10.3 Financial, Human, and Technological Resources and Limitation Implications
Key Takeaways
- GIAS Standard 13.5 requires determining the financial, human, and technological resources needed for the engagement and discussing with the CAE any concern that resources are insufficient to achieve the objectives.
- Financial resources include hours, travel, specialist or co-source fees, and tool licenses; human resources include skills mix, specialists versus generalists, guest auditors, and outsourced slices; technological resources include CAATs, controlled system access, and protected evidence storage.
- If skills, hours, or tools are insufficient, obtain the resource, delay, reduce scope with a documented limitation (Chapter 2), or do not start an engagement you cannot support.
- Silently shrinking tests to protect the original report date is an unapproved work-program change and an undocumented scope limitation—not a professional option.
- Guest auditors and co-sourced slices remain on the work program and still require competence, objectivity safeguards, and internal audit review; Chapter 6 project management is how you re-baseline hours and specialist timing.
CIA Part 2 objective A7 clusters four skills: determine financial, human, and technological resources, then evaluate implications of resource limitations. GIAS Standard 13.5, Engagement Resources, requires internal auditors to determine those three resource types for the engagement and to discuss with the CAE any concern that resources are not sufficient to achieve the engagement objectives. This is engagement-level resourcing. Activity-wide budget fights with the board sit under governing and management standards and are not the center of Part 2.
Quick Answer: Price the engagement in hours, travel, specialist or co-source fees, and tools; staff it with a mix of generalists, specialists, guest auditors, or an outsourced slice; and confirm the technology needed to extract, protect, and analyze evidence. If skills, hours, or tools are insufficient, document a scope limitation (Chapter 2), delay, obtain a specialist, or do not start. The exam trap is silently shrinking tests to protect the original date.
Financial Resources: Hours Are Money
Financial resources are the budget that makes fieldwork possible. On most internal audit engagements that budget is dominated by hours, then travel, then specialist or co-source fees, then tools and licenses.
Hours should be built from the work program (Chapter 10.1), not from last year's calendar leftover. Estimate time by task: planning, walk-throughs, data extraction, each test, documentation, supervision, and wrap-up. High residual-risk tasks get more hours, not the same six-hour box as a low-risk inquiry. Travel is a financial resource when locations, inventory observations, or on-site operations tests are required; a remote-only budget that cannot fund a required observation is already a limitation. Specialist fees and co-source contracts are financial resources even when the people look like human resources—the invoice still has to exist.
Chapter 6 project management belongs here: critical path, specialist lead time, and a dated milestone plan. A resource plan that assumes the ERP security specialist is free next Monday without a booking is not a plan.
| Resource type | What you are determining | Typical engagement examples | Limitation signal |
|---|---|---|---|
| Financial | Money and time that can be bought | Staff hours, overtime, travel, lodging, co-source fees, software licenses, secure-data-room fees | Hours budgeted at 120 while the work program's tasks need 200; no travel for a required physical count |
| Human | Who can do the work competently and objectively | Generalists, domain specialists, guest auditors, language skills, location coverage, co-sourced slice | No one assigned can review firewall rules; guest auditor is the process owner |
| Technological | Tools and access needed to obtain and protect evidence | Workpaper system, CAATs and analytics, data extracts, read-only ERP access, log-repository access, encryption | Team has interviews booked but cannot obtain the payment file or monitoring export |
Human Resources: Generalists, Specialists, Guests, Outsourced Slices
Human resources are not a headcount. They are competence plus capacity plus objectivity for the tasks on the work program.
Generalists can execute many accounting, operational, and straightforward access tests with supervision. Specialists are needed when the methodology in Chapter 10.2 requires skills the core team does not have—ERP security, industrial control systems, complex models, language of a foreign sub-ledger, or cyber log architecture. Standard 13.5 plus competency requirements still demand that someone competent perform or closely supervise that slice.
Guest auditors are people borrowed from elsewhere in the organization. They can add capacity and business knowledge. They also create the classic objectivity problem: a guest from accounts payable should not independently test accounts payable. If you use guests, put them on tasks outside their home process, disclose the arrangement in planning, and keep internal audit supervision. A guest is not a way to dodge a specialist fee by letting the control owner audit themselves.
