Financial and Technological Resources for the Engagement (CIA Part 2: Engagement Planning)
Introduction
In CIA Part 2 (Practice of Internal Auditing), engagement planning includes deciding which resources are needed to achieve the engagement objectives. Most candidates focus on human resources: staff, skills and experience. The IIA framework also expects internal auditors to plan the financial and technological resources an engagement needs.
Under the Global Internal Audit Standards (Standard 13.5, Engagement Resources), internal auditors must evaluate whether the financial, human and technological resources available are sufficient and appropriate to perform the engagement. The legacy IPPF Standard 2230 (Engagement Resource Allocation) set the same expectation. The engagement must be resourced so it can be completed effectively, efficiently and on time.
Why It Is Important
1. Achieving engagement objectives: An engagement cannot meet its objectives if it lacks the budget for travel, specialists or tools. It also fails if it lacks the technology to analyze large data sets. Poor resourcing can produce insufficient evidence and unreliable conclusions.
2. Efficiency and cost control: The internal audit activity works within an approved budget. Each engagement uses part of that budget, so careful planning keeps it from overrunning and crowding out other risk-based engagements on the annual plan.
3. Quality and conformance: The Standards require that resources be appropriate and sufficient. Not planning resources properly is a conformance issue that internal or external quality assessments can identify.
4. Coverage of modern risks: Organizations rely on ERP systems, cloud platforms, automation and huge volumes of transactional data. Without suitable technology, such as data analytics software, continuous auditing tools or secure evidence repositories, auditors cannot test full populations or detect anomalies efficiently.
5. Supporting the chief audit executive's (CAE's) reporting duties: The CAE must tell senior management and the board about resource limitations and their impact. Engagement-level resource planning gives the evidence needed to show whether internal audit's resources are adequate overall.
What It Is
Financial resources are the monetary inputs needed to carry out an engagement. They typically include:
- The engagement budget (often expressed in hours, then converted into cost)
- Travel and accommodation for site visits, especially in multi-location or international audits
- Fees for external service providers, such as IT security specialists, actuaries, forensic accountants, engineers or legal experts
- Training costs where staff need new skills for a particular engagement
- Costs of licenses, subscriptions or data purchases needed for the work
- Contingency funds for scope changes
Technological resources are the tools and systems used to plan, perform, document and report the engagement. They include:
- Audit management software for workpapers, scheduling, time tracking and issue tracking
- Data analytics tools (generalized audit software such as ACL/Galvanize or IDEA, plus Python, R, SQL, Power BI or Tableau) to extract, analyze and visualize data
- Computer-assisted audit techniques (CAATs), such as test data, integrated test facilities, embedded audit modules and parallel simulation
- Continuous auditing and monitoring tools
- Process mining, robotic process automation and AI or machine learning tools
- Communication and collaboration tools for remote auditing, such as video conferencing and secure file sharing
- Access to client systems and data, including read-only access rights, data extracts and IT support from the auditee
How It Works
Step 1: Understand the engagement objectives and scope. Resource needs follow from the objectives, scope and risk assessment from preliminary planning. Examples:
- A broad, multi-site, high-risk engagement needs more travel funds and more hours.
- A cybersecurity or data-heavy engagement needs specialized tools and possibly outside experts.
Step 2: Consider the nature and complexity of the engagement. Consider these factors:
- Complexity of the processes and systems involved
- Volume of transactions and the availability of electronic data
- Geographic spread of locations
- Time constraints and reporting deadlines
- Regulatory requirements
- Whether the work is assurance or consulting
Step 3: Identify available resources. Determine what the internal audit activity already has:
- In-house tools and licenses
- Staff skilled in analytics
- Approved budgets
- Existing co-sourcing arrangements
Step 4: Identify gaps and ways to close them. If resources are insufficient, consider these options:
- Request additional budget from the CAE
- Co-source or outsource to external service providers
- Borrow guest auditors or specialists from elsewhere in the organization (with attention to objectivity)
- Acquire or rent software
- Train staff
- Rely on the work of other assurance providers where appropriate
- Adjust the timing or scope, with this communicated and approved
Step 5: Prepare the engagement budget and work program. The budget typically allocates hours by phase (planning, fieldwork, reporting, follow-up) and by staff member. It also lists non-labor costs such as travel and specialist fees. The work program specifies the procedures and tools to be used, such as running data analytics over 100 percent of payments.
Step 6: Obtain approval. The engagement plan, including resource allocation, is reviewed and approved by the CAE or a designee before fieldwork begins. Significant changes later also require approval.
Step 7: Monitor and compare. During the engagement, supervisors compare actual hours and costs with the budget. They investigate significant variances and document the reasons, such as scope expansion or data access delays. After completion, the variance analysis improves future planning.
Step 8: Communicate limitations. If resource limitations prevent the engagement from achieving its objectives, follow these steps:
- Discuss the issue with the CAE.
- The CAE may escalate to senior management and the board.
- If the limitations amount to a scope limitation, disclose them in the engagement communication.
