CIA (Certified Internal Auditor) Explained: Exam, Eligibility and Fast Track

CIA (Certified Internal Auditor), awarded by the Institute of Internal Auditors (IIA), is the leading global qualification specifically for internal audit — a career path many ACCA and CIMA-qualified professionals move into, yet one Learnsignal's blog hasn't covered directly until now.

What CIA is and why internal audit gets its own qualification

Internal audit is a distinct discipline from external audit or financial reporting: it's about independently evaluating an organisation's risk management, internal controls, and governance processes from the inside, reporting to an audit committee or board rather than external shareholders. CIA exists because that specific skill set — risk-based audit planning, control evaluation, internal audit methodology — isn't the core focus of ACCA, CIMA, or most other accounting qualifications, even though internal audit is a common and well-established career destination for people who start in accounting.

Exam structure

The CIA credential is a three-part exam: Part 1 covers internal audit fundamentals, Part 2 covers internal audit engagement, and Part 3 covers the internal audit function more broadly. Candidates must pass all three parts within three years of being approved to sit the exam.

Eligibility — and a fast track for qualified accountants

Standard eligibility runs on a sliding scale based on education: a master's degree requires one year of internal audit experience, while a bachelor's degree requires two years. There's also a route for existing Internal Audit Practitioner (IAP) holders with five years of relevant experience (two of which within the last three years), which waives Part 1 and requires only Parts 2 and 3.

Most relevant for Learnsignal's audience: qualified accountants — including CPA, CA, and CISA holders — are eligible for a one-part Challenge Exam rather than the full three-part sequence, since IIA recognises that a recognised accounting or audit-adjacent qualification already covers a meaningful share of the underlying competency. The IIA has also been actively expanding access to this pathway, including piloting new experience-based routes into the Challenge Exam in 2026, which signals the Institute's continued interest in making CIA more directly accessible to professionals coming from established accounting and audit backgrounds rather than requiring everyone to start from the same first-principles route. ACCA is explicitly recognised by IIA as a qualifying credential for this Challenge Exam route, making CIA a genuinely fast, targeted addition for an ACCA-qualified professional moving specifically into internal audit, rather than a full qualification restart.

What counts as relevant experience

IIA accepts a broader range of experience than "internal audit" alone toward CIA eligibility, including quality assurance, risk management, compliance, external audit, and internal control work — meaning a finance professional with several years in external audit or risk-adjacent roles may already have experience that counts, even without formally being titled "internal auditor." This flexibility matters in practice, since job titles in this space vary considerably between organisations, and someone doing genuinely audit-adjacent work under a different title shouldn't assume they don't qualify without actually checking IIA's specific criteria.

Why this matters for career progression

Internal audit has grown in visibility and strategic importance as organisations face more regulatory scrutiny, more complex risk (cyber, ESG, supply chain), and greater board-level expectations around assurance. Boards and audit committees increasingly expect internal audit functions to provide genuine strategic assurance rather than a purely compliance-checking function, which has raised the bar for what a senior internal auditor is expected to know and demonstrate through formal credentials like CIA. CIA is the credential employers specifically look for when hiring into senior internal audit, audit committee support, or Chief Audit Executive-track roles, in the same way CISA is the recognised credential for IT audit specifically.

Other IIA credentials worth knowing about

CIA sits alongside a couple of other IIA credentials worth being aware of. The Internal Audit Practitioner (IAP) is a lighter-touch, entry-level credential that can serve as a stepping stone toward CIA, with a route that credits IAP holders toward the full CIA (waiving Part 1, as noted above). There's also the CRMA (Certification in Risk Management Assurance), a specialist credential for internal auditors focused specifically on risk management assurance work, which pairs naturally with CIA for auditors whose role leans heavily into enterprise risk.

FAQs

Can I get CIA immediately after finishing ACCA?
You can apply for the Challenge Exam route as an ACCA-qualified accountant, sitting a single exam rather than all three parts — though you'll still need to meet the relevant experience requirement for full certification.

Is CIA the same as CISA?
No — CIA is a broader internal audit credential covering financial, operational, and compliance auditing generally; CISA is specifically focused on auditing information systems and IT controls. Some internal auditors hold both.

Do I need to work in internal audit already to start the CIA process?
Not necessarily — quality assurance, risk management, compliance, external audit, and internal control experience can all count toward the experience requirement, so a career move into internal audit and starting the CIA process can happen together.