Outsourcing a slice (co-source) is legitimate when you need a defined methodology—for example, a privileged-access review of the payment system—without hiring a permanent specialist. The slice still belongs on your work program: objectives, criteria, tasks, extent, deliverable, confidentiality, and review of the co-source workpapers. You cannot outsource professional judgment about engagement conclusions and then claim you never saw the limitation.
Staffing mix should match residual risk. Putting three new hires on the high residual ERP access risk and the specialist on low-risk expense sampling is a human-resource failure even if total hours look generous.
Technological Resources: Tools, Access, and Protection
Technological resources are the systems that let you execute the methodologies you chose. Typical needs include:
- An engagement workpaper or GRC tool to document the approved program and evidence.
- Data-extraction and analytics tools (CAATs) when finance analytics or duplicate-payment tests are in the program.
- Read-only or otherwise controlled access to ERP, banking files, or log repositories. Production administrator rights are usually the wrong ask.
- Secure transfer and storage for personal data, payment files, and cyber logs.
- Collaboration tools for remote or integrated teams (Chapter 6), with the same confidentiality rules as on-site work.
A work program that plans log review without repository access, or duplicate-payment analytics without a payment-file extract, has a technology limitation even if the hours look fine. We will eyeball a few PDFs instead is a methodology change that needs approval (Chapter 10.1), not a clever workaround.
Implications of Limitations: Talk, Document, Change Scope—or Stop
If financial, human, or technological resources are insufficient to achieve the approved objectives, GIAS 13.5 requires that concern to go to the CAE. Part 2 then tests what you do next.
Professional options, often used together:
- Obtain the missing resource: book a specialist, extend hours, buy the extract tool, fund the trip, co-source a slice.
- Delay start or the affected tasks until the resource exists (specialist available after go-live hypercare; travel after the count date is scheduled).
- Reduce scope with a documented limitation following Chapter 2: change objectives or scope, communicate the limitation and its effect on the engagement, and update the work program for prompt re-approval.
- Do not start (or do not continue) an engagement you cannot support. Issuing a cheerful report on an unsupported objective is worse than a timely delay.
Chapter 6 project management is the mechanism: re-baseline hours, sequence specialist work, and reset the date. Protecting a status-report date is not a Standard.
The Trap: Silently Shrinking Tests
The exam's favorite wrong answer is the quiet cut. Time is short, so the team drops two locations, halves the sample, skips the observation, and still reports as if the original program was completed. That is not agile flexibility. It is an undocumented scope limitation, an unapproved work-program change, and a quality failure.
Silent shrinking is worse than an honest limitation because stakeholders cannot see what assurance they did not receive. If you must do less, you must change the program, obtain approval, and communicate the limitation. If the remaining work cannot support the objectives even with a limitation, do not start—or stop and escalate to the CAE.
A second trap is using a guest auditor from the auditee as a free specialist. A third is co-sourcing without review, treating a vendor slide deck as sufficient evidence. A fourth is confusing this engagement-level 13.5 conversation with the CAE's separate, activity-level discussion of budget shortfalls with the board. Part 2 wants the in-charge's decision on this job.
Worked Limitation Call
An integrated payroll engagement needs 160 hours, one week of specialist time for privileged access, read-only payroll-file access, and a site visit to observe time-clock controls at a plant. The function can supply 110 generalist hours, no specialist this month, no plant travel, and no file extract until legal reviews privacy.
Wrong: start anyway, vouch 15 pay stubs at headquarters, and issue on the original date.
Right: discuss with the CAE immediately. Options that can be combined: delay the access testing until the specialist is free; co-source that slice; postpone the observation to the next plant shutdown and document a timing or scope limitation if the report cannot wait; obtain legal-approved extract access or cut the analytics objective with a documented limitation. If privileged-access restriction is a high residual-risk objective and no competent person can test it, do not pretend the 15 stubs answered it.
The pie chart below is an illustrative split of a supported engagement budget, not an IIA published formula. Use it to remember that specialist or co-source cost and tools are financial and technological resources, not afterthoughts you discover in week three.
Staff hours, travel, and specialist fees are primarily classified as which engagement resource type under GIAS Standard 13.5?
The team lacks a cybersecurity specialist, and a high residual-risk objective requires testing privileged access to the payment file. Which response is least appropriate?
If planned resources appear insufficient to achieve the engagement objectives, GIAS Standard 13.5 requires internal auditors to do which of the following?