What is the CIA exam?
The CIA is awarded by the Institute of Internal Auditors and is the standard qualification for internal audit professionals worldwide. Where ISACA's CISA focuses on auditing information systems, the CIA covers the internal audit function as a whole: its mandate and independence, how engagements are planned and executed, and how the audit function itself is governed and measured.
The exam was rewritten for the Global Internal Audit Standards that took effect in January 2025, with the new version launching in English in May 2025. The three parts were renamed at the same time: Internal Audit Fundamentals, Internal Audit Engagement, and Internal Audit Function. Material written against the older Essentials, Practice and Business Knowledge structure is out of date.
All three parts are multiple choice and must be passed within three years of being accepted into the programme. Certification also requires an education qualification, relevant experience and a character reference.
Who sits it
- Internal auditors and internal audit managers
- Chief audit executives and audit committee support staff
- Risk, compliance and internal control professionals
- External auditors moving into internal audit
Exam format at a glance
- Parts
- Three: Internal Audit Fundamentals, Internal Audit Engagement, and Internal Audit Function
- Part 1
- 125 multiple-choice questions, 2.5 hours
- Parts 2 and 3
- 100 multiple-choice questions each, 2 hours each
- Delivery
- Pearson VUE test centres, on demand with no fixed windows; online proctoring was withdrawn in May 2025
- Fees (USD)
- Application $120 for IIA members or $240 otherwise, plus $310/$445 for Part 1 and $280/$415 for each of Parts 2 and 3
- Eligibility
- A master's degree plus one year of experience, a bachelor's plus two years, or the Internal Audit Practitioner certification plus five years. Holders of the CPA, CA or CISA have the education requirement waived
- Time limit
- Three years from acceptance into the programme, extendable once by 12 months for $275; passed parts are otherwise forfeited
- Passing standard
- A scaled score of 600 or higher on a 250–750 scale
- Pass rate
- The IIA does not routinely publish one
- Syllabus version
- Aligned to the Global Internal Audit Standards, effective January 2025
Exam-body facts last checked September 2026. Fees, dates and formats change; confirm the current details with The Institute of Internal Auditors (IIA) before registering.
Syllabus and topic weights
Weights from the IIA's current expanded test specifications, published against the Global Internal Audit Standards. Note that some pages on the IIA's own site still serve the retired 2019 syllabus, and much third-party material repeats its older weights.
- 1.Part 1 — Foundations of Internal Auditing35%
- 2.Part 1 — Governance, Risk Management, and Control30%
- 3.Part 1 — Ethics and Professionalism20%
- 4.Part 1 — Fraud Risks15%
- 5.Part 2 — Engagement Planning50%
- 6.Part 2 — Information Gathering, Analysis, and Evaluation40%
- 7.Part 2 — Engagement Supervision and Communication10%
- 8.Part 3 — Engagement Results and Monitoring45%
- 9.Part 3 — Internal Audit Operations25%
- 10.Part 3 — Internal Audit Plan15%
- 11.Part 3 — Quality of the Internal Audit Function15%
How to prepare for CIA
- 1
Check that any study material you buy is written for the post-2025 syllabus. The part names and the domain weights both changed, and older material is easy to mistake for current.
- 2
Part 2 is the most concentrated: engagement planning alone is half of it, and information gathering and analysis another 40 percent. There is very little else in that paper.
- 3
Part 1 is the broadest and carries the ethics and fraud material, which candidates coming from an external audit background often underestimate.
- 4
Watch the three-year clock. Parts you have passed are forfeited if you do not finish in time, which is a harsher rule than most comparable certifications.
- 5
Answer as an internal auditor reporting to an audit committee, not as a manager fixing the problem. The correct option is usually the one that preserves independence.
We don't cover CIA yet
We have no CIA study material. Our CISA content is the closest thing we offer: more than 900 practice questions and 204 lessons on the IS audit process, governance and management of IT, operations and resilience, and protection of information assets. The governance, risk and control material in CISA Domain 2 overlaps meaningfully with CIA Part 1.
CIA FAQ
How is the CIA different from the CISA?
The CIA covers internal auditing as a discipline across any subject matter. ISACA's CISA covers the audit and control of information systems specifically. Many practitioners hold both, and we do have CISA material.
Can I sit the exams without a degree?
Not directly. Candidates without a degree take the Internal Audit Practitioner certification first, which then serves as the education qualification, with a longer experience requirement.
Does the IIA publish pass rates?
Not as a routine release. Figures circulating for the three parts come from prep providers citing IIA data, and their vintage is usually unclear.
Does StudyOptima have CIA questions?
No, and none are planned at present. Our CISA material covers IT audit in depth, and the governance, risk and control concepts overlap substantially with CIA Part 1.
Related exams
Certified Information Systems Auditor: the globally recognised credential for professionals who audit, control and assure information systems.
Certified Information Systems Security Professional: the benchmark certification for security leadership across eight domains of the ISC2 Common Body of Knowledge.