Audit Plan Approval and Resource Communication

1. Why This Topic Matters

Developing a risk-based internal audit plan is only half the job. A plan that has not been reviewed and approved by the board, and whose resource needs have not been honestly communicated, has no organizational legitimacy. The IIA treats the approval and communication step as a mandatory requirement because it protects three things at once: the independence of the internal audit activity (the board, not management, decides what gets audited), the alignment of audit effort with the organization's most significant risks, and the accountability of the Chief Audit Executive (CAE) for what the function can and cannot deliver with the resources it has been given.

For the CRMA exam, this topic sits inside the domain Risk-Based Audit Planning and Engagements. Questions test whether you understand who approves what, what must be communicated, when changes must be re-communicated, and how the CAE should handle resource shortfalls. Candidates who memorize the Standards' exact wording and the governance logic behind them consistently score well here.

2. What It Is: The Core Requirements

Under the 2017 IPPF Standards, the relevant requirements are:

- Standard 2010 (Planning): The CAE must establish a risk-based plan to determine priorities consistent with the organization's goals, based on a documented risk assessment performed at least annually, with input from senior management and the board.
- Standard 2020 (Communication and Approval): The CAE must communicate the internal audit activity's plans and resource requirements, including significant interim changes, to senior management and the board for review and approval. The CAE must also communicate the impact of resource limitations.
- Standard 2030 (Resource Management): The CAE must ensure that internal audit resources are appropriate (the right mix of knowledge, skills, and competencies), sufficient (enough quantity to achieve the plan), and effectively deployed (used in a way that optimizes achievement of the approved plan).

Under the 2024 Global Internal Audit Standards (GIAS), the same logic appears in:

- Standard 9.4 (Internal Audit Plan): The CAE must develop a plan that supports achievement of organizational objectives, is based on a documented risk assessment, considers board and senior management input, identifies the resources required, and is communicated to the board and senior management for review and approval. Significant interim changes must be communicated and approved, and the CAE must communicate the impact of resource limitations.
- Standard 10.1 (Financial Resource Management), 10.2 (Human Resources Management), and 10.3 (Technological Resources): The CAE must manage the budget, staff competencies, and technology needed to deliver the plan, and must inform the board and senior management when resources are insufficient.
- Standard 8.2 (Resources): The board is responsible for ensuring the internal audit function has sufficient resources and approves the internal audit budget and plan.
- Standard 7.1 (Organizational Independence): Board approval of the plan and budget is one of the explicit mechanisms that safeguards independence.

Key definitions to lock in:
- Board: the highest-level governing body (or a committee such as the audit committee) charged with oversight. The board approves.
- Senior management: executives who run operations. Senior management reviews and provides input; it does not have the final say over audit scope.
- Significant interim change: any change to the plan during the year that materially alters coverage, such as dropping a high-risk engagement, adding a major consulting project, or reallocating a large share of hours.
- Resource limitations: gaps between what the risk assessment says should be audited and what the function can actually deliver with its budget, headcount, skills, and tools.

3. How It Works: The Approval and Communication Cycle

Step 1 - Build the risk-based plan. The CAE performs or updates the organization-wide risk assessment at least annually, drawing on the enterprise risk management framework, strategic objectives, prior audit results, regulatory requirements, and input from the board and senior management. Engagements are prioritized by risk. The CAE also maps the plan to other assurance providers (coordination and reliance) to avoid gaps and duplication.

Step 2 - Quantify the resources required. For each planned engagement the CAE estimates hours, the skills needed (for example IT, fraud, actuarial, ESG), travel and tools, and whether external specialists or co-sourcing will be required. The total is compared to the available budget and staff capacity.

Step 3 - Identify the gap and its impact. If the plan cannot be fully delivered, the CAE determines what will be cut or deferred and, critically, what risk exposure remains unaddressed as a result. The CAE does not quietly shrink the plan; the gap and its consequences are documented.

Step 4 - Communicate to senior management and the board. The CAE presents the plan, the methodology behind it, the required resources, the resource gap, and the impact of that gap. Senior management provides input and may challenge priorities, but the board is the approving body. Common presentation elements include the risk universe and heat map, proposed engagements ranked by risk, coverage of key strategic risks, planned hours versus available hours, and risks that will not be covered.

Step 5 - Obtain formal approval. Approval is documented, typically in audit committee minutes. The approved plan becomes the baseline against which the CAE later reports performance (Standard 2060 / GIAS 11.3).

Step 6 - Monitor and re-communicate. The plan is dynamic. When risks emerge (an acquisition, a cyber incident, a regulatory change), the CAE reassesses and, if the change is significant, brings it back to the board for approval. Minor scheduling adjustments do not require board approval, but the CAE should use judgment and disclose cumulative changes in periodic reporting.

