A function approves a 14,000-hour audit plan, then loses two senior auditors in March and discovers its data-analytics licenses expired in April. The plan did not change. The capability behind it did. Resource management is the discipline that keeps those two things aligned.
The chief audit executive (CAE) runs the budgeting process, recruiting, and technological resource considerations so the approved plan can actually be delivered. Every resource question on this exam reduces to one comparison: what the plan demands versus what the function has. When the gap is material and cannot be closed, the CAE communicates the impact of that resource limitation to senior management and the board. That escalation is the answer far more often than "work harder" or "cut scope quietly."
The budget follows the plan, never the reverse. Build it bottom-up from the risk-based plan: estimate hours per engagement, convert hours to cost, then add the non-hour costs.
- Direct labor: salaries, benefits, and payroll burden for audit staff, usually 70% to 85% of the total budget.
- Outsourced and co-sourced labor: contracted hours at a billing rate, used where a skill is missing or demand is temporary.
Common mistakes
- Budgeting on paid hours. Using 2,080 hours per auditor instead of roughly 1,500 available hours overstates capacity by about 39% and guarantees plan slippage.
- Omitting recurring technology cost. A $96,000 license carries $17,280 of annual maintenance at 18%, plus training hours. Budgeting the purchase price only understates year-two cost.
- Absorbing the gap silently. Quietly dropping 1,500 plan hours instead of reporting the limitation to senior management and the board is the defect the exam punishes.
Bottom line
- Budget from the plan: price engagement hours, then add co-sourcing, technology, training, and travel; direct labor is typically 70% to 85% of total.
- Available hours run about 1,400 to 1,600 per auditor, not 2,080; capacity is measured in hours, never headcount.
- Incremental budgeting fits stable years; zero-based budgeting fits mergers, mandate changes, or a shifted risk profile.
- Technology cost includes licenses plus implementation plus recurring maintenance of roughly 15% to 20%, plus training; internal audit should not administer systems it audits.
Exam shortcut
When a stem gives headcount and a plan in hours, multiply headcount by roughly 1,500 before comparing. Any option that uses 2,080 is the distractor. When the gap cannot be closed, scan the options for the verb "communicate," "report," or "inform the board." That is almost always correct; "reduce scope without notification" and "absorb through overtime" are the standard traps. Sort the behavioral vocabulary by two questions.
The full lesson (about 2,584 words, 17 min read) adds 2 worked examples, all 6 common mistakes, a self-check, free in the app.
Learning objectives
- 2
Browse all free CIA Part 3 lessons or jump into free CIA Part 3 practice questions.