A 720-hour engagement staffed with 620 hours of available time is not a fieldwork problem. It is a planning decision, and the exam tests whether you make it before the work starts or discover it in week five.
Resourcing turns an approved objective into an executable plan. You are answering three questions: how many people with what skills, how much money, and what technology. The Global Internal Audit Standards anchor engagement-level allocation in Standard 13.3 (Engagement Resource Allocation), while function-level capacity sits in Principle 10 and its three parts, financial (10.1), human (10.2), and technological (10.3). The engagement draws on the pool the chief audit executive built; it does not create capacity.
KEY: Resources follow objectives and scope, never the reverse. You size the team to the work the objectives require. If the team cannot be sized to the work, that fact goes up the chain as a limitation, and it does not silently shrink the objectives.
Competence is the combination of knowledge, skills, and experience needed to perform the engagement's procedures. Assess it against the specific subject, not against general audit experience.
Common mistakes
- Sizing the team from headcount instead of hours. Three auditors is not a budget. The plan needs 720 gross-up hours mapped to named people and phases.
- Omitting the supervision and contingency gross-up. A 600-hour bottom-up estimate at 12% supervision and 8% contingency is really 720 hours, and the 120-hour difference is the overrun.
- Treating a skill gap as a volume gap. Adding two generalist staff does not deliver 40 hours of analytics competence. Match the gap's type before its size.
Bottom line
- Resources follow objectives and scope; the plan is sized to the work, and any shortfall is escalated rather than absorbed by shrinking objectives.
- Human requirements: headcount and hours by grade, technical knowledge, experience mix, objectivity screening, language and clearance, and development fit.
- Financial requirements: internal loaded labor, external specialists, travel, technology licenses, translation and legal, plus an explicit contingency.
- Technological requirements: data extraction and access provisioning lead time, analytics platform and an operator, licensed working paper seats, and secure handling of regulated data.
Exam shortcut
Read the gap's type before its size. Stems that say "no one in the function has performed a cloud configuration review" are skill gaps, so adding staff hours is always a wrong answer; train, borrow, or co-source. Stems that say "the team is committed to two other engagements" are capacity gaps, so reallocation and rescheduling become correct.
The full lesson (about 2,365 words, 16 min read) adds 2 worked examples, all 6 common mistakes, a self-check, free in the app.
Learning objectives
- 7
Browse all free CIA Part 2 lessons or jump into free CIA Part 2 practice questions.