search

CIA Exam Prep: Parts, Format and a Study Plan

9/19/2026

The Certified Internal Auditor exam is the gateway to the internal audit profession's global credential, and it is not the exam it was a few years ago. The Institute of Internal Auditors (IIA) rebuilt it to align with its Global Internal Audit Standards, which took effect in January 2025. If you are working from older study notes or a colleague's advice from before then, some of what you have is out of date.

This guide explains the current three-part CIA exam, what each part covers, how the exam is delivered and scored, who is eligible, and how to build a study plan that works around a full-time audit job. If you want the bigger picture of the credential itself and how it compares with the CPA, start with the accounting certifications and designations overview; this page is about passing the exam.

The CIA Exam at a Glance

Per the IIA's published exam information and syllabus:

Part

Name

Questions

Time

Part 1

Internal Audit Fundamentals

125

2.5 hours (150 minutes)

Part 2

Internal Audit Engagement

100

2 hours (120 minutes)

Part 3

Internal Audit Function

100

2 hours (120 minutes)

 

All three parts are multiple choice and computer based, delivered through Pearson VUE. Scores are reported on a scale of 250 to 750, and 600 is required to pass each part. The IIA does not prescribe an order, so you can take the parts in whatever sequence suits you.

The IIA reviews its exam periodically, so confirm the current part structure and syllabus on the IIA's site before you register. The breakdown below follows the IIA's syllabus for the exam aligned to the Global Internal Audit Standards.

Part 1: Internal Audit Fundamentals

What it covers

Part 1 is the conceptual foundation: what internal auditing is, the standards and ethics that govern it, and the governance, risk and control environment it evaluates. The IIA syllabus sets four sections:

Section

Weight

A. Foundations of Internal Auditing

35%

B. Ethics and Professionalism

20%

C. Governance, Risk Management, and Control

30%

D. Fraud Risks

15%

 

Foundations covers the purpose and mandate of internal audit, the Global Internal Audit Standards, independence and objectivity, and the difference between assurance and advisory services. Ethics and professionalism covers integrity, due professional care, competency and communication. Governance, risk and control covers governance frameworks, risk management processes and internal control concepts. Fraud risks covers fraud schemes, red flags and the auditor's responsibilities when fraud is suspected.

How to prepare

Part 1 has the most questions and the longest time limit, and it is heavy on the vocabulary of the Standards. Candidates who come from external audit often know control concepts well but stumble on the internal-audit-specific framing: the mandate, the role of the board, and how independence works inside the organization. Learn the Standards' terms precisely, because questions often turn on the exact wording. For the control framework material, our post on the internal controls over financial reporting framework is a useful refresher, and our post on fraud triangle detection maps well onto the fraud risks section.

Part 2: Internal Audit Engagement

What it covers

Part 2 follows an engagement from start to finish. The IIA syllabus sets three sections:

Section

Weight

A. Engagement Planning

50%

B. Information Gathering, Analysis, and Evaluation

40%

C. Engagement Supervision and Communication

10%

 

Engagement planning covers objectives, scope, risk assessment of the area under review, the engagement work program and resource allocation. Information gathering, analysis and evaluation covers sources of evidence, sampling, analytical procedures and data analytics, and evaluating results against criteria. Supervision and communication covers reviewing workpapers, communicating results and the elements of a good finding.

How to prepare

Half the weight sits in planning. That surprises candidates who think of auditing as fieldwork. Expect scenario questions asking which step comes next, which objective fits a given risk, or which procedure gives the best evidence. If you work in internal audit, Part 2 is the part where experience helps most, so many candidates take it early to build momentum. If you come from outside internal audit, work through every step of an engagement cycle with a real or sample work program before you start questions.

