Internal audit has one professional certification of its own and a crowd of neighbors. The Certified Internal Auditor is the profession’s designation, and the IIA surrounds it with an entry-level credential, a risk management assurance credential and an accelerated route for qualified accountants and IT auditors. Around them sit the credentials internal auditors most often add or compete with: the CPA and the chartered accountancy qualifications, the CISA for technology audit, the CFE for fraud, the CMA for management accounting and the CFA for investments. Each certifies a different job, costs a different amount of time and money, and opens different doors.
This page compares them all in one place: what each certifies, what the exams involve, what it takes to qualify and keep the credential, what it costs at a first attempt and how long it takes. It then sets out which to earn first by career path, how to sequence two, and where the site’s head-to-head guides go deeper. Figures are those published by the awarding bodies as of September 2026, and each credential’s own guide on this site gives the detail and the sources. If you only need one answer, the next section gives it.
In this guide
- The short answer: which first, by path
- Every credential side by side
- What changed in 2025 and 2026
- The IIA’s own credentials
- Accountancy credentials: CPA, ACCA and CMA
- Technology: the CISA and its neighbors
- Fraud: the CFE
- Investments: the CFA
- Sector and specialist credentials
- Every head-to-head comparison
- Time to credential
- How to choose: five questions
- Sequencing by career stage
- Holding more than one: CPE and dues
- Common mistakes
- Questions auditors ask about certifications
- Related guides
The short answer: which first, by path
For almost everyone who intends to build a career in internal audit, the first credential is the CIA. It is the profession’s designation, its syllabus is the job, and it is the one a search for an audit manager or chief audit executive assumes. The exceptions are people whose path runs through a specialism or through accountancy: IT auditors, who should start with the CISA; fraud investigators, who should start with the CFE; and people at the very start of a finance career in countries where the CPA or a chartered accountancy qualification is the expected foundation. Students and auditors without a degree now enter the CIA through the Internal Audit Practitioner designation.
| Your path | First credential | Usually second |
|---|---|---|
| Generalist internal auditor, staff to manager | CIA | CISA, CFE or an accountancy qualification, depending on the audit plan |
| Aspiring chief audit executive | CIA | CPA, CA or ACCA if the path runs through financial reporting |
| IT auditor | CISA | CIA when you move toward managing engagements or a function |
| Fraud or investigations focus | CFE, or the CIA first if you are in internal audit | The other one |
| Accounting graduate in public accounting (US) | CPA | CIA, through the Challenge Exam, if you move to internal audit |
| Finance graduate in an ACCA country | ACCA | CIA, through the Challenge Exam, once you are a member |
| Management accountant or FP&A professional | CMA | CIA only if you move to the assurance side |
| Auditor near investments or treasury | CIA | CFA Level I as structured learning, if the investment audits are your specialty |
| Student, or auditor without a degree | IAP (CIA Part 1) | The CIA, with the Part 1 waiver |
| Risk management or second-line assurance | CRMA, or the CIA | The other one |
Every credential side by side
The two tables below set the nine credentials internal auditors most often weigh side by side, first by what each certifies and how it is examined, then by what it takes to earn and keep. Fees are first-attempt exam and program fees at the published member or professional price where one exists; memberships, study materials and retakes are extra. Where a figure depends on a jurisdiction or a member category, the credential’s own guide has the full schedule.
| Credential | Awarded by | What it certifies | Exams |
|---|---|---|---|
| CIA | The Institute of Internal Auditors | Internal audit practice to the Global Internal Audit Standards | Three parts: 125 questions in 150 minutes, then 100 in 120 minutes for each of Parts 2 and 3 |
| IAP | The IIA | Entry-level internal audit knowledge | One: CIA Part 1 |
| CRMA | The IIA | Risk management assurance | One: 120 questions in 150 minutes |
| CPA | US state boards of accountancy | A license to practice public accounting in the United States | Four sections of four hours: three core and one discipline |
| ACCA | Association of Chartered Certified Accountants | A full professional accountancy qualification | Thirteen exams at three levels, with exemptions, plus an ethics module |
| CMA | Institute of Management Accountants | Management accounting and financial management | Two parts of four hours: 100 multiple-choice questions and two case-based questions each |
| CISA | ISACA | Information systems audit, control and security | One: 150 questions in four hours |
| CFE | Association of Certified Fraud Examiners | Fraud schemes, investigation and law, prevention and deterrence | Three sections: 120, 120 and 70 questions |
| CFA | CFA Institute | Investment analysis and portfolio management | Three levels, taken in sequence |
The second table turns to what each credential takes to earn and keep: the experience the awarding body verifies before it certifies you, the fees for a first attempt at every exam, and the annual requirement once you hold the letters.
