivity traps.
Using guest auditors or rotating staff from operations is fine only if objectivity is managed. An auditor should not assess operations they were responsible for within the previous year. Choose answers that manage these conflicts.
Tip 7: Responsibility cannot be outsourced.
When internal audit is outsourced or co-sourced, the organization, overseen by the board, remains responsible for an effective function. The CAE or a designated person must oversee the provider.
Tip 8: Technology questions focus on effectiveness and efficiency.
Expect scenarios on data analytics, continuous auditing and audit management software. The best answer usually shows how technology widens coverage, for example full-population testing instead of sampling. It also supports timely insights and efficiency, while keeping data secure and confidential.
Tip 9: Read for keywords.
Words such as best, most appropriate, first and primary matter. For example:
• The first step in resource planning is usually to identify needs from the risk-based plan.
• The best response to a shortfall is usually communication to the board.
Tip 10: Eliminate extreme or unilateral answers.
Rule out answers where the CAE acts alone without oversight. Rule out answers where management controls internal audit resources in a way that could impair independence. Rule out answers that compromise quality to save money.
Tip 11: Remember performance and development.
Human resource questions may test training plans, CPE, performance appraisals and succession planning. The Standards expect the CAE to develop staff competencies over time, not just hire.
Tip 12: Think like a CAE, not an auditor.
In management-level scenarios, choose the strategic, governance-focused answer over a tactical, engagement-level one.
Sample Question Walkthrough
Question: The CAE finds that the approved budget will not allow coverage of several high-risk areas in the risk-based audit plan. What is the most appropriate action?
A. Reduce testing in every engagement to fit the budget.
B. Remove the high-risk areas and audit only lower-risk ones.
C. Communicate the impact of the resource limitation to senior management and the board.
D. Ask management to perform self-assessments in place of audits.
Answer: C. The Standards require the CAE to tell the board and senior management about the impact of resource limits.
• Options A and B weaken assurance without board awareness.
• Option D does not replace independent assurance.
Summary
Managing internal audit resources means making sure financial, human and technological resources are appropriate, sufficient and effectively deployed to achieve the risk-based plan. The CAE:
• Builds the budget from the plan.
• Develops a competent team.
• Uses modern technology.
• Monitors performance.
• Most importantly, communicates resource limits and their effects to the board.
On the exam, favour answers that link resources to risk, keep board oversight and independence, protect quality, and stress transparent communication.
Managing internal audit resources is a core responsibility of the Chief Audit Executive (CAE). It is tested in the CIA Challenge Exam under Internal Audit Operations and the Audit Plan. The Global Internal Audit Standards (2024) cover it mainly in Domain IV: Managing the Internal Audit Function, under Principle 10: Manage Resources. Principle 10 has three standards:
• Standard 10.1: Financial Resource Management
• Standard 10.2: Human Resources Management
• Standard 10.3: Technological Resources
Candidates familiar with the older IPPF (2017) will recognise this content from Standard 2030 – Resource Management. That standard required resources to be appropriate, sufficient and effectively deployed to achieve the approved plan.
Why Managing Internal Audit Resources Is Important
• Delivering the audit plan: A risk-based plan only works if the function has the money, people and tools to carry it out. Without enough resources, high-risk areas may go unaudited and assurance gaps appear.
• Protecting quality and conformance: Under-resourced teams cut corners, miss risks and may fail to conform with the Standards.
• Supporting independence: Board oversight of the budget means management cannot quietly starve internal audit of funds to limit its scope. The board, with input from senior management, should approve the resource plan.
• Building credibility: A competent, well-equipped team that uses modern technology earns the trust of the board and senior management.
• Responding to emerging risks: Cybersecurity, AI, ESG and digital transformation demand new skills and tools. Strong resource management lets the function adapt.
• Accountability: The CAE must use the organization's resources efficiently and show value for money.
What It Is: The Three Resource Pillars
1. Financial Resource Management (Standard 10.1)
The CAE must manage the internal audit budget so that the function can fulfil its mandate and achieve the plan. Key elements include:
• Preparing a budget based on the risk-based audit plan. The budget covers staff costs, training, travel, technology, co-sourcing or outsourcing fees, and quality assessments.
• Presenting the budget to the board for discussion and approval, with senior management input.
