CIA-2 - Engagement Planning (50% of the exam) - Section A.7
Determine the level of financial, human, and technological resources and skills needed for the engagement, and evaluate the implications of resource limitations.
Determine the financial, human, and technological resources an engagement requires, matching auditor skills and tools to the subject matter under review. Evaluate the implications of resource limitations on the engagement's scope, depth, or timeline, and identify how such constraints should be communicated and managed.
Engagement resourcingResource limitations
Practice question for this objective
lock_openFree sampleEngagement Planningeasy
During engagement planning, an internal auditor determines the financial, human, and technological resources needed for the work. In internal audit terms, what does appropriately resourcing an engagement mean?
AAssigning whoever is available on the team first, then narrowing the engagement objectives to fit the people who were assigned to it.
BRequesting the largest possible budget so the engagement is never at risk of running short of money before the fieldwork is complete.
CUsing only the specific tools and staff that were used on the prior year audit of the same area, regardless of any change in scope.
DMatching the quantity and type of resources and the skills deployed to the assessed objectives, scope, and complexity of the engagement.check_circle Correct
Resourcing an engagement means matching the resources and skills deployed to the engagement's assessed objectives, scope, and complexity. Resources are a means to achieving the engagement objectives, so the assessed objectives, scope, and complexity determine what financial, human, and technological resources and competencies are needed, not the other way around.
Why A is wrong: This is tempting because staff availability is a real constraint, but it inverts the logic: objectives drive resourcing, not the reverse, so it is wrong.
Why B is wrong: Over-resourcing feels safe, but resourcing means matching resources to the assessed needs, not maximising the budget, so this is inefficient and incorrect.
Why C is wrong: Repeating last year feels efficient, but it ignores current objectives, scope, and complexity changes, so the resourcing may no longer be appropriate.
Why D is correct: Correct: resourcing aligns the money, people, technology, and competencies to what the engagement objectives and scope actually require to be achieved.
Answers that look right on this material and are not. Each one is a distractor from a different question in the CIA-2 bank for this domain.
The residual risk remaining after management controls have operated over the audited process
errorWhy it is wrong: Residual risk describes exposure after controls, which is assessed during risk analysis. It is tempting because planning also considers risk, but it is not what a resource inventory of hours, skills, and tools identifies.
A scope limitation, because management has restricted the auditor's access to the records, systems, or personnel needed to complete the work.
errorWhy it is wrong: Scope limitations are tempting to confuse with this, but they involve restricted access imposed on the engagement, not a shortfall in the team's own skills.
Narrow the engagement scope to exclude the cloud security testing the team cannot perform.
errorWhy it is wrong: Cutting scope to fit the available team avoids the gap rather than resourcing it, and would leave a significant risk area unassessed without justification.