Developing Staff Through Engagements

Overview
Within the CRMA domain of Risk-Based Audit Planning and Engagements, the topic of developing staff through engagements addresses how the Chief Audit Executive (CAE) and engagement supervisors use real audit and risk assurance work as the primary vehicle for building the knowledge, skills, and competencies of the internal audit team. Rather than treating training and fieldwork as separate activities, this concept recognises that every engagement is an opportunity to grow people while still delivering a high-quality, risk-based result. For the CRMA exam, you must understand both the professional standards that underpin this responsibility and the practical judgement involved in balancing staff development against engagement quality, budget, and risk.

Why It Is Important
1. Standards require it. The IIA Global Internal Audit Standards place explicit obligations on the internal audit function to be collectively competent. Standard 3.1 (Competency) requires internal auditors to possess or obtain the knowledge, skills, and abilities to perform their responsibilities. Standard 10.2 (Human Resources Management) requires the CAE to establish a programme for recruiting, developing, and retaining qualified auditors, and Standard 13.4 (Engagement Resources) requires the CAE to ensure appropriate and sufficient resources are assigned to each engagement. In legacy terminology these map to Standards 1210 (Proficiency), 1230 (Continuing Professional Development), 2030 (Resource Management), 2230 (Engagement Resource Allocation), and 2340 (Engagement Supervision).
2. Risk management assurance demands specialised skills. Providing assurance over enterprise risk management (ERM), emerging risks, cyber, ESG, third-party, and model risk requires competencies that are often best acquired on the job under supervision.
3. Succession, retention, and engagement. Auditors who are stretched, coached, and given visible development opportunities are more likely to stay, and the function builds a pipeline of future supervisors and CAEs.
4. Quality and independence. A well-developed team reduces over-reliance on a few experts or on co-sourced providers, strengthening the function's ability to deliver independent, objective assurance.
5. Stakeholder confidence. Boards and audit committees evaluate whether the function has the collective competence to cover the audit universe; a documented development approach supports that assessment and the Quality Assurance and Improvement Programme (QAIP).

What It Is
Developing staff through engagements means deliberately designing and managing engagements so that they build individual and team capability. Core elements include:
- Competency framework and skills inventory: a documented set of required competencies (for example, the IIA Internal Audit Competency Framework) mapped against each auditor's current proficiency to identify gaps.
- Development-aware resource allocation: assigning staff to engagements not only because they already have the skills, but because the engagement will stretch them in an area identified in their individual development plan, while ensuring the team as a whole is competent.
- Stretch assignments and rotation: rotating auditors across business units, risk types, and engagement roles (team member, in-charge, reviewer) so they develop breadth and depth.
- Supervision and coaching: structured oversight proportionate to the auditor's experience, including workpaper review, real-time feedback, and guidance on judgement calls.
- Mentoring and buddy systems: pairing less experienced auditors with seasoned practitioners or subject matter experts.
- Knowledge transfer from specialists and co-source partners: requiring external experts or guest auditors to work alongside internal staff so skills remain in the function after the engagement ends.
- Post-engagement evaluation and debrief: formal performance feedback tied to competencies demonstrated, lessons learned sessions, and updates to the individual development plan.
- Linkage to continuing professional development (CPD): connecting on-the-job learning with formal training, certifications (such as CRMA, CIA), and professional reading.

How It Works in Practice
Step 1 - Assess needs at the planning stage. During annual risk-based planning, the CAE compares the skills required by the proposed audit plan with the skills available. Gaps are addressed through training, hiring, co-sourcing, or deliberately scheduling development opportunities. If a gap cannot be closed, the CAE must inform senior management and the board of the limitation.
Step 2 - Allocate engagement resources with development in mind. Under Standard 13.4 the engagement supervisor considers the nature and complexity of the engagement, time constraints, and available resources. A development objective is legitimate only if the overall team remains competent to achieve the engagement objectives. For example, a junior auditor may lead testing of a moderate-risk area while a senior reviews closely; a junior should not be the sole resource on a high-risk, highly technical area without adequate supervision.
Step 3 - Set explicit development objectives. Before fieldwork, the in-charge and the staff member agree what the auditor will learn (for example, performing a risk and control matrix for a new process, conducting a management interview, or drafting an observation). These are documented in the engagement plan or the individual development plan.
Step 4 - Supervise proportionately. Supervision extends from planning through reporting. The extent of supervision depends on the proficiency and experience of the auditors and the complexity of the engagement. Supervisors ensure workpapers support conclusions, objectives are met, and the auditor's reasoning is challenged constructively. Evidence of supervision (review notes, sign-offs) is retained.
Step 5 - Coach in real time. Rather than correcting work silently, supervisors explain why a change is needed, model professional scepticism, and let the auditor revise. This converts review into learning.
Step 6 - Evaluate and feed back. At engagement close, the supervisor completes a performance evaluation referencing the competency framework, discusses strengths and development areas with the auditor, and updates the development plan and skills inventory. Aggregated results inform the CAE's resource management and QAIP reporting.
Step 7 - Close the loop. Development results feed the next planning cycle: new competencies expand the areas the function can cover without external help; persistent gaps trigger formal training or recruitment decisions.