• Monitoring actual spending against budget and explaining significant variances.
• Telling the board promptly when funding is insufficient, and explaining the impact on coverage and assurance.
• Seeking more funding, or reprioritising the plan, when risks change.
2. Human Resources Management (Standard 10.2)
The CAE must build and maintain a team with the right mix of knowledge, skills and abilities. Key elements include:
• Workforce planning: Matching staff numbers and skills to the plan, and finding skill gaps.
• Recruitment: Hiring people with relevant qualifications, experience and ethical values. Common credentials include CIA, CPA, CISA and CFE.
• Training and development: Supporting continuing professional development, certifications and on-the-job coaching.
• Performance evaluation: Setting objectives, giving feedback and recognising good work.
• Retention and succession planning: Keeping critical knowledge and preparing future leaders.
• Alternative sourcing: Using co-sourcing, outsourcing, guest auditors, rotational programs or subject matter experts to fill gaps.
• Collective competency: Not every auditor needs every skill. The team as a whole must have the competencies to deliver the plan.
3. Technological Resources (Standard 10.3)
The CAE must make sure the function has technology that supports the audit process. Key elements include:
• Audit management software for planning, workpapers, issue tracking and reporting.
• Data analytics and computer-assisted audit techniques (CAATs) for testing full populations.
• Continuous auditing and monitoring tools.
• Emerging tools such as robotic process automation, AI and visualisation dashboards.
• Training staff to use these tools well.
• Protecting data security and confidentiality when using technology.
• Regularly reviewing whether current tools still meet the function's needs.
• Telling the board about technology limits that affect the function's effectiveness.
How It Works in Practice
Step 1: Start with the risk-based audit plan
Resource needs come from the plan. The CAE estimates the hours, skills and tools each engagement requires.
Step 2: Perform a gap analysis
The CAE compares needs with what is available:
• Headcount and hours
• Skill sets
• Technology
• Budget
Step 3: Decide how to close gaps
Options include:
• Hiring permanent staff
• Training existing staff
• Co-sourcing or outsourcing specialised work, such as IT or actuarial audits
• Using guest auditors from the business, while managing independence and objectivity risks
• Investing in technology to boost efficiency
• Reprioritising or deferring lower-risk engagements
Step 4: Communicate and obtain approval
The CAE presents the plan, budget and resource needs to senior management and the board. The CAE must explain how any resource limits affect the plan.
Step 5: Deploy resources effectively
The right people are assigned to the right engagements. This means matching expertise to engagement risk and avoiding conflicts of interest, such as an auditor reviewing an area they recently worked in.
Step 6: Monitor and adjust
The CAE tracks budget use, staff utilisation, skills development and technology performance. The plan and resources are updated as risks change.
Step 7: Report
The CAE regularly reports resource sufficiency to the board. This includes the effect of any shortfall on the function's ability to give assurance.
Key Concepts to Remember
• Appropriate: The right mix of knowledge, skills and competencies.
• Sufficient: Enough quantity to complete the plan.
• Effectively deployed: Used in a way that best achieves the plan.
• Outsourcing: The organization may outsource internal audit, but responsibility for an effective function stays with the organization. Board oversight remains required.
• Using external service providers: The CAE must assess the provider's competence, independence and objectivity before relying on its work.
• Guest auditors: They bring business knowledge but create objectivity risks. They should not audit areas they were recently responsible for.
• Resource limitations: Significant limits must be communicated to the board. The CAE should not just quietly reduce scope.
Exam Tips: Answering Questions on Managing Financial, Human and IT Resources
Tip 1: Link resources back to the risk-based plan.
The correct answer usually ties resource decisions to the audit plan and organizational risk. If an option says resources should be based on prior-year headcount or management preference, it is likely wrong.
Tip 2: When resources are insufficient, communicate to the board.
This is one of the most heavily tested points. If the CAE lacks enough budget, staff or technology, the best response is to tell the board about the impact on the plan and assurance coverage. Silently cutting scope or lowering quality is never the best answer.
Tip 3: The board approves; senior management provides input.
For budget and resource plan questions, pick the answer where the board approves and senior management consults. This protects independence.
Tip 4: Collective competency beats individual perfection.
Questions may ask whether every auditor must be an IT expert. They need not. The function as a whole must have the needed competencies, through staff, training or external providers.
