Audit and accounting professionals can choose from four credentials that come up together: the CPA, the CIA, the CISA and the CFE. They are not ranked versions of the same thing. One is a state license with legal consequences; the other three are professional credentials from membership bodies, each aimed at a specific kind of work. The right choice depends on what you want to sign, test or investigate.
This comparison uses the issuing bodies' published rules as of November 2026. Each body can change them, so check its page before you commit. Detailed guides: CIA, CISA and CFE.
What is the core difference between them?
The CPA is a license issued by a state board of accountancy. State law determines who may use the title and who may issue audit and other attest reports. For audits of public companies, the firm must also be registered with the PCAOB. A credential from the IIA, ISACA or the ACFE does not carry that legal authority. It shows you passed that body's exam and met its experience and ethics requirements.
| CPA | CIA | CISA | CFE | |
|---|---|---|---|---|
| Issued by | State boards of accountancy | The Institute of Internal Auditors (IIA) | ISACA | Association of Certified Fraud Examiners (ACFE) |
| Nature | License | Credential | Credential | Credential |
| Focus | Accounting, audit and attest, tax | Internal audit practice and governance | Information systems audit, control and security | Fraud prevention, detection and investigation |
| Legal authority | Attest reports and the CPA title, set by state law | None | None | None |
| Rules vary by state | Yes | No | No | No |
How do the entry requirements compare?
CPA. Requirements are set by each state board, and they differ. The long-standing path is 150 semester hours of education, passing the Uniform CPA Examination and a period of experience. Many states have adopted or are adopting a newer path that requires a bachelor's degree in accounting (120 semester hours), two years of professional experience and the exam. The NASBA and AICPA model legislation behind it requires each state to enact it, and effective dates vary by state. Under the updated model law, a CPA's right to practice across state lines depends on the individual's own education, exam and experience rather than on whether the home state's rules match the other state's. Read your own board's current rules, and the 150-hour rule entry for background.
CIA. A bachelor's degree and two years of internal audit experience, or a master's degree and one year, plus passing three exam parts within three years of applying (the IIA also sets a three-year program window). An active US CPA license exempts you from the education requirement.
CISA. Five years of information systems audit, control, assurance or security experience within the 10 years before you apply, with up to three years of that waivable through education and general work. You must pass the exam within five years before applying.
CFE. An ACFE Associate Member needs 40 points to sit for the exam and 50 points to be certified. A bachelor's degree earns 40 points. Certification also requires two years of professional experience related to fraud detection or deterrence.
How do the exams compare?
| CPA | CIA | CISA | CFE | |
|---|---|---|---|---|
| Structure | 4 sections: 3 core (AUD, FAR, REG) and 1 discipline (BAR, ISC or TCP) | 3 parts | 1 exam | 3 sections |
| Length | 4 hours per section | Part 1: 125 questions, 150 minutes. Parts 2 and 3: 100 questions, 120 minutes each | 150 questions, 4 hours | 120 and 120 questions at 2.5 hours each; 70 questions at 1.5 hours |
| Scoring | Scaled, 75 to pass each section | Set by the IIA; see its candidate materials | Scaled 200 to 800, 450 to pass | Handbook sets the passing score |
| Window | State boards set credit rules | 3 years from program acceptance; each registration lasts up to 180 days | Pass within five years before applying for certification | See the ACFE candidate handbook |
The CPA exam is the longest by testing time: four sections of four hours each is 16 hours of exam time. The CFE totals 6.5 hours of testing. For deeper detail on any one exam, use the guides linked above.
How do the maintenance requirements compare?
- CPA. State boards set CPE for license renewal, usually a multi-year total with an annual minimum and sometimes a required ethics course. See CPE.
- CIA. 40 hours a year for practicing holders, with at least two on ethics.
- CISA. 120 hours per three-year cycle with at least 20 each year, plus an annual maintenance fee.
- CFE. 20 credits each year, of which 10 must address fraud detection and deterrence and 2 must address ethics.
Hours for one body do not automatically count for another. A course on fraud controls can often satisfy a CPA board, the CFE and the IIA, but each body sets its own content and reporting rules, so keep one record and tag each hour by what it can count toward.
Which credential fits which audit career?
| If your work is... | Start with | Why |
|---|---|---|
| Financial statement audit at a CPA firm | CPA | State law requires the license for signing reports. |
| Public company audit | CPA | The firm must be PCAOB registered, and the CPA license is the base credential for the people who sign. |
| Internal audit department or co-sourced internal audit | CIA, with a CPA if you came from external audit | The CIA tests the IIA Global Internal Audit Standards. |
| SOX testing | CIA or CPA; CISA for the IT side | Business-process testing leans on the CIA and CPA. ITGC testing leans on CISA. |
| IT audit, ITGC testing, SOC reports, technology risk | CISA | The five domains cover systems operations, protection of assets, and governance of IT. |
| Fraud risk assessment and investigations | CFE | Exam sections cover fraud schemes, investigations and legal issues, and prevention. |
| Forensic accounting and litigation support | CPA plus CFE; the AICPA's CFF is the CPA-specific option | See the forensic accountant career guide. |
| Government and nonprofit audit | CPA | Audits of governments and federal award recipients are generally performed by licensed CPA firms, and state rules apply. See financial audit vs single audit vs Yellow Book. |
Where do the credentials overlap?
