search

What Is a Certified Internal Auditor (CIA)?

9/8/2026

The Certified Internal Auditor is the credential for people whose job is to tell an organization's board and management whether its risk management, controls and governance actually work. It is issued by The Institute of Internal Auditors (IIA), it is recognized worldwide, and it is the only certification built specifically around internal auditing rather than borrowed from external audit or general accounting.

That last point is where most of the confusion starts. People who search for "CIA certification" are often accountants weighing it against the CPA, or staff who have landed in an internal audit department and want to know whether the letters are worth the effort. The short answer is that the two credentials serve different masters. A CPA license is a state-issued license to practice public accounting, including attest work. The CIA is a professional certification that says you can plan and run internal audit engagements, and run an internal audit function, to the IIA's Global Internal Audit Standards.

This guide covers what a CIA does, how the current three-part exam is built, the eligibility routes (including the ones for people without a degree and for existing CPAs), and how to decide whether the credential fits your career.

What a Certified Internal Auditor Actually Does

Internal auditors work for the organization they audit, but they report independently, usually to an audit committee. Their remit is wider than the financial statements. A typical internal audit plan covers operational processes, compliance with laws and policies, IT controls, fraud risk, and the reliability of financial reporting, all chosen on the basis of risk.

The work falls into two broad types:

  • Assurance engagements, where internal audit gives an objective opinion on whether a process, control set or risk response is designed and operating effectively.
  • Advisory engagements, where internal audit helps management improve a process without taking ownership of it.

The CIA certifies that you can do both to a recognized standard. Holders work as internal audit staff and seniors, audit managers, chief audit executives, SOX and controls specialists, risk and compliance leads, and consultants in outsourced or co-sourced internal audit practices. Plenty of external auditors pick it up when they move into industry, because the methodology, independence model and reporting lines are different enough that the external-audit mindset does not transfer cleanly.

If you want the controls side of that work in more depth, our post on the internal controls over financial reporting framework covers how control environments are assessed in practice.

CIA vs. CPA: Different Scope, Not Different Rank

The two are frequently compared as if one were a lesser version of the other. They are not.

 

CIA

CPA

Issued by

The Institute of Internal Auditors

State board of accountancy

Type

Professional certification

State license

Core focus

Internal audit: governance, risk, control, engagement execution

Public accounting, attest, tax, financial reporting

Attest/audit reports on financial statements

No

Yes (the exclusive CPA right)

Exam

Three-part CIA exam

Uniform CPA Examination (three Core sections plus one Discipline)

Geographic reach

Global

State-based, with mobility rules

 

The practical differences:

Only a CPA can sign an audit or review report on financial statements. The CIA does not authorize attest work and does not let you hold yourself out as a CPA.

The CIA goes deeper on internal audit methodology. The CPA exam tests external audit procedures in AUD, but it does not test how to build a risk-based internal audit plan, run a quality assurance program, or report to a board as a chief audit executive. The CIA does.

The CIA is global and carries no state boundary. A CIA who moves countries or states keeps the credential. A CPA has to think about licensure and mobility, which we cover in our post on holding a CPA license in multiple states.

Many internal audit leaders hold both. The CPA opens doors to controller and CFO paths and is often preferred for audit committee-facing roles; the CIA signals internal audit specialism. If you are early in your career and undecided, our comparison of CPA career paths lays out where each route tends to lead.

The CIA Exam: Three Parts, Rebuilt for 2025

The IIA revised the exam to align with its Global Internal Audit Standards, which took effect in January 2025. The updated English-language exam launched in May 2025, and other languages have been transitioning on their own schedules. If you studied from older materials, or a colleague passed under the previous syllabus, be aware that the part titles and section weightings changed, even though the question counts and time limits did not.

Part 1: Internal Audit Fundamentals

125 questions, 150 minutes. This part tests the foundations of the profession: the purpose and mandate of internal audit, independence and objectivity, ethics and professionalism, governance, risk management and control concepts, and fraud risk. The IIA's syllabus weights it as follows:

  • Foundations of Internal Auditing: 35%
  • Ethics and Professionalism: 20%
  • Governance, Risk Management, and Control: 30%
  • Fraud Risks: 15%

Part 2: Internal Audit Engagement

100 questions, 120 minutes. Part 2 is about running an individual engagement from start to finish:

  • Engagement Planning: 50%
  • Information Gathering, Analysis, and Evaluation: 40%
  • Engagement Supervision and Communication: 10%

Half the weight on planning is the tell. The exam expects you to scope an engagement on risk, set objectives and criteria, and design the work program, not just execute testing someone else designed.