| Credential | Experience to certify | Exam fees, first attempt | Annual upkeep |
|---|---|---|---|
| CIA | One to five years, depending on education | $990 for IIA members, $1,515 for non-members | 40 CPE hours for practicing CIAs, two in ethics; $30 renewal for members |
| IAP | None | $430 for members, $685 for non-members, $210 for students | 20 CPE hours from 2026; $20 renewal for members |
| CRMA | One year with a master’s, two with a bachelor’s, five on the IAP or no-degree routes | $565 for members, $830 for non-members | 20 CPE hours for practicing holders, two in ethics |
| CPA | Usually one year under a licensed CPA; rules vary by jurisdiction | $268.59 per section from July 2026, $1,074.36 for four, plus application and registration fees | About 40 CPE hours a year in most jurisdictions, set by the board |
| ACCA | 36 months with nine performance objectives | About £2,000 across the Applied Skills and Strategic Professional exams, ethics and registration, plus the Applied Knowledge exams and a £140 annual student subscription | 40 units of CPD, at least 21 verifiable; member subscription £326 for 2026 |
| CMA | Two continuous years, which can include auditing | $1,390 for professional members, $1,039 for students | 30 CPE hours, two in ethics; IMA membership and a $30 annual fee |
| CISA | Five years in IS audit, control or security, with up to three substituted | $575 for ISACA members, $760 for non-members, plus a $50 certification application | 20 CPE hours a year and 120 per three-year cycle; $45 maintenance fee for members |
| CFE | Two years of fraud-related experience and 50 qualification points | $480, covering a first attempt at each section | 20 CPE hours, ten related to fraud and two in ethics; ACFE membership |
| CFA | 4,000 qualifying hours over at least 36 months | $3,520 to $4,570 for the three levels at 2026 prices | Annual membership and conduct statement; continuing education encouraged |
Three things stand out once they are side by side. First, only the CIA, the IAP and the CRMA certify internal audit itself; everything else certifies a neighboring profession or specialism that internal auditors borrow from. Second, the cheapest credentials in money are not the cheapest in time: the CFE’s $480 exam fee is one of the lowest in the table, but it needs ACFE membership and two years of fraud-related experience, and the CISA’s single exam sits behind five years of experience. Third, the accountancy qualifications are in a different category of commitment, measured in years rather than months, which is why the IIA lets their holders reach the CIA through a single exam.
What changed in 2025 and 2026
Almost every credential in the table changed in the last two years, which is why so much advice online is out of date. Before you buy study material or plan a route, check it against this list.
| Credential | What changed | What it means for you |
|---|---|---|
| CIA | The 2025 syllabus took effect in English on 28 May 2025; online proctoring ended the same month; delayed scoring began on 1 April 2026 | Use 2025-syllabus material, book a test center, and expect results within about three weeks |
| IAP | The exam became CIA Part 1 in May 2025; the designation became permanent in July 2025; CPE and annual renewal began in 2026 | The IAP is now the route into the CIA for students and auditors without a degree |
| CRMA | The CIA stopped being a prerequisite in July 2025 | Risk professionals can take it without holding the CIA first |
| CIA Challenge Exam | From 1 June 2026, one unified exam for every pathway, year-round applications, four testing windows, seventeen more accounting bodies and an experience-based pilot | More qualified professionals can reach the CIA through one exam |
| CMA | Case-based questions replaced the essays, launched in May 2026 and the only format in IMA’s global exam from September/October 2026 | Essay-era study material is the wrong rehearsal for the second hour |
| CFE | A new three-section exam from 2 June 2026 | Check how any sections passed under the old format transfer |
| CPA | The CPA Evolution exam model since January 2024; alternative licensure pathways in twenty-four jurisdictions by July 2026 | The fifth year of education is no longer the only route in many states |
| ACCA | A redesigned qualification launches in September 2027 | Students starting now will cross the transition; plan the Options with it in mind |
| CFA | No enrollment fee for exams from February 2026 | The entry cost fell, but the three levels still take years |
| CISA | A new job practice took effect in 2024 | Use material written for the 2024 domains |
The IIA’s own credentials
The CIA is, in the IIA’s words, the only globally recognized internal audit certification, held by more than 220,000 people in 170 countries. The 2025 syllabus splits it into Internal Audit Fundamentals, Internal Audit Engagement and Internal Audit Function; the IIA currently publishes pass rates of 44, 48 and 56 percent for Parts 1 to 3. The exams are sat year-round at Pearson VUE test centers, and candidates have three years from approval to complete the program. The CIA exam guide covers requirements, every fee, scoring and study plans, and the site’s free CIA question bank, study planner and flashcards support the preparation.
