17.1 Supervision Throughout Planning and Fieldwork

CIA Part 2 2025 Section C, Engagement Supervision and Communication, is 10% of the exam. Objective C1 is to apply appropriate supervision throughout the engagement. C1a is the planning-and-fieldwork requirement: describe how supervision applies throughout engagements, including during engagement planning. The item writers like a picture you should reject on sight: staff finish planning alone, the supervisor is too busy until wrap-up, and a senior then initials a stack of workpapers the afternoon before the exit meeting. That is a closing stamp. It is not supervision.

Supervision is a live control on the design and execution of this engagement. It exists so that engagement objectives are achieved, work quality conforms to the Global Internal Audit Standards (GIAS) and the internal audit function's methodology, and the people doing the work develop competence. Those three outcomes cannot be inspected into existence after the activity under review has already heard a rating. If the objective is vague, the engagement risk assessment is copied from last year, the work program tests the wrong activities, or the staffing mix cannot perform the tests, late review only documents a failed design.

GIAS map: Standard 12.3 applied across Domain V

Keep the domain map accurate. The methodology for supervision sits in Domain IV (Managing the Internal Audit Function), Principle 12 Enhance Quality, Standard 12.3 Oversee and Improve Engagement Performance. The chief audit executive must establish and implement methodologies for engagement supervision, quality assurance, and the development of competencies. The CAE or an engagement supervisor must provide internal auditors with guidance throughout the engagement, verify that work programs are complete, and confirm that engagement workpapers adequately support findings, conclusions, and recommendations. Supervisory duties may be delegated to appropriate, qualified people; the CAE still retains ultimate responsibility, including when work is performed by staff or by other service providers. Evidence of supervision is documented and retained.

That is not a license to turn this chapter into CIA Part 3. Part 3 2025 is where candidates are tested on managing the internal audit activity, function-level quality programs as an operations system, board reporting, final engagement communication attributes, residual-risk acceptance, and action-plan monitoring. Part 2 tests how supervision is applied to the engagement you are running.

Domain V, Performing Internal Audit Services, is where that application happens. Domain V includes Principle 13 Plan Engagements Effectively, Principle 14 Conduct Engagement Work, and Principle 15 Communicate Engagement Results and Monitor Action Plans. Domain V does not name a separate supervision principle, but it includes supervision of engagement work: approving the work program and its changes, reviewing documentation, and keeping conclusions from outrunning evidence. Use Principle 15 on Part 2 only as it applies to supervising work — blocking unreviewed conclusions from being communicated. Do not treat Standard 15.1 final-communication elements or Standard 15.2 confirmation of action-plan implementation as Section C1 topics.

Planning: objectives, risk assessment, work program, staffing

GIAS commentary on Standard 12.3 is direct: during the planning phase, the engagement supervisor approves the engagement work program and may assume responsibility for other aspects of the engagement. Standard 13.6 Work Program requires that the program be based on planning information, including the engagement risk assessment, and that it identify evaluation criteria, tasks to achieve objectives, methodologies and tools, and the internal auditors assigned to each task. The CAE must review and approve the work program and any subsequent changes. The primary criterion for approval is whether the program achieves the engagement objectives efficiently.

A supervisor who never touches objectives (Standard 13.3), the engagement risk assessment (Standard 13.2), resources (Standard 13.5), or the program (Standard 13.6) until fieldwork is done has not supervised planning. Staff who plan alone and then ask for a signature are the de facto engagement leaders. The supervisor is a notary.

Staffing is planning supervision. Standard 13.5 requires identifying the types and quantity of resources necessary to achieve the objectives, considering nature and complexity, the time frame, and whether financial, human, and technological resources are appropriate and sufficient. Matching a first-year auditor to a high-judgment fraud-sensitive estimate with no in-flight coaching is a supervision failure, not a stretch assignment. Matching only financial testers to a cybersecurity scope the team cannot execute is a resource failure the supervisor must raise before the program is treated as executable. If the limitation cannot be fixed, the program and, if needed, the scope must change — with approval — rather than silently shrinking tests in the field.

Fieldwork: guidance, program completion, and documented presence

After approval, supervision means monitoring that the work program is completed and that changes are approved before they become unofficial scope. The supervisor should see early that a sample will not support the objective, that a walk-through contradicted the control narrative, or that a tester is about to rate a control effective from inquiry alone. GIAS states that the extent of supervision required depends on the maturity of the internal audit function, the proficiency and experience of internal auditors, and the complexity of engagements. Intensity scales; disappearance is not allowed. A new auditor on a first physical inventory needs tighter direction than an experienced senior repeating a well-understood test. A first review of an ERP cutover needs more supervisor time than a recurring low-complexity checklist. Remote fieldwork does not reduce the duty; it changes the tools — more frequent checkpoints, earlier workpaper review, and a clearer rule about who may speak for the team.

Document the supervision: program approval, staffing decisions, approved changes, and timely workpaper review. Claiming you were on the status call is not a quality record.

The closing-stamp trap

A payroll team copies last year's program, starts sampling on day one, and tells payroll management in week three that overtime controls look fine. On the last afternoon the supervisor initials every paper and signs the conclusion. The initials are neat and the file looks reviewed. C1a still fails. The supervisor never challenged the objective, never tested whether this year's risks belonged in the program, never approved the quiet drop of exception testing, and allowed an unreviewed conclusion to reach the activity under review. The required pattern is supervisor involvement in objectives, risk assessment, work program, and staffing before substantial testing, then continued guidance while tests run.