Certified Internal Auditor (CIA): Requirements, Exam Parts and Annual CPE

The Certified Internal Auditor (CIA) is the credential issued by The Institute of Internal Auditors (IIA) for internal audit professionals. It is not a license. No state requires it, and it does not authorize anyone to sign an audit report on financial statements. It signals competence in the practice defined by the IIA's Global Internal Audit Standards, and many internal audit departments, audit committees and job postings treat it as the expected qualification for the function.

This guide reflects the IIA's published requirements as of November 2026. The IIA can change fees, exam content and renewal rules, so use its certification pages for the current version before you register.

Who is the CIA for?

The CIA fits people who work inside an organization's internal audit function, or who provide internal audit services under a co-sourced or outsourced arrangement. That includes staff auditors, audit managers, chief audit executives, and CPAs who move from external audit into internal audit, SOX testing or risk and compliance roles. For how the two disciplines differ, see internal audit vs external audit and the internal audit guide.

What are the CIA requirements?

The IIA sets three requirements: education, professional experience and passing the exam. You apply to the program first, then you have three years from acceptance to complete the exam parts.

Other points from the IIA's requirements page:

• Qualifying experience. The IIA accepts experience in internal audit, quality assurance, risk management, audit or assessment disciplines, compliance, external audit and internal control.
• Education proof. You submit a degree copy, official transcripts, a university letter or an evaluation service letter.
• US CPAs. Holders of an active US CPA license are exempt from the education requirement. The experience requirement still applies.
• ACCA members. Qualified ACCA members are exempt from both education and experience requirements.
• Internal Audit Practitioner (IAP). The IIA offers a separate entry-level credential, the IAP. Holders with an active IAP take only Parts 2 and 3 for the CIA, because Part 1 is waived. The experience years in the table above still apply, and candidates with no degree and an active IAP need five years of experience, two of them in the past three years.
• Challenge exam. The IIA also offers a one-sitting challenge exam that covers content from all three parts. It is open to active CPA and CA holders from approved bodies and to active CISA holders, with a different fee. Check the IIA's page for whether applications are open.

Fees differ for IIA members and nonmembers and the IIA has announced a price change effective January 2027, so the figures are not repeated here. The IIA lists the application fee and per-part fees on the CIA page. All fees are non-refundable and non-transferable.

What are the three CIA exam parts?

The IIA's exam content follows its Global Internal Audit Standards, which took effect in January 2025. The three parts can be taken in any order.

Each registration is valid for 180 days or until your program expiration date, whichever comes first. If you do not sit the exam in that period you forfeit the registration. Results are issued within three weeks of the exam date.

Part 1: Internal Audit Fundamentals

Section A covers the purpose, mandate and charter of internal audit, assurance versus advisory services, independence, and the Three Lines Model. Section B covers integrity, objectivity and due professional care. Section C covers how internal audit evaluates governance, risk management and internal controls, which overlaps with the COSO framework. Section D covers fraud risk, the fraud triangle and the internal auditor's role in prevention and detection.

Part 2: Internal Audit Engagement

This is the part closest to day-to-day audit fieldwork: setting objectives and scope, risk assessment for an engagement, designing procedures and work programs, sampling and analytics, evaluating evidence, and supervising the work. A CPA will recognize the logic from audit evidence, audit sampling and audit documentation, applied to operational, compliance and IT engagements as well as financial ones.

Part 3: Internal Audit Function

Part 3 covers managing the function: budgeting, staffing, managing external providers, the risk-based audit plan, the quality assurance and improvement program, communicating results, and following up on management's action plans. The IIA's 2025 syllabus tests business, IT and financial topics inside these sections, in the context of internal auditing, rather than as a separate business knowledge part.

If you studied from older material, note that the previous syllabus had different parts and weights (for example, a Part 3 called Business Knowledge for Internal Auditing). Use study materials that match the current syllabus. The IIA states that exam topics and format are subject to change as approved by its Professional Certifications Board.

How do you maintain the CIA?

