In accounting, CIA stands for Certified Internal Auditor, the only globally recognized professional credential in the internal audit field. It’s issued by The Institute of Internal Auditors (IIA), and it signals that the holder has demonstrated competence in evaluating an organization’s internal controls, risk management, and governance processes. Where a CPA looks outward at financial reporting and tax compliance, a CIA looks inward at whether a company’s own systems are working the way they should.
How a CIA Differs From a CPA
Most people asking about the CIA already know what a CPA is and want to understand how the two relate. They cover different territory with some overlap.
A Certified Public Accountant typically works in public accounting, performing external audits for multiple clients and handling tax preparation, financial reporting under GAAP, and SEC compliance. CPAs often sit at accounting firms that serve outside organizations. A Certified Internal Auditor works inside a single organization, reviewing that company’s processes, identifying inefficiencies, and advising leadership on risk before problems surface in an external audit. CPAs are the outside inspectors; CIAs are the in-house quality team.
The credentials aren’t mutually exclusive. Many professionals hold both, and CPAs who want to pivot toward internal audit work can earn the CIA through an accelerated Challenge Exam pathway.1The Institute of Internal Auditors. Accounting CIA Challenge Exam for CPAs and CAs
What a Certified Internal Auditor Does
A CIA’s day-to-day work centers on evaluating the internal control environment across the entire organization. That covers controls over financial reporting, IT systems, and operational procedures, and it means judging whether those controls are designed properly and actually functioning as intended. When there are gaps, the CIA documents the issue and recommends fixes.
Risk assessment is a major part of the job. CIAs review how management identifies and responds to strategic, financial, and operational risks, then evaluate whether those responses match the organization’s risk tolerance. They also verify compliance with external regulations and internal policies. For publicly traded companies, that often involves reviewing controls required under statutes like the Foreign Corrupt Practices Act, which mandates accurate books and records and adequate internal accounting controls.2U.S. Department of Justice. Foreign Corrupt Practices Act Unit
Fraud: What CIAs Do and Don’t Do
A common misconception is that internal auditors are responsible for preventing fraud. They aren’t. Fraud prevention falls to management as the first line of defense. The CIA’s role is to evaluate whether the controls designed to prevent and detect fraud are actually working, which includes analyzing data for patterns that suggest irregularities and assessing whether further investigation is warranted.
When fraud does occur, the CIA examines how controls failed and recommends improvements. Internal auditors don’t typically conduct fraud investigations themselves unless they have specialized expertise. More often, they flag the issue and recommend that the organization engage forensic accountants, legal counsel, or certified fraud examiners.
Reporting Line
CIAs report directly to the audit committee or board of directors, not to the management team they’re evaluating. That reporting line preserves independence. An internal auditor who reports to the CFO they’re auditing has an obvious conflict. Direct access to the board also ensures findings reach the people with authority to act on them. Formal audit reports detail control gaps, rank them by severity, and recommend corrective actions that drive board decisions about where to allocate resources for remediation.
How to Earn the CIA
Earning the CIA requires meeting education, experience, and examination requirements set by the IIA. The specific combination depends on your educational background.
Education and Experience
The standard path requires a bachelor’s degree (or its international equivalent) plus two years of internal audit experience or equivalent work in external audit, risk management, or quality assurance. Candidates with a master’s degree need only one year of professional experience. All experience must be verified by a supervisor or current CIA before the credential is awarded.3The Institute of Internal Auditors. Certified Internal Auditor
Candidates without a bachelor’s degree can enter through the Internal Audit Practitioner (IAP) certification, a single-exam credential with no degree requirement. Once you hold an active IAP, you can apply for the full CIA program and receive a waiver for Part 1 of the CIA exam, reducing the exam to two parts instead of three.3The Institute of Internal Auditors. Certified Internal Auditor
The Three-Part Exam
The core requirement is passing all three parts of the CIA exam within three years of your application being accepted. If you don’t finish within three years, you’ll need to reapply to the program.4The Institute of Internal Auditors. Certifications Program Changes Frequently Asked Questions
The three parts cover progressively broader material:
- Part 1, Essentials of Internal Auditing, covers the foundation of the profession, including the IIA’s Global Internal Audit Standards and core concepts of internal control. It has 125 multiple-choice questions and a 2.5-hour time limit.
- Part 2, Practice of Internal Auditing, focuses on applying the Standards, managing the audit function, and performing engagement activities. It has 100 questions and a 2-hour time limit.
- Part 3, Business Knowledge for Internal Auditing, covers broader topics like financial management, information technology, and the global business environment. It also has 100 questions and a 2-hour time limit.
All three parts are computer-based and administered at approved testing centers worldwide. Each part is scored on a 250 to 750 scale, and you need a 600 to pass. These exams aren’t easy on the first attempt. Global pass rates hover in the mid-40% to mid-50% range across the three parts, with Part 1 historically the most difficult. Serious preparation, typically 100 to 150 hours of study per part, is the norm.
Challenge Exam for CPAs
Active CPAs and Chartered Accountants from approved accounting bodies worldwide can earn the CIA through a streamlined Challenge Exam instead of the standard three-part process. This single exam doesn’t require proof of internal audit experience and runs during specific testing windows in February, June, September, and November. The next application window opens April 1, 2026, and the exam content will be updated effective June 1, 2026 to align with the new Global Internal Audit Standards.1The Institute of Internal Auditors. Accounting CIA Challenge Exam for CPAs and CAs
Applicants need a letter of good standing from their accounting body and a government-issued photo ID. No extensions are available for the Challenge Exam, so missing your testing window means waiting for the next one.
What It Costs
The financial investment depends on whether you’re an IIA member. For the standard three-part path:5The Institute of Internal Auditors. Internal Audit Certification Pricing
- Application fee: $120 for members, $240 for non-members
- Part 1 exam: $310 for members, $445 for non-members
- Part 2 exam: $280 for members, $415 for non-members
- Part 3 exam: $280 for members, $415 for non-members
Total exam cost lands at $990 for IIA members or $1,515 for non-members, before study materials or prep courses. IIA membership itself costs extra, but the exam savings often offset the dues, especially once you factor in lower annual renewal fees after certification.
Keeping the Credential Active
Practicing CIAs must complete 40 hours of Continuing Professional Education (CPE) every year. Qualifying activities include attending conferences, completing relevant coursework, and teaching in the field.6The Institute of Internal Auditors. CPE Requirements
Annual renewal runs $30 for members and $120 for non-members in active status. IIA members residing in North America get renewal fees included with their membership. Renewal and CPE reporting are handled through the IIA’s Certification Candidate Management System between October 1 and December 31 each year. Missing this window or failing to pay pushes your certification into a grace period with doubled fees: $60 for members and $240 for non-members.5The Institute of Internal Auditors. Internal Audit Certification Pricing
If your certification lapses beyond the grace period, the consequences are steeper than most people expect. You can’t simply pay back fees and catch up on CPE. The IIA requires you to reapply to the certification program and pass the exam again from scratch. That reality alone makes the 40-hour annual requirement worth staying on top of.