- CPA and CIA. The overlap is in risk assessment, internal control and evidence. The CPA exam tests external audit under AICPA standards; the CIA tests internal audit under IIA standards. Read internal audit vs external audit.
- CPA and CISA. The overlap is in ITGCs and IT-dependent controls within the audit. The CPA exam includes a discipline section on information systems, but it does not replace a dedicated IT audit credential.
- CPA and CFE. The overlap is in fraud risk. AU-C 240 sets the auditor's responsibilities on fraud in a financial statement audit, and SAS 151, issued by the Auditing Standards Board on October 14, 2026, supersedes it; the CFE goes further into investigation technique and the legal framework. See fraud risk assessment under AU-C 240.
- CIA and CISA. Internal audit teams that cover IT often need both: the CIA for audit method and governance, the CISA for systems and security controls.
Worked example: a three-year credential plan
Illustrative. A staff auditor at a regional CPA firm wants to move to internal audit at a bank in about three years. She holds a bachelor's degree and two years of experience, and she is licensed in her state.
- Year 1. She already holds the CPA license. She applies to the CIA program. Her active CPA license exempts her from the education requirement, and her two years of audit experience count because external audit is one of the IIA's qualifying fields.
- Years 1 to 3. She registers for one part at a time. At up to 180 days per registration, three registrations use up to 540 days, which fits the three-year window with room to retake.
- Year 2. She starts building IT audit experience by testing ITGCs. A bachelor's degree waives two years of the CISA's five, so she needs three years of qualifying IS audit work. If she adds one year of separate general audit work, the cap of three waived years applies, and she needs two years of direct experience.
- CPE. She tags each hour by body (CPA board, CIA, CISA) and checks that her ethics hours satisfy each requirement.
The plan is a sketch. A different employer, state or goal changes the order.
What mistakes do candidates make?
- Treating the CIA, CISA or CFE as a substitute for the CPA license. None authorizes attest work.
- Using a state's rule from a general article when the board's own page differs, especially for CPA education and experience, where many states have changed their rules recently.
- Choosing by popularity instead of by the work. A CFE adds little for a candidate who will never do fraud examination.
- Counting experience that does not match the body's definition. The IIA, ISACA and ACFE each define qualifying experience in their own terms.
- Ignoring maintenance cost. Each credential adds CPE tracking and annual reporting.
Frequently asked questions
Which is better, the CPA or the CIA?
They do different jobs. The CPA is a state license for accounting, tax and attest work, including signing audit reports. The CIA is an internal audit credential. Choose by whether you want to sign reports or lead an internal audit function.
Can a CPA get the CIA without a degree requirement?
An active US CPA license exempts you from the CIA's education requirement. You still need the internal audit experience and must pass the three exam parts.
Is CISA useful for a financial auditor?
It is useful if you test ITGCs or technology controls as part of audits or SOX work. It does not add attest authority.
Do I need the CFE to work in forensic accounting?
No credential is legally required. Many forensic practitioners hold a CPA, a CFE or both, and some CPAs add the AICPA's CFF.
Which credential takes the least time to earn?
The CFE has the shortest total exam time at 6.5 hours, and the CPA the longest at 16 hours. The CIA and CISA depend on experience requirements, and CISA waivers can reduce the direct experience needed.
Do the requirements differ by state?
For the CPA license, yes: state boards of accountancy set education, experience, exam credit and CPE rules, and many states have recently changed their education paths. The CIA, CISA and CFE are set by their issuing bodies and are the same everywhere. Each board's rules are on its own page in the state hub.
Sources
- NASBA, New CPA Licensure Pathways and CPA Mobility (December 23, 2025), nasba.org
- NASBA, CPA Exam, nasba.org/exams/cpaexam
- AICPA and CIMA, Everything You Need to Know About the CPA Exam, aicpa-cima.com
- The Institute of Internal Auditors, CIA Certification: Requirements and CPE Requirements, theiia.org
- ISACA, Get CISA Certified, isaca.org, and CISA Maintenance Requirements
- ISACA, Certification Exam Candidate Guide (2026), isaca.org
- ACFE, CFE Credential Eligibility, acfe.com/cfe-credential/eligibility, About the CFE Exam and CPE Requirements
- Sarbanes-Oxley Act of 2002, section 102 (registration of public accounting firms), congress.gov
Part of CORAA University · Quality management and practice: related guides, calculators and templates.
AU-C references are to AICPA Professional Standards, paraphrased here; read the standard itself before relying on a requirement. This page is guidance, not professional advice. Report an error