Key Considerations for Technology
- Data access and integrity: Auditors must make sure extracted data are complete and accurate. Typical checks are reconciling record counts and control totals to the source system.
- Security and confidentiality: Data obtained for analysis must be protected, especially personal or sensitive data. This involves privacy laws, encryption and retention rules.
- Competency: Tools are only useful if auditors can use them. Planning should match tools to staff skills or provide training.
- Cost-benefit: Buying expensive software for a single engagement may not be justified. Compare it with renting, co-sourcing or a simpler method.
- Independence of tools: Auditors should prefer to run their own queries rather than rely only on reports prepared by the auditee. Auditee-prepared reports may be incomplete or manipulated.
Key Considerations for External Service Providers
When financial resources fund external experts, the CAE must assess their:
- Competence: professional certification, reputation and experience
- Independence and objectivity: relationships with the organization or auditee
- Scope of work, defined in an engagement letter
The CAE remains responsible for the work and its conclusions, even when it is performed by an outside provider.
Common Exam Scenarios
- An auditor discovers the engagement needs specialized IT skills not available in-house. Best action: obtain the necessary competencies, for example by engaging an external IT specialist with the CAE's approval, rather than proceeding without them.
- An engagement involves millions of transactions. Best tool: data analytics or generalized audit software to test the entire population, rather than manual sampling.
- Actual hours greatly exceed budget. Best action: analyze the cause of the variance, document it and obtain approval for any changes. Do not simply cut procedures needed to support conclusions.
- Resource shortages threaten the audit plan. Best action: the CAE communicates the impact of resource limitations to senior management and the board.
- A question asks which factor is MOST important in determining engagement resources. Usual answer: the nature and complexity of the engagement, together with time constraints and available resources. Engagement objectives and risks drive everything else.
Exam Tips: Answering Questions on Financial and Technological Resources for the Engagement
Tip 1: Remember the three resource types. The Standards refer to financial, human and technological resources. If an answer choice mentions only staff, it may be incomplete when the question concerns the engagement as a whole.
Tip 2: Link resources to objectives and risk. The correct answer usually states that resources are determined from engagement objectives, scope, nature, complexity, time constraints and available resources. Be wary of answers based solely on last year's budget, auditee preference or minimizing cost.
Tip 3: Sufficient AND appropriate. Sufficient means enough quantity. Appropriate means the right mix of knowledge, skills, tools and funding. If a choice addresses only one dimension, look for a better one.
Tip 4: Never sacrifice quality to save money. Answers that reduce testing below what is needed to support conclusions are wrong. Examples are cutting procedures to meet the budget or skipping a needed specialist to save fees. The preferred response is to seek more resources, adjust scope with approval, or disclose the limitation.
Tip 5: The CAE holds responsibility. The CAE ensures that resources are sufficient, approves engagement plans and resource allocations, and reports significant resource limitations to senior management and the board. Outsourcing does not transfer this responsibility.
Tip 6: Technology means full-population testing and efficiency. When a question describes large data volumes, repetitive transactions or a need for continuous assurance, the best answer usually involves data analytics, CAATs or continuous auditing.
Tip 7: Know CAAT terminology. Be ready to distinguish these techniques:
- Test data: auditor-prepared transactions processed through the client's programs
- Integrated test facility (ITF): a fictitious entity within live processing
- Parallel simulation: the auditor's own program reprocesses real data and compares the results
- Embedded audit modules: code within the application that flags transactions continuously
- Generalized audit software: extracts and analyzes data files
Tip 8: Data integrity comes first. When a question concerns analyzing extracted data, the first step is often to verify the completeness and accuracy of the data, for example by reconciling to control totals. Only then should the auditor run analytics.
Tip 9: Consider cost-benefit and alternatives. For a one-time need, co-sourcing or a guest specialist is often better than permanently hiring staff or buying costly software. Check that the specialist is competent and objective.
Tip 10: Budget variances call for analysis, not concealment. Expect correct answers to involve comparing actual results with the budget and documenting and explaining variances. Approval is needed for scope or budget changes, and the lessons learned improve future planning.
Tip 11: Watch for keywords. Words like MOST appropriate, FIRST, BEST and PRIMARY signal that several answers may be partly right. Choose the one most aligned with the Standards: risk-based, objective-driven, quality-focused and properly approved.
Tip 12: Remember confidentiality. If technology choices involve sensitive data, the best answer considers data security, privacy laws and secure storage. Examples are using encrypted tools and limiting access to what the engagement needs.
Quick Summary
Financial and technological resources are core elements of engagement planning. Internal auditors must determine them based on the engagement's objectives, risks, nature, complexity and time constraints. They must ensure the resources are sufficient and appropriate, obtain the CAE's approval, monitor actual use against the budget, and communicate limitations. Technology, especially data analytics and CAATs, improves coverage and efficiency, provided data integrity, security and auditor competence are ensured. In the exam, favor answers that protect engagement quality, follow the Standards and involve proper approval and communication.