Step 7 - Report against the plan. The CAE periodically reports progress, completion rates, deviations, and any new resource constraints so the board can hold the function accountable and intervene if coverage is slipping.

4. Typical Scenarios the Exam Tests

Scenario A - Management wants to remove an engagement. The CFO asks the CAE to drop a planned audit of treasury operations because of a system implementation. Correct response: the CAE evaluates the risk, and because this is a significant interim change, communicates the proposed change and its impact to the board for approval. The CAE does not simply comply with management.

Scenario B - Budget cut after approval. The approved plan required twelve auditors; headcount is frozen at nine. Correct response: the CAE communicates the impact to senior management and the board, identifying which high-risk areas will not be covered, and seeks either additional resources (co-sourcing, outsourcing, guest auditors) or formal acceptance of the reduced coverage by the board.

Scenario C - Skills gap. The plan includes a complex cybersecurity audit but no staff member has the competency. Correct response: this is an appropriateness issue under Standard 2030 / GIAS 10.2. The CAE should obtain the expertise (training, co-sourcing, external specialist) or communicate to the board that the engagement cannot be performed competently. Declining to disclose the gap or performing the audit without competence violates the Standards.

Scenario D - Who approves? Questions often offer the CEO, CFO, external auditor, or audit committee as the approver. The answer is the board or its audit committee. Senior management reviews and provides input.

Scenario E - New emerging risk mid-year. A major data breach occurs. Correct response: the CAE reassesses risk, proposes adding an engagement, identifies what will be deferred to free resources, and obtains board approval for the significant change.

5. Exam Tips: Answering Questions on Audit Plan Approval and Resource Communication

Tip 1 - Know the three verbs: communicate, review, approve. The CAE communicates; senior management and the board review; the board approves. If an answer choice has management approving the plan or the CAE approving his or her own plan, eliminate it.

Tip 2 - Remember that resources are part of the approval package. The Standards do not say communicate the plan alone. They say communicate the plan and resource requirements. Any option that treats the budget as a separate, purely administrative matter is weaker than one that ties resources to coverage.

Tip 3 - The impact of resource limitations must always be disclosed. This is the most frequently tested phrase. When a scenario describes a shortfall, the best answer is nearly always the one where the CAE tells the board which risks will go unaudited and why. Silence, absorbing the cut without comment, or lowering quality to stretch resources are wrong answers.

Tip 4 - Distinguish significant from minor changes. Moving an engagement from Q2 to Q3 is a scheduling matter. Cancelling a high-risk engagement, adding a large consulting project, or shifting more than a modest share of hours is significant and goes back to the board. If the question stresses materiality, risk, or coverage, treat the change as significant.

Tip 5 - Independence is the underlying principle. When two answers seem plausible, choose the one that keeps decision authority over audit scope with the board rather than with the executives being audited. The exam rewards recognizing that plan approval is an independence safeguard, not just a procedural step.

Tip 6 - Use the appropriate, sufficient, effectively deployed triad. Resource questions often hinge on which of these three is at issue. A skills problem is appropriateness. A headcount or budget problem is sufficiency. A problem of wasted hours or poor scheduling is deployment. Matching the problem to the right term helps you select the right remedy.

Tip 7 - The plan is dynamic, not annual-and-forgotten. Answers that imply the plan is fixed for the year once approved are incorrect. The risk assessment is performed at least annually, but the plan must be adjusted whenever significant risks change.

Tip 8 - Watch for the word first or most appropriate. When asked what the CAE should do first after discovering a resource gap, the sequence is: assess the impact on coverage, explore alternatives (co-sourcing, reprioritization), then communicate to senior management and the board. When asked for the most appropriate action, choose communication to the board with a clear statement of impact.

Tip 9 - Coordination with other assurance providers can be a resource answer. If an option mentions relying on the work of second-line functions or external auditors to close a coverage gap, it is a legitimate resource strategy, provided the CAE evaluates the reliability of that work and remains accountable.

Tip 10 - Map 2017 and 2024 terminology. The CRMA may reference either framework. Standard 2020 equals GIAS 9.4 for communication and approval; Standard 2030 maps to GIAS 10.1 through 10.3 for resources; the board's duty to ensure resources appears in GIAS 8.2. Knowing both sets of numbers prevents confusion when a question cites one or the other.

6. Quick Recap

- The CAE builds a risk-based plan, identifies the resources required, and quantifies any gap.
- The plan, resource requirements, significant interim changes, and the impact of resource limitations are communicated to senior management and the board.
- The board approves; management provides input.
- Resources must be appropriate, sufficient, and effectively deployed; shortfalls are disclosed, never hidden.
- The plan is dynamic and is updated as risks change, with significant changes returning to the board.
- Board approval of the plan and budget is a core safeguard of internal audit independence.

Master these points, read every scenario for who holds approval authority and whether a resource impact has been disclosed, and you will handle this section of the CRMA exam with confidence.