In accounting, CIA stands for Certified Internal Auditor, a professional credential issued by The Institute of Internal Auditors (IIA). It is the only globally recognized certification for internal auditors, and it signals that the holder has demonstrated competence in evaluating an organization’s internal controls, risk management, and governance processes. Where a CPA looks outward at financial statements and tax compliance, a CIA looks inward at whether the company’s own systems are doing what they are supposed to do.
How a CIA Differs From a CPA
Most people who ask what CIA means in accounting already know what a CPA is and want to understand how the two fit together. They cover different territory, with some overlap.
A Certified Public Accountant typically works in public accounting, performing external audits for multiple clients and handling tax preparation, financial reporting under GAAP, and SEC compliance. CPAs often sit at accounting firms serving outside organizations. A Certified Internal Auditor works inside a single organization, reviewing that company’s processes, identifying weaknesses, and advising leadership on risk before problems surface in an external audit. CPAs are the outside inspectors; CIAs are the in-house quality team.
The two credentials are not mutually exclusive. Many professionals hold both, and CPAs who want to move toward internal audit work can earn the CIA through an accelerated Challenge Exam pathway.1The Institute of Internal Auditors. Accounting CIA Challenge Exam for CPAs and CAs
What a CIA Actually Does
A CIA’s work centers on evaluating the internal control environment across the organization. That includes assessing whether controls over financial reporting, IT systems, and operational procedures are designed properly and functioning as intended. When controls have gaps, the CIA documents the issue and recommends fixes.
Risk assessment is a major part of the job. CIAs review how management identifies and responds to strategic, financial, and operational risks, then evaluate whether those responses match the organization’s risk tolerance. They also verify compliance with external regulations and internal policies.
One common misconception worth clearing up: internal auditors are not responsible for preventing fraud. That falls to management. The CIA’s role is to evaluate whether the controls designed to prevent and detect fraud are working, flag red flags in the data, and recommend that specialists like forensic accountants or certified fraud examiners handle any actual investigation.
To preserve independence, CIAs report directly to the audit committee or board of directors rather than to the management team they are evaluating. Their formal audit reports rank control gaps by severity and recommend corrective actions for the board to act on.
Requirements to Earn the CIA
Earning the CIA requires meeting education, experience, and examination requirements set by the IIA. The specific combination depends on your background.
Education and Experience
The standard path requires a bachelor’s degree (or international equivalent) plus two years of internal audit experience, or equivalent work in external audit, risk management, or quality assurance. Candidates with a master’s degree need only one year of experience. All experience has to be verified by a supervisor or current CIA before the credential is awarded.2The Institute of Internal Auditors. Certified Internal Auditor
For candidates without a bachelor’s degree, the IIA offers an entry-level route through the Internal Audit Practitioner (IAP) certification. The IAP is a single-exam credential with no degree requirement. Once you hold an active IAP, you can apply for the full CIA program and receive a waiver for Part 1 of the CIA exam.2The Institute of Internal Auditors. Certified Internal Auditor
The CIA Exam
The core requirement is passing all three parts of the CIA exam within three years of your application being accepted. The IIA shortened this window from four years to three in September 2019. If you do not finish within three years, you have to reapply to the program.3The Institute of Internal Auditors. Certifications Program Changes Frequently Asked Questions
The three parts cover progressively broader material:
- Part 1, Essentials of Internal Auditing, covers the foundation of the profession, including the IIA’s Global Internal Audit Standards and core concepts of internal control. It has 125 multiple-choice questions and a 2.5-hour time limit.
- Part 2, Practice of Internal Auditing, focuses on applying the Standards, managing the audit function, and performing engagement activities. It has 100 questions and a 2-hour limit.
- Part 3, Business Knowledge for Internal Auditing, covers broader topics like financial management, information technology, and the global business environment. It also has 100 questions and a 2-hour limit.
All three parts are computer-based and administered at approved testing centers worldwide. Each is scored on a scale from 250 to 750, and you need a 600 to pass. Global pass rates run in the mid-40% to mid-50% range across the three parts, with Part 1 historically the toughest. Typical preparation runs 100 to 150 hours per part.
Challenge Exam for CPAs
Active CPAs and Chartered Accountants from approved accounting bodies worldwide can earn the CIA through a streamlined Challenge Exam instead of the standard three-part process. This single exam does not require proof of internal audit experience and is offered during specific testing windows in February, June, September, and November. The next application window opens April 1, 2026, and the exam content will be updated effective June 1, 2026 to align with the new Global Internal Audit Standards.1The Institute of Internal Auditors. Accounting CIA Challenge Exam for CPAs and CAs
Applicants need a letter of good standing from their accounting body and a government-issued photo ID. No extensions are available, so missing a testing window means waiting for the next one.
What It Costs
Fees depend on whether you are an IIA member. For the standard three-part path:4The Institute of Internal Auditors. Internal Audit Certification Pricing
- Application fee: $120 (members) or $240 (non-members)
- Part 1 exam: $310 (members) or $445 (non-members)
- Part 2 exam: $280 (members) or $415 (non-members)
- Part 3 exam: $280 (members) or $415 (non-members)
That puts total exam costs at $990 for IIA members or $1,515 for non-members, not counting study materials. Membership itself carries its own fee, but the exam savings often offset the dues, and renewal fees drop as well.
Keeping the Credential Active
Practicing CIAs must complete 40 hours of Continuing Professional Education (CPE) every year. Qualifying activities include attending conferences, completing relevant coursework, and teaching in the field.5The Institute of Internal Auditors. CPE Requirements
Annual renewal, including CPE reporting, runs through the IIA’s Certification Candidate Management System between October 1 and December 31. Standard renewal costs $30 for members and $120 for non-members. Members residing in North America have renewal fees included with their membership. Missing the window pushes your certification into a grace period with doubled fees: $60 for members and $240 for non-members.4The Institute of Internal Auditors. Internal Audit Certification Pricing
If a certification lapses past the grace period, the consequences are steeper than most people expect. You cannot simply pay back fees and catch up on CPE. The IIA requires you to reapply to the program and pass the exam again from scratch.