Part 3: Internal Audit Function

What it covers

Part 3 moves from the single engagement to running the internal audit activity as a whole. The IIA syllabus sets four sections:

Section

Weight

A. Internal Audit Operations

25%

B. Internal Audit Plan

15%

C. Quality of the Internal Audit Function

15%

D. Engagement Results and Monitoring

45%

 

Operations covers the strategy, policies, resources and coordination of the function. The internal audit plan covers risk-based planning across the organization. Quality covers the quality assurance and improvement program and performance measurement. Engagement results and monitoring, the heaviest section, covers how results are communicated to senior management and the board and how the function tracks management's actions.

How to prepare

Part 3 is written from the perspective of a chief audit executive. Staff auditors often find it the most abstract because they have not yet run a function, built an annual plan or reported to an audit committee. Read it as a manager would: who decides, who is told, and what the Standards require at each step. If your organization will let you, sit in on the annual planning process or read past audit committee reports. If you are in a smaller organization, our SOX compliance checklist for small companies shows how monitoring and reporting look in practice.

Eligibility: Who Can Sit for the CIA Exam

Per the IIA's eligibility requirements:

  • Master's degree or higher: 1 year of internal audit experience.
  • Bachelor's degree: 2 years of internal audit experience.
  • Active Internal Audit Practitioner (IAP): 5 years of internal audit experience, 2 of them within the past 3 years (reduced if you later earn a degree).
  • No degree, or still a student: earn the IAP first, then move into the CIA program.

All candidates need a valid government-issued photo ID. Accepted experience is broader than the job title "internal auditor": the IIA lists internal audit, quality assurance, risk management, audit and assessment disciplines, compliance, external audit and internal control.

Two rules matter most for planning:

  • You can sit for the exam before your experience is complete. Degree holders can apply and test first, then verify experience. You are certified only once the experience is verified.
  • You have three years from the date you are accepted into the CIA program to complete the requirements. Exam registrations are valid for 180 days, or until your program expiration date if that comes first.

The IIA publishes current application and exam fees, with lower prices for members. Check them on the IIA site before you budget.

The CIA Challenge Exam

Qualified CPAs and chartered accountants, CISA holders and some experienced auditors may be eligible for the CIA Challenge Exam, a single exam that replaces the three-part route for those groups. Eligibility is set by the IIA and the syllabus is published separately, so check whether you qualify before you buy three-part materials.

How the Exam Is Delivered

You take the CIA exam through Pearson VUE, either at a test center or, for most exams, through online proctoring. The IIA notes that online proctoring is not available for every exam, so confirm when you schedule. The IIA says the exam is offered in multiple languages, which matters for global audit teams.

Because registrations are valid for 180 days, buy a part's registration only when you are ready to schedule it within that window. Buying all three at once and then letting a registration lapse is an expensive mistake.

A Study Plan for Working Auditors

Most CIA candidates already work full time. A plan that assumes long study blocks will fail. One that runs on steady short sessions, with deadlines you set yourself, usually works.

Step 1: Pick your order

The IIA leaves the order to you. Three sensible options:

  • Part 2 first if you already work in internal audit. Engagement work is what you do every day, so it gives a fast pass.
  • Part 1 first if you are new to internal audit or coming from external audit. It builds the Standards vocabulary that Parts 2 and 3 assume.
  • Part 3 last for most candidates, because it is written for those running the function and benefits from everything else you have learned.

Step 2: Diagnose before you read

Take a set of practice questions for the part before you open the study text. Sort your misses by syllabus section. That tells you where to spend time and keeps you from re-reading what you already know.

Step 3: Study by section weight

Allocate time in proportion to the weights in the syllabus, adjusted for your weak areas. In Part 2, engagement planning at 50% deserves far more time than supervision and communication at 10%. In Part 3, engagement results and monitoring carries 45%.

Step 4: Short daily sessions

Forty-five minutes on most days beats a single long weekend session. Spaced practice is what produces retention, and it fits around audit fieldwork and travel.

Step 5: Read the Standards, not just summaries

The exam is aligned to the Global Internal Audit Standards. Read the relevant Standards themselves for each section, because questions often turn on the exact obligations and wording.