The Internal Audit Practitioner is the IIA’s entry-level designation. Since May 2025 its exam has been CIA Part 1, it requires no degree, and active holders receive a waiver for Part 1 when they apply for the CIA. For students and auditors without a degree it is now the IIA’s route into the CIA; the IAP vs CIA guide covers the route and its timing traps.
The CRMA, Certification in Risk Management Assurance, certifies the ability to give assurance over risk management. Since July 2025 it no longer requires the CIA; it is a single exam of 120 questions in 150 minutes, weighted toward risk management assurance. It suits auditors who specialize in risk management reviews and second-line professionals moving toward assurance; the CRMA guide weighs whether it is worth it.
The CIA Challenge Exam is not a separate credential but an accelerated route to the CIA: one exam of 150 questions in 180 minutes for qualified CPA and chartered accountant holders from more than thirty approved accounting bodies, for CISA holders and, in a 2026 pilot, for professionals with ten or more years in internal audit or related fields. The fees are $150 and $845 for IIA members, and the Challenge Exam guide explains each pathway.
Retired and specialty credentials. The CGAP, CFSA and CCSA closed to new candidates at the end of 2018, though holders can keep them by renewing; the IIA now offers certificate programs, which are courses with exams rather than designations. The guide to the IIA’s specialty and retired credentials decodes the alphabet. In the UK and Ireland, the Chartered IIA also offers its own routes to chartered membership, alongside the CIA.
Accountancy credentials: CPA, ACCA and CMA
Accountancy credentials matter to internal auditors for two reasons: financial reporting risk is a large part of most audit universes, and audit committees look for financial literacy in the chief audit executive. They are also far larger undertakings than the CIA.
The CPA is a US license granted by state boards, examined through the Uniform CPA Examination. Since January 2024 the exam has three core sections, Auditing and Attestation, Financial Accounting and Reporting, and Taxation and Regulation, plus one discipline section chosen from three. The education rule is where most candidates lose time: the traditional model requires 150 semester hours for licensure, and by July 2026 twenty-four jurisdictions had enacted an alternative pathway, most commonly a bachelor’s degree plus two years of experience. The CIA vs CPA guide compares the two line by line, including three budgets for each.
The ACCA is the global chartered accountancy qualification of the Association of Chartered Certified Accountants, with more than 266,100 members and 546,500 future members in 179 countries. It has thirteen exams, an ethics module and 36 months of practical experience, and a redesigned qualification launches in September 2027. ACCA members, like members of the other approved accounting bodies such as ICAEW, ICAS, CPA Australia, CPA Canada, CA ANZ and the Institute of Chartered Accountants of India, can reach the CIA through the Challenge Exam. The CIA vs ACCA guide covers the exams, fees, the 2027 changes and the Challenge route.
The CMA is the Institute of Management Accountants’ credential for management accounting and financial management in business. Its two parts, Financial Planning, Performance, and Analytics and Strategic Financial Management, replaced their essays with case-based questions in 2026. It overlaps with the CIA on internal controls, risk management and ethics, and IMA counts auditing as qualifying experience, but the CMA is not one of the routes into the CIA Challenge Exam. The CIA vs CMA guide sets out who should earn which.
Technology: the CISA and its neighbors
The CISA, ISACA’s Certified Information Systems Auditor, is the credential IT audit hiring managers look for. It is one exam of 150 questions in four hours, built on the 2024 job practice’s five domains, from the IS audit process to the protection of information assets, scaled from 200 to 800 with 450 to pass. Anyone can sit it; certifying takes five years of IS audit, control or security experience, with up to three substituted. It is also one of the pathways into the CIA Challenge Exam. The CISA guide for internal auditors covers when it is worth it and a twelve-week study plan, and the CIA vs CISA guide compares the two.
As technology audit work deepens, ISACA’s CRISC and CISM and security credentials such as the CISSP become relevant for risk and security specialists. They are the right next step for an IT auditor moving toward technology risk management or security, and rarely the right first credential for an internal auditor. For the audit work itself, the site’s guides to IT general controls and to building the IT audit plan show what the credential should prepare you for.
