Module 3B Managing Resources

controlled in other ways rather than the head of internal audit deciding how to spend the
function’s budget.
• Staff positions and salaries, for example, may be set according to departmental or
central government decree and policies.
• Office furniture and equipment (including IT) may also be handled separately from the
budget allocated to the internal audit function.
• The training budget may be held centrally by the Central Harmonization Unit.
The requirement for the head of internal audit to develop, seek approval for, and manage a
budget may be limited in practice. Even with delegated budgetary responsibility, many of the
costs associated with the function may not be discretionary (i.e., a matter for the budget holder
to decide). Salaries (aside from performance-related bonuses), for example, are pre-determined
and need only to be tracked.
Setting such difficulties to one side, in order to seek approval for a budget, the head of the
function needs to produce a proposal aligned with the strategy and plan of engagements. A
good starting point is the previous year’s budget although it is not simply a matter of adding a
percentage to allow for inflation. Prior levels of resourcing may have been insufficient.
Conditions, requirements, and expectations change, and the head of internal audit should
always be seeking improvements that may require utilizing resources in a different way.
The IIA’s paper “Budgeting the Internal Audit Function: How Much is Enough?” addresses these
questions. Benchmarking is sometimes used to help determine what is the appropriate level of
resourcing, but no two organizations are completely identical. The paper suggests following a
five-step process.
Step 1: Define the audit universe. This is a description of all auditable entities (“departments,
divisions, systems, processes, subsidiaries, programs, activities, and even accounts”).
Step 2: Assess the risks. It is highly unlikely an internal audit function has sufficient
resources to audit the entire audit universe. Besides, this approach would be highly
inefficient by applying resources to low likelihood, low impact risks where assurance and
advice may have limited value. The audit plan needs to prioritize engagements based on
organizational objectives and risks because “while internal audit can audit anything, it can’t
audit everything.” Assurance mapping may be part of this process to avoid unnecessary
overlap and duplication with the work of other assurance providers on which internal audit
can place reliance.
Step 3: Develop the audit plan. Identifying which audits must be undertaken as a matter of
highest urgency helps determine the major part of the budget based on estimated staff
hours needed, although some allowance should be made for ad hoc engagements and
reactive assurance and advisory engagements for new and emerging risks and
43