Part 3: Internal Audit Function

100 questions, 120 minutes. Part 3 moves from the engagement to the department:

  • Internal Audit Operations: 25%
  • Internal Audit Plan: 15%
  • Quality of the Internal Audit Function: 15%
  • Engagement Results and Monitoring: 45%

Under the previous syllabus, Part 3 was where business knowledge, IT and accounting concepts sat as stand-alone topics. In the 2025 version those subjects are tested in the context of internal auditing rather than as general business knowledge, which is one of the larger shifts for anyone comparing old and new study materials.

Scoring

Each part is scored on a scale from 250 to 750, and a scaled score of 600 or higher passes. The parts are taken separately, so you can schedule them around work and other commitments.

Who Is Eligible: The Current Routes

The IIA sets eligibility, and it has broadened the routes in recent years. As published on the IIA's CIA pages:

Bachelor's or master's degree

The standard route. A master's degree pairs with one year of internal audit experience; a bachelor's degree pairs with two years. You can sit for the exam before you have the experience and complete the experience afterward. The designation is not awarded until the experience is verified.

No degree: the Internal Audit Practitioner (IAP) route

Students and professionals without a degree start with the Internal Audit Practitioner (IAP) designation, which is earned through CIA Part 1. IAP holders then receive a waiver for CIA Part 1 and can apply for the CIA, passing Parts 2 and 3. The trade-off is experience: the IAP route requires five years of internal audit experience, two of them within the past three years, with reductions available to people who later earn a degree. This makes the CIA one of the few respected audit credentials genuinely open to people without a degree, provided they can show the experience.

Existing CPAs, CAs and CISAs: the Challenge Exam

Holders of an active CPA or Chartered Accountant designation from an approved body, and holders of the CISA, can use the CIA Challenge Exam: a single multiple-choice exam that takes the qualifying certification into account. The education requirement is waived. Check the IIA's current list of approved bodies and the Challenge Exam schedule before planning on this route, because it applies only to specific credentials and has its own syllabus.

What counts as experience

The IIA accepts experience in internal audit and related disciplines, including quality assurance, risk management, compliance, external audit and internal control. External auditors are therefore not starting from zero, which is one reason the CIA is a common second credential for people moving from public accounting into industry.

The program clock

Once you are accepted into the CIA program, you have three years to complete the requirements. Applicants also provide proof of education where applicable and a valid government-issued photo ID. Program fees and exam registration fees are published by the IIA and vary by membership status and region, so check them directly rather than relying on figures quoted elsewhere.

How Long It Takes in Practice

Timelines vary widely with how much study time a working candidate can protect, and the three-year program window is the only hard limit. Part 1 is the most conceptual and the easiest to start with for people new to internal audit; Part 2 rewards engagement experience; Part 3 rewards anyone who has seen how an audit department is actually managed.

A sensible sequence for most people:

  1. Confirm your eligibility route (degree, IAP or Challenge Exam) on the IIA site before buying anything.
  2. Apply and get accepted into the program, which starts the three-year clock.
  3. Take Part 1 first unless you already hold the IAP.
  4. Book Parts 2 and 3 once you have seen at least one full engagement cycle at work, because the questions assume judgment that is hard to fake from reading alone.
  5. Submit experience verification once you have the required years.

The single most common mistake is studying from materials written for the pre-2025 syllabus. Before you buy any review course, confirm it is aligned to the 2025 CIA exam.

Preparing for the CIA Exam

Our CIA Review Course Package is the starting point for candidates preparing for the exam. Review the product page for exactly what is included and which syllabus it covers, and compare it against the IIA's published syllabus for each part.

Whatever you use, a few habits make a measurable difference:

  • Read the Global Internal Audit Standards themselves. The exam uses their terminology, and the 2025 revision changed much of it. A candidate who knows the old Standards well can still miss questions on vocabulary alone.
  • Practice questions under time. Part 1 gives you 150 minutes for 125 questions, which is just over a minute per question. Parts 2 and 3 give you 120 minutes for 100.
  • Study planning harder than you think you need to. Engagement Planning is half of Part 2.
  • Connect Part 3 to your own department. Think about how your audit plan is built, how results are tracked, and how quality is assessed. The questions are much easier when you can picture a real function.