Step 6: Practice under exam conditions

Before each part, complete at least one timed set at full length: 125 questions in 150 minutes for Part 1, 100 questions in 120 minutes for Parts 2 and 3. That is roughly 72 seconds per question, so pacing matters.

Step 7: Schedule the date first

Book your exam date as soon as you purchase a registration. A date turns a study plan into a deadline, and the 180-day validity gives you a natural limit.

Common Mistakes on the CIA Exam

  • Studying from pre-2025 material. The exam was rebuilt around the Global Internal Audit Standards, and older content and terminology may no longer match.
  • Treating it like an external audit exam. Internal audit has its own mandate, reporting lines and independence model.
  • Underweighting engagement planning. It is half of Part 2.
  • Leaving Part 3 too abstract. Think like a chief audit executive reporting to a board.
  • Letting registrations expire. Buy each part's registration when you are ready to sit within 180 days.
  • Forgetting the three-year program clock. Finish the exams and experience inside the eligibility period.

Where Review Materials Fit

The IIA publishes the syllabus and practice resources, and a structured review course organizes the material into lessons, practice questions and timed exams. Our CIA Review Course Package is built for candidates preparing for the CIA exam. Before you buy any review materials, ours included, confirm they reflect the current syllabus aligned to the Global Internal Audit Standards.

For related skills, our internal auditing training courses and audit training courses catalogs cover practical audit topics, and our post comparing CPA career paths shows where internal audit fits among accounting careers.

Frequently Asked Questions

How many parts does the CIA exam have?

The CIA exam has three parts. Part 1, Internal Audit Fundamentals, has 125 questions in 150 minutes. Part 2, Internal Audit Engagement, and Part 3, Internal Audit Function, each have 100 questions in 120 minutes. All are multiple choice and delivered through Pearson VUE at a test center or, for most exams, by online proctoring. The IIA does not prescribe an order, so you can take the parts in the sequence that suits your experience.

What score do you need to pass the CIA exam?

You need a scaled score of 600 on the IIA's reporting scale of 250 to 750 for each part. The IIA converts raw scores to that scale so results are comparable across exam versions. Because scoring is scaled, there is no fixed number of questions you must answer correctly, and you should treat every question as counting. Aim for consistent accuracy across all syllabus sections in practice rather than relying on your strongest areas.

Can I take the CIA exam without internal audit experience?

Yes, if you hold a degree. The IIA lets candidates with a bachelor's or master's degree apply and sit for the exams before the experience requirement is met. You become certified once you verify the required experience: 1 year with a master's degree or 2 years with a bachelor's degree. Accepted experience includes internal audit, risk management, compliance, quality assurance, external audit and internal control roles. Candidates without a degree start with the Internal Audit Practitioner designation.

How long does it take to pass the CIA exam?

It depends on your background and study time, but the IIA sets the outer limit: you have three years from acceptance into the CIA program to finish the requirements, and each exam registration is valid for 180 days. Many working auditors plan one part every few months, starting with the part closest to their daily work. Candidates new to internal audit usually need longer for Part 1 and Part 3.

Which CIA exam part is the hardest?

It varies by candidate. Experienced internal auditors often find Part 2 most familiar because it follows the engagement work they do daily. Candidates from external audit or other fields often find Part 1 demanding because of the Standards vocabulary and internal-audit framing. Many staff auditors find Part 3 the most abstract because it is written from the perspective of someone running the internal audit function and reporting to the board.

Did the CIA exam change recently?

Yes. The IIA revised the CIA exam to align with its Global Internal Audit Standards, which took effect in January 2025. The current exam has three parts: Internal Audit Fundamentals, Internal Audit Engagement and Internal Audit Function, with updated syllabus sections and weights. Study materials written for the earlier exam may use outdated structure and terminology, so confirm any course reflects the current syllabus and check the IIA site for the latest details before you register.

Start Your CIA Prep

Know the current syllabus, pick an order that matches your experience, and study in steady sessions weighted to the sections that count most. The CIA Review Course Package gives you a structured place to do it.