Fraud: the CFE
The CFE, awarded by the Association of Certified Fraud Examiners, certifies fraud examination: schemes and financial crimes, investigations and law, and prevention and deterrence. Since June 2026 the exam has three sections of 120, 120 and 70 questions, each passed at 75 percent, and it can be sat remotely or at a test center. Candidates need ACFE membership and 40 qualification points to sit and 50 points plus two years of fraud-related experience to certify; the CIA itself is worth ten points. The ACFE reports roughly 60,000 CFEs. The CFE guide for internal auditors covers the points and a ten-week plan, and the CIA vs CFE guide sets out the sequencing.
Investments: the CFA
The CFA charter, awarded by CFA Institute, is the benchmark credential for investment analysis and portfolio management: three levels taken in sequence, about 300 hours of study per level on CFA Institute’s recommendation, and three to four years for most candidates. Recent pass rates were 39 percent for Level I and 43 percent for Level II in May 2026 and 50 percent for Level III in February 2026. It is rarely the right credential for an internal audit career, but auditors who cover treasury, investments or wealth management sometimes take Level I as structured learning. The CIA vs CFA guide explains when that makes sense, and the treasury audit guide shows the work where the two meet.
Sector and specialist credentials
Some sectors have credentials of their own, and in those sectors they can matter as much as a second general credential.
| Sector | Credential | What to know |
|---|---|---|
| Healthcare | CHIAP, from the Association of Healthcare Internal Auditors | Requires internal audit and healthcare experience; the exam has 175 questions, 150 of them scored, in four hours, online proctored; $495 for members and $745 for non-members; 40 CPE hours every two years, including two of ethics |
| Banking and financial services | AML and compliance credentials such as CAMS and CRCM | Valued for compliance and financial crime audits; the financial services guide shows where they fit |
| Government | Government financial management credentials such as the CGFM; the retired CGAP for existing holders | Financial audit under Government Auditing Standards rewards the CPA; internal audit functions in agencies reward the CIA |
| Higher education | No certification; ACUA is the association for college and university auditors | Its conference, journal and guides serve the sector; the CIA remains the credential |
| Risk management | CRMA from the IIA; risk credentials from risk bodies | The CRMA certifies assurance over risk management; second-line risk roles often read risk bodies’ credentials instead |
Every head-to-head comparison
Each comparison below has its own full guide on this site, with exam structures, fees, eligibility, career impact by role, decision tables by candidate profile and common mistakes.
| Comparison | The one-line verdict | Full guide |
|---|---|---|
| CIA vs CPA | Choose by the door: the CPA for public accounting and the finance track, the CIA for an internal audit career; CAE postings often list both | CIA vs CPA |
| CIA vs CISA | The CISA first for IT auditors, the CIA first for generalists; leaders in either track eventually want both | CIA vs CISA |
| CIA vs CFE | The CIA for the profession, the CFE for the fraud specialism; the CIA counts toward CFE eligibility | CIA vs CFE |
| CIA vs CMA | The CIA to audit the finance function, the CMA to run it; internal audit experience counts toward the CMA | CIA vs CMA |
| CIA vs ACCA | A specialist certification against a full accountancy qualification; ACCA members reach the CIA through one exam | CIA vs ACCA |
| CIA vs CFA | Almost never substitutes: the CFA certifies investment analysis, the CIA assurance | CIA vs CFA |
| IAP vs CIA | The IAP is CIA Part 1 with its own designation; the route in for students and auditors without a degree | IAP vs CIA |
| CRMA and the CIA | A risk management assurance specialism that no longer requires the CIA | The CRMA guide |
Time to credential
Time is the cost most candidates underestimate. The table gives realistic ranges for a working professional from starting to study to holding the letters, drawn from the awarding bodies’ own estimates where they publish them and from the site’s credential guides otherwise.
| Credential | Exams | What usually sets the pace | Realistic total |
|---|---|---|---|
| IAP | One exam, about 60 to 100 hours of study | Booking a test center and passing Part 1 | Two to four months |
| CIA | Three parts, a few hundred hours in total | Study time around a full-time job | Six to eighteen months for an experienced auditor; longer where experience is still being earned |
| CRMA | One exam | The experience requirement for newer auditors | A few months of study for someone who qualifies |
| CISA | One exam, three to six months of study | Five years of experience net of substitutions | Months for an experienced IT auditor; three to five years for a new graduate |
| CFE | Three sections inside a 60-day window | Points and two years of fraud-related experience | About ten to twelve weeks of study for a practicing auditor who qualifies |
| CMA | Two parts, about 150 to 170 hours each on IMA’s guidance | Three testing windows a year | Eight to twelve months |
| CPA | Four sections, 300 to 400 hours in total as prep providers quote them | The education requirement and the rolling credit window | Eighteen to thirty-six months |
| ACCA | Thirteen exams, fewer with exemptions | Exam sessions and 36 months of experience | Three to four years at the fastest, on ACCA’s estimate |
| CFA | Three levels, about 300 hours each on CFA Institute’s recommendation | Sequential levels in set windows | Three to four years |
How to choose: five questions
What job do you want in five years? Write down two or three real job titles and look at the credentials their postings name. This single step settles most cases, because credentials are keys to specific doors: the CIA to internal audit leadership, the CPA to public accounting and the finance track in the US, the CISA to IT audit, the CFE to investigations.