Tip 5: Know the order of preferred actions for skill gaps.
For a specialised engagement the team cannot handle, acceptable options include training staff, hiring, co-sourcing, or using an external specialist. Declining the engagement or performing it without competence is generally wrong. If the gap cannot be filled, the CAE should communicate the limitation.
Tip 6: Watch for independence and objectivity traps.
Using guest auditors or rotating staff from operations is fine only if objectivity is managed. An auditor should not assess operations they were responsible for within the previous year. Choose answers that manage these conflicts.
Tip 7: Responsibility cannot be outsourced.
When internal audit is outsourced or co-sourced, the organization, overseen by the board, remains responsible for an effective function. The CAE or a designated person must oversee the provider.
Tip 8: Technology questions focus on effectiveness and efficiency.
Expect scenarios on data analytics, continuous auditing and audit management software. The best answer usually shows how technology widens coverage, for example full-population testing instead of sampling. It also supports timely insights and efficiency, while keeping data secure and confidential.
Tip 9: Read for keywords.
Words such as best, most appropriate, first and primary matter. For example:
• The first step in resource planning is usually to identify needs from the risk-based plan.
• The best response to a shortfall is usually communication to the board.
Tip 10: Eliminate extreme or unilateral answers.
Rule out answers where the CAE acts alone without oversight. Rule out answers where management controls internal audit resources in a way that could impair independence. Rule out answers that compromise quality to save money.
Tip 11: Remember performance and development.
Human resource questions may test training plans, CPE, performance appraisals and succession planning. The Standards expect the CAE to develop staff competencies over time, not just hire.
Tip 12: Think like a CAE, not an auditor.
In management-level scenarios, choose the strategic, governance-focused answer over a tactical, engagement-level one.
Sample Question Walkthrough
Question: The CAE finds that the approved budget will not allow coverage of several high-risk areas in the risk-based audit plan. What is the most appropriate action?
A. Reduce testing in every engagement to fit the budget.
B. Remove the high-risk areas and audit only lower-risk ones.
C. Communicate the impact of the resource limitation to senior management and the board.
D. Ask management to perform self-assessments in place of audits.
Answer: C. The Standards require the CAE to tell the board and senior management about the impact of resource limits.
• Options A and B weaken assurance without board awareness.
• Option D does not replace independent assurance.
Summary
Managing internal audit resources means making sure financial, human and technological resources are appropriate, sufficient and effectively deployed to achieve the risk-based plan. The CAE:
• Builds the budget from the plan.
• Develops a competent team.
• Uses modern technology.
• Monitors performance.
• Most importantly, communicates resource limits and their effects to the board.
On the exam, favour answers that link resources to risk, keep board oversight and independence, protect quality, and stress transparent communication.
Test mode:
CIA Challenge - Managing Financial, Human and IT Resources Example Questions
Test your knowledge of Managing Financial, Human and IT Resources
Question 1
In managing the development of internal audit staff, what does the term competency framework refer to?
Question 2
Which of the following best describes a career path framework used to develop and retain internal auditors?
Question 3
Exit interviews tell a chief audit executive that experienced auditors are leaving. They say their work feels routine and they have little say in how engagements are run. Senior management agrees to fund one initiative to improve retention. Which recommendation should the chief audit executive judge to be the most effective response to the root cause?
Unlock Premium Access
Certified Internal Auditor Challenge Exam
- Access to ALL Certifications: Study for any certification on our platform with one subscription
- 2865 Superior-grade Certified Internal Auditor Challenge Exam practice questions
- Unlimited practice tests across all certifications
- Detailed explanations for every question
- CIA Challenge: 5 full exams plus all other certification exams
- 30-Day Money-Back Guarantee: Full refund within 30 days if unsatisfied
- Risk-Free: 7-day free trial with all premium features!
More Managing Financial, Human and IT Resources questions
74 questions (total)
Other Internal Audit Operations and Audit Plan concepts
Aligning Internal Audit Strategy with Stakeholder ExpectationsCAE Relationships and Communication with Senior Management and the BoardCoordinating with and Relying on Other Assurance ProvidersDeveloping a Risk-Based Audit PlanPlanning, Organizing, Directing and Monitoring Internal Audit OperationsSources of Potential Engagements and the Audit Universe