The Budget Cut and the Plan That Cannot Survive It
It is October and you are finalising next year's risk-based internal audit plan for a Bulgarian state fund that administers EU and national subsidy payments. Your unit has five auditors and a budget of 480,000 leva. In September the council informed you that the unit's budget will be cut by 15% and that one auditor vacancy will not be filled, leaving four auditors. The fund's payment volume is growing 12% next year. The supervisory board has asked for assurance on: (1) eligibility of subsidy payments, (2) the new grant scheme launching in January with a 40 million leva budget, (3) IT general controls over the payment system, and (4) compliance with public procurement rules in the fund's own purchasing. Last year's plan had 11 engagements; you completed 9 and deferred 2. A European Court of Auditors follow-up is expected in the second half of the year.
1. Build the risk-based prioritisation for next year's plan under the reduced capacity, and justify what you defer.
Read the worked answer
First establish capacity honestly. Four auditors, less leave, training, follow-up and management time, gives roughly 3.2-3.5 full-time equivalents of engagement work. Last year 11 engagements were planned and 9 delivered with five auditors, so 11 is not achievable with four. Plan for 6-7 engagements plus follow-up, and say so in the plan rather than over-committing again.
Prioritisation by risk, not by request order:
- New grant scheme (40 million leva, launching January): highest inherent risk. New design, new eligibility rules, high fraud exposure, no operating history. Prioritise a design/implementation review early in the year, before payments scale, so findings can still change behaviour. This is also the best use of scarce audit resource because it is preventive.
- IT general controls over the payment system: high impact, and it underpins assurance on payments generally. Keep it, but scope it to access management, change control and interface integrity rather than a full review.
- Eligibility of subsidy payments: core statutory assurance. Keep a focused sample-based engagement, and use data analytics to cover more of the population with fewer hours.
- Public procurement in the fund's own purchasing: lowest relative risk of the four (smaller financial exposure, mature rules, existing controls). Defer or reduce to a light-touch review, and say so explicitly with the risk accepted.
Also schedule the ECA follow-up work in the second half and reserve contingency for it. Deferrals must be recorded with the risk accepted, not silently dropped, and approved by the supervisory board.
2. How should you communicate the capacity constraint and its consequences to the supervisory board, and what should the plan document say about residual risk?
Read the worked answer
The communication should be a formal plan submission that leads with the arithmetic and the consequence, not a request for sympathy. Structure: capacity available; demands received; risk ranking with rationale; what is covered; what is not covered and the exposure that remains; and what the board is being asked to approve.
Key messages: the 15% budget cut plus the unfilled vacancy removes roughly one-fifth of engagement capacity while payment volume grows 12%, so coverage per leva of payment falls. The board is not being asked to choose between nice-to-have audits; it is being asked to accept a defined residual risk. Name it: for example, 'public procurement in the fund's own purchasing will not be audited next year; based on prior findings and value, we assess this as low-to-medium exposure and recommend the board accept it.' That converts an omission into a documented, owned decision.
The plan should also state assumptions and triggers: if the grant scheme launches late, resources shift; if the ECA follow-up expands, a named engagement is deferred and the board is informed. Include a statement that the plan is risk-based and was prepared independently, and that the board's approval does not change the auditor's objectivity. Recommend that the board record its acceptance of the residual risks in the minutes, so that the gap is a governance decision rather than an audit failure. Offer a mid-year review to re-prioritise if capacity or risk changes.