Certified individuals renew annually through the IIA's certification management system. The IIA's renewal policy requires:

• CPE hours. A practicing CIA holder reports 40 hours of CPE each year. The requirement differs for nonpracticing and retired status, and the IIA's renewal policy sets those rules.
• Ethics training. At least two hours on ethics each year. These count toward the annual total.
• Standards conformance. An annual statement on whether you conform with the Standards.
• Ethics attestation. An annual attestation that you will abide by the IIA's Standards of Ethics and Professionalism and have had no criminal convictions since the prior reporting period.

Reporting runs through the end of the calendar year; the IIA's page says renewal opens on 1 October and closes on 31 December. If you miss it, the certification enters a two-year grace period during which you cannot use the designation. If the designation is revoked after the period ends, a CIA holder can restore it by applying for recertification and passing CIA Part 1.

CPE hours can count toward more than one IIA credential. A CIA and a CRMA holder who completes 40 hours related to both internal auditing and risk management assurance can apply them to both. CPE is also a feature of the CPA license. The CPE glossary entry describes how state boards and the AICPA set CPA hours. Hours earned for one body do not automatically satisfy the other, so track each body's content and reporting rules separately.

Worked example: planning the three-year window

Illustrative. A candidate with a bachelor's degree and 18 months in a SOX testing role applies to the program. She needs 2 years of experience, so she will have it six months from now, and she has three years (36 months) to pass all three parts.

She registers for one part at a time. Each registration lasts at most 180 days, so three sequential registrations use up to 540 days, about 18 months, which fits well inside the 36-month window and leaves a retake buffer. She takes Part 2 first because it matches her current work, then Part 1, then Part 3. If she fails a part, she registers again within the same program window. The math only breaks if she lets registrations lapse: a forfeited registration is not refunded.

Is the CIA worth it for a CPA?

It depends on where the career is going. A CPA in external audit already holds the state license that governs attest work, and the CIA does not replace it. For a CPA moving into an internal audit department, a chief audit executive path, or SOX and operational audit roles, the CIA documents knowledge of the IIA standards that the CPA exam does not test directly. The CPA exemption from the education requirement and the existence of a challenge exam for CPAs reduce the entry effort. See the comparison of CPA, CIA, CISA and CFE.

Common mistakes

• Studying from the 2019 syllabus after the exam changed.
• Letting a part registration expire after paying for it.
• Assuming the CPA license covers the experience requirement. It covers education only.
• Counting a CPA-board CPE course toward IIA hours without checking it against the IIA's own policy.
• Missing the 31 December renewal deadline and entering the grace period.

Frequently asked questions

How many parts is the CIA exam?

Three. Part 1 has 125 questions in 150 minutes. Parts 2 and 3 each have 100 questions in 120 minutes.

How long do you have to pass all three CIA parts?

Three years from acceptance into the program. Each part registration is valid for 180 days or until the program expires, whichever comes first.

Do CPAs need a degree to get the CIA?

An active US CPA license exempts you from the education requirement. You still need the internal audit experience.

Can you take the CIA exam parts in any order?

Yes. The IIA does not require a sequence.

How many CPE hours does a CIA need each year?

Practicing holders report 40 hours, including at least two on ethics.

Does the CIA let you sign audit opinions?

No. Issuing an audit report on financial statements is governed by state accountancy law and, for public companies, PCAOB registration. The CIA is an internal audit credential.

Do the rules differ by state?

The CIA is set by the IIA and is the same in every state. The CPA license is the credential that varies by state, including its education, experience and CPE rules. Each state board of accountancy publishes its own rules; start from the state hub.

Sources

• The Institute of Internal Auditors, CIA Certification: Requirements, theiia.org/en/certifications/cia
• The Institute of Internal Auditors, CIA Exam Syllabus pages, theiia.org/en/certifications/cia/exam-prep-resources/exam-syllabus
• The Institute of Internal Auditors, CIA Exam: Why and How It's Changing (V1.05.2024), theiia.org
• The Institute of Internal Auditors, Expanded Test Specifications for CIA Parts 1, 2 and 3 (V2.09.2024), theiia.org
• The Institute of Internal Auditors, CPE Requirements, theiia.org/en/certifications/already-certified/cpe-requirements
• The Institute of Internal Auditors, Annual Certification Renewal Policy, theiia.org

AU-C references are to AICPA Professional Standards, paraphrased here; read the standard itself before relying on a requirement. This page is guidance, not professional advice. Report an error