Key Principles the Exam Tests
- Collective competence over individual perfection: the Standards require the internal audit function as a whole to possess the necessary skills, so development assignments are acceptable when the team collectively covers the gap.
- Development must not compromise engagement quality or risk coverage: high-risk, complex, or sensitive engagements take priority for experienced resources.
- The CAE is ultimately accountable for resource management and competency, even when day-to-day supervision is delegated.
- Supervision is proportionate to experience and complexity and must be documented.
- Knowledge transfer should be built into co-sourcing and specialist arrangements.
- Independence and objectivity still apply: rotating an auditor into an area they recently managed, or using development as a reason to assign someone with a conflict, is inappropriate.
- Development is continuous and should be linked to CPD, the competency framework, and the QAIP.

Exam Tips: Answering Questions on Developing Staff Through Engagements
1. Identify the balancing act. Most scenario questions present a tension between developing a junior auditor and ensuring the engagement is adequately resourced. The best answer usually assigns the development opportunity with appropriate supervision, rather than either refusing the opportunity or leaving the junior unsupervised on a high-risk area.
2. Look for the word 'collectively'. If an option states that every auditor must individually possess all required skills, it is almost always wrong. The Standards require the function to collectively possess, or obtain, the necessary competence.
3. Recognise the CAE's accountability. When a question asks who is responsible for ensuring appropriate resources and competencies for the plan or an engagement, the answer is the CAE, even if supervisors execute the detail.
4. Watch for competency gaps that cannot be closed. If the function lacks skills and cannot obtain them through development, training, or co-sourcing in time, the correct action is to obtain competent advice or assistance, or decline or defer the engagement and communicate the limitation to senior management and the board, not to proceed anyway for development's sake.
5. Prefer answers that document. Options that include documenting development objectives, supervision evidence, and performance feedback are generally stronger than informal approaches.
6. Reject development as an excuse to override independence. If a question offers a rotation or assignment that creates a conflict of interest or impairs objectivity (for example, auditing an area the auditor worked in during the past year), eliminate it regardless of the development benefit.
7. Connect to the risk-based plan. When asked how staff development relates to planning, the correct reasoning is that the skills assessment is performed during risk-based planning, and development, training, hiring, or co-sourcing decisions are driven by the gap between required and available competencies.
8. Supervision scales with experience. If a question asks how much supervision is appropriate, choose the answer that ties the extent of supervision to the auditor's proficiency and the complexity and risk of the engagement, rather than a fixed rule.
9. Co-sourcing should include knowledge transfer. When an option describes using external specialists, the better answer involves pairing them with internal staff so the function builds capability, instead of outsourcing the skill permanently without transfer.
10. Use the 'most appropriate' lens. CRMA questions often have more than one defensible option; select the one that best satisfies the Standards (competency, resource allocation, supervision, CPD) while protecting engagement quality and risk coverage.
11. Memorise the standard anchors. Be ready to associate Competency (3.1), Human Resources Management (10.2), Engagement Resources (13.4), and Engagement Supervision with the legacy numbers 1210, 1230, 2030, 2230, and 2340 in case the exam uses either terminology.
12. Eliminate extremes. Options that say 'never assign juniors to risk engagements' or 'always let staff choose their assignments' are typically distractors; the Standards favour judgement, proportionality, and accountability.

Quick Recall Summary
- Engagements are the primary on-the-job development tool for building risk assurance competence.
- Assess skills during risk-based planning; allocate resources so the team is collectively competent.
- Give stretch roles with proportionate, documented supervision and coaching.
- Transfer knowledge from specialists and co-source partners.
- Evaluate performance against the competency framework, feed back, and update development plans.
- Never let development objectives undermine engagement quality, risk coverage, independence, or objectivity.
- The CAE remains accountable for competency and resource management, and reports unresolved gaps to senior management and the board.