In these weeks many internal audit functions are preparing next year's plan to take it to the audit committee. It usually arrives with the engagements, the calendar and the team. If it does not say which technology those engagements will be carried out with, it is missing a part that the Spanish supervisor already recommends including.

What the CNMV recommends

Technical Guide 1/2024 from the CNMV, Spain's securities regulator, dated 27 June 2024, is addressed to the audit committees of public interest entities. When it deals with approving the annual internal audit plan, it recommends that, besides the objectives and the engagements, the plan include the resources needed to carry it out, human (internal and external), financial and technological.

The guide does not stop at approval. When following up on the plan, it recommends that the committee check, among other things, whether the main business risk areas identified in the plan are adequately covered in practice, and whether the resources approved at the start are available, technological ones included. In other words, the committee does not just approve an allocation. It comes back later to ask whether that allocation actually covered the risk.

What the Global Standards require

The guide points the committee to the IIA's Global Internal Audit Standards, published in January 2024, as a reference, and they say the same thing from the chief audit executive's side. Standard 9.4 asks the plan to identify the human, financial and technological resources needed to complete it, and the CAE to communicate to the board and senior management "the impact of any resource limitations on internal audit coverage."

Standard 10.3, on technological resources, goes one step further. The CAE must strive to ensure the function has technology to support the internal audit process, must "regularly evaluate the technology used by the internal audit function" and must communicate "the impact of technology limitations on the effectiveness or efficiency of the internal audit function to the board and senior management." Having tools is not enough. The cost of not having them has to be stated.

The budget does not make it easy

The study KPMG and the Spanish Institute of Internal Auditors presented in March 2025 gives a hint of the starting point in Spain. Almost 80% of the organisations surveyed have their own budget for internal audit, yet more than 50% of companies consider that budget limited. The public summary does not give the sample size, so it is better read as a signal than as a measurement.

With a tight budget, the technology limitation will not disappear in one cycle. What can be done is to explain it well.

Three pieces for the next committee meeting

  1. A coverage map with the method. For each main risk area, which engagement covers it and how it is tested, whether on the full population, on a sample or through document review. It is the direct answer to whether the risk is covered in practice.
  2. The limitation expressed as coverage. Saying an analytics tool is missing tells a board member nothing. Saying a sample of payments is reviewed because the full year cannot be extracted from the system does, because it describes which part of the risk goes untested.
  3. The technology evaluation, in writing and every year. What was requested, what was approved, what was implemented and what changed in coverage. It is the regular evaluation Standard 10.3 asks for, and it also answers whether the approved resources are available.

The committee does not need to know which tool internal audit uses. It needs to know which part of the risk goes untested for lack of it.

That approach changes the budget conversation. The considerations for implementation of Standard 10.3 themselves suggest presenting "sufficiently supported technology funding requests" to the board and senior management. A request that arrives with its effect on coverage is discussed as a decision about risk, not as a cost of the function. And it connects to a problem the profession has carried for years, a capability gap that does not close by hiring alone.