At Kelmscott Water the chief audit executive is preparing next year's audit budget. Senior management has asked the function to absorb a new regulatory compliance area without any increase to its approved funding or headcount. The audit committee expects the annual audit plan still to address the highest risks. What should the chief audit executive do first?
- AReassess the risk-based audit plan, reprioritise engagements against the new area, and report any resulting coverage gaps to the audit committee. Correct
- BAdd the compliance area to the existing plan and instruct the team to work additional hours so that all previously scheduled engagements are still completed.
- CDecline the new compliance area on the grounds that it falls outside the scope already approved for the internal audit function this cycle.
- DMove the funding shortfall to the finance director who oversees the operating budget and let that role decide which engagements to drop.
Why A is correct: This is correct because budgeting for the function is driven by the risk-based plan, so the chief audit executive reprioritises within the available resources and escalates residual coverage gaps to the board-level committee that owns the resourcing decision.
Why B is wrong: This is tempting because it appears to preserve full coverage, but sustained overtime is not a resourcing strategy, masks the shortfall from the audit committee, and risks quality and retention problems the budget process exists to surface.
Why C is wrong: This is tempting because scope should be agreed, but unilaterally refusing emerging high-risk coverage abdicates the function's risk-based responsibility rather than reprioritising and escalating the resourcing constraint.
Why D is wrong: This is tempting because finance controls budgets, but delegating audit-plan prioritisation to management compromises the chief audit executive's independence and reporting line to the audit committee, which should receive the coverage decision.