If you need more depth on the controls and audit side before you start, our internal auditing training courses and broader audit training courses cover the underlying subject matter.

Is the CIA Worth It?

It depends on where you want to work.

It is a strong fit if:

  • You are in, or moving into, an internal audit department and want a recognized credential for the work you already do.
  • You want to become an audit manager or chief audit executive, where the CIA is commonly listed in job postings.
  • You are an external auditor moving into industry and want to show you understand internal audit as its own discipline.
  • You do not have a degree but do have internal audit experience, and the IAP route gives you a realistic path.
  • You work in, or want to work in, risk, compliance or SOX roles where internal audit methodology is the core skill.

It is a weaker fit if:

  • You want to sign audit reports or run a public accounting practice. That requires a CPA license.
  • Your work is mainly tax. The enrolled agent and CPA routes are the relevant comparison.
  • You want maximum optionality early in your career and are undecided between industry and public accounting. The CPA is broader, and many people add the CIA later through the Challenge Exam.

For a wider view of the credential landscape, see our overview of accounting certifications and designations.

The Bottom Line

The CIA is the profession's internal audit credential: global, focused and practical. It does not compete with the CPA for attest work, and it does not try to. What it certifies is the ability to plan engagements on risk, gather and evaluate evidence, report to management and the board, and run an internal audit function to the Global Internal Audit Standards. For anyone whose career is in internal audit, risk or controls, that is exactly the right thing to certify.

If you are ready to start, look at the CIA Review Course Package and check it against the 2025 syllabus for each part, then confirm your eligibility route with the IIA before you book your first exam.

Frequently Asked Questions

What is CIA certification?

The Certified Internal Auditor is a professional certification issued by The Institute of Internal Auditors. It certifies that the holder can perform internal audit engagements and run an internal audit function in line with the IIA's Global Internal Audit Standards. It is recognized globally and is the only certification designed specifically for internal auditors. Earning it requires passing a three-part exam (or the Challenge Exam for eligible CPAs, CAs and CISAs), meeting an education or practitioner route, and verifying qualifying work experience.

How many parts are on the CIA exam and how long is each?

The CIA exam has three parts. Part 1, Internal Audit Fundamentals, is 125 questions in 150 minutes. Part 2, Internal Audit Engagement, is 100 questions in 120 minutes. Part 3, Internal Audit Function, is 100 questions in 120 minutes. Each part is scored on a 250-750 scale, and a scaled score of 600 or higher passes. The current syllabus was revised to align with the Global Internal Audit Standards, and the updated English exam launched in May 2025.

Can I become a Certified Internal Auditor without a degree?

Yes. Candidates without a degree start by earning the Internal Audit Practitioner (IAP) designation through CIA Part 1. IAP holders receive a waiver for Part 1 when they apply for the CIA and then pass Parts 2 and 3. The trade-off is experience: this route requires five years of internal audit experience, two of them within the past three years, with reductions for candidates who later earn a degree. Confirm the current rules on the IIA site before applying.

How much experience do I need for the CIA?

It depends on your education. The IIA pairs a master's degree with one year of internal audit experience, a bachelor's degree with two years, and the IAP route with five years. Experience in related fields such as quality assurance, risk management, compliance, external audit and internal control can qualify. You can sit for the exam before completing the experience, but the designation is not awarded until the experience is verified, and you have three years from acceptance into the program to finish.

Is the CIA harder than the CPA?

They test different things, so difficulty is not a straight comparison. The CPA exam covers a much wider body of knowledge, including financial accounting, tax and regulation, external audit and a discipline section, and leads to a state license. The CIA is narrower but deeper on internal audit methodology, governance and running an audit function. Accountants with external audit experience often find CIA Part 1 familiar, while Parts 2 and 3 reward hands-on internal audit judgment.

Can a CPA get the CIA faster?

Often, yes. Holders of an active CPA or Chartered Accountant designation from an IIA-approved body, and CISA holders, can take the CIA Challenge Exam, a single multiple-choice exam that takes the existing certification into account, with the education requirement waived. Check the IIA's current list of approved bodies, the Challenge Exam syllabus and the testing schedule before relying on this route, because it applies only to specific credentials.