CIA

Overview

The Certified Internal Auditor (CIA) is the global professional credential for internal auditors, awarded by The Institute of Internal Auditors (The IIA). To earn it, you apply to the programme, meet the education and experience rules, and pass a three-part computer-based exam. The IIA says more than 220,000 people in 170 countries hold an active CIA.

Some candidates qualify for a shorter route, the CIA Challenge Exam, which replaces the three parts with a single exam.

Who can apply

Your education decides how much internal audit experience you need.

• Master's degree or equivalent: 1 year of internal audit experience.

• Bachelor's degree or equivalent: 2 years of internal audit experience.

• Internal Audit Practitioner (IAP) holders: 5 years of experience, with 2 of them in the past 3 years, or the degree-based experience above if you also hold a degree.

• No degree yet: The IIA says you first earn the Internal Audit Practitioner designation, then move to the CIA.

The IIA counts experience in internal audit, quality assurance, risk management, audit or assessment work, compliance, external audit and internal control. You show proof of education with transcripts, a degree letter or a credential evaluation letter, and you need valid government photo ID.

Exam pattern

The exam has three parts, taken on computer at secure test centres through Pearson VUE. The IIA does not set the order, so you can sit the parts in any order.

The exam is offered in many languages, including English, French, German, Japanese, Korean, Spanish, Portuguese, Turkish and Thai. Availability of language and syllabus version differs by language, so check the IIA page for yours.

Syllabus

The test specifications give a weighting for each section.

Part 1: Internal Audit Fundamentals

Part 2: Internal Audit Engagement

Part 3: Internal Audit Function

Part 1 builds on the Global Internal Audit Standards, the internal audit charter, independence, the Three Lines Model and ethics. Part 2 covers setting engagement objectives and scope, risk assessment, IT and business-process risks, and planning the approach. Part 3 covers running the audit function, resources, the risk-based audit plan, quality, and reporting results to senior management and the board.

Important dates

You have three years from the date your CIA programme application is accepted to complete the requirements. Once your application is approved, you can register for exam parts, and each registration is valid for 180 days or until your programme expires, whichever comes first.

Fees

The IIA lists these fees in US dollars, valid in the US, Canada and some other countries, as listed on the official site in 2026. Elsewhere, contact your national IIA institute for local rates. All fees are non-refundable and non-transferable.

How to apply

1. Gather proof of education, government photo ID, and a name-change document if your name differs from your degree.

2. Create an account in the IIA's Certification Candidate Management System (CCMS), choose the CIA programme and submit your application with payment.

3. Wait for approval. The IIA emails you when your application is approved.

4. Register for each exam part in CCMS and book your sitting.

The Challenge Exam

The Challenge Exam is a single multiple-choice exam that covers all three parts and takes your existing qualification into account. The IIA offers it to active CPAs and CAs from approved bodies, active CISA holders, and people with 10 or more years of internal audit or related experience.

After the exam

You get one official result within three weeks of your exam date, and the IIA emails you when it is ready. Once certified, you self-attest each year that you have met the renewal requirements, which include continuing professional education (CPE) hours.

FAQs