What does your employer pay for? Most employers reimburse one credential readily and argue about others. A credential your employer funds, for the job you already hold, is usually the right first one: the study is also training for your current work, and the cost is not yours.
What do you already hold? Existing credentials change the arithmetic. A CPA, a chartered accountant or an ACCA member can reach the CIA through the one-part Challenge Exam, and so can a CISA holder. The CIA is worth ten points toward the CFE and counts toward the CMA’s education requirement.
What does your audit plan contain? An audit plan that is a third technology suggests the CISA as a second credential; one heavy with fraud exposure suggests the CFE; one built around financial reporting and SOX suggests an accountancy credential. The annual risk assessment tells you which risks your function spends its time on.
How much time do you really have? A credential that takes three years only makes sense if you will still want it in three years. Short credentials that fit your current job beat long ones that fit a hypothetical future one, and nothing stops you from adding the long one later.
Sequencing by career stage
| Stage | Typical move | Why |
|---|---|---|
| Student or intern | The IAP at the student price | A passed professional exam on a graduate application, and CIA Part 1 done |
| Staff auditor, years one and two | Start the CIA, or finish it if you hold the IAP | The credential for the job, while the Standards are new and the study doubles as training |
| Senior auditor | Finish the CIA; add a specialism if your plan needs it | The CISA or CFE differentiates you on the engagements you lead |
| Audit manager | Second credential, chosen by the function’s risk profile | Managers are hired for depth in the risks the committee worries about |
| Director and chief audit executive | Keep the credentials current; add one only for a gap the committee sees | At this level the record matters more than letters, but a missing CIA still draws questions |
The certification roadmap by career stage goes further into each stage, and the internal audit career ladder shows what each level is expected to do. For the pay side of the decision, the salary guide explains how to price a credential in a negotiation.
Holding more than one: CPE and dues
Many senior internal auditors hold two credentials, and a few hold three. The recurring cost is mostly dues and reporting, because continuing education overlaps heavily: a course on internal control, fraud, data analytics or ethics usually counts for every body, provided the records meet each body’s rules. Keep one learning log, tag each entry with the categories each body uses, and put every reporting deadline in the same calendar.
| Credential | Annual requirement | What to watch |
|---|---|---|
| CIA | 40 hours for practicing CIAs, 20 for those not practicing; two of ethics | Reporting runs from 1 October to 31 December; the CIA maintenance guide covers what counts |
| CISA | 20 hours a year and 120 per three-year cycle | The annual maintenance fee, and the three-year total |
| CFE | 20 hours, ten related to fraud and two of ethics | The fraud-specific ten; general audit CPE does not fill them |
| CMA | 30 hours, two of ethics | IMA membership must stay active, or the CMA lapses |
| CPA | Usually 40 hours a year or 120 over three, set by each board | Board-specific ethics content and subject-area rules |
| ACCA | 40 units of CPD on the unit route, at least 21 verifiable | The annual declaration |
| IAP and CRMA | 20 hours for practicing holders | The IAP’s renewal requirement began in 2026 |
Common mistakes
| Mistake | What it looks like | Fix |
|---|---|---|
| Choosing by prestige | Earning the credential that sounds most senior rather than the one the next job names | Check the postings for the roles you want |
| Ignoring accelerated routes | A CPA, chartered accountant, ACCA member or CISA holder sitting all three CIA parts | Check the Challenge Exam pathways first |
| Studying from outdated material | Preparing for the 2019 CIA syllabus, the old IAP exam, the CMA essays or the old CFE sections | Confirm the current exam format before buying anything |
| Two credentials at once | Two syllabi, two sets of deadlines, neither passed | One at a time, in the order of the job you hold |
| Letting experience windows lapse | Passing an exam and missing the deadline to prove the experience | Put every program and application deadline in your calendar on the day you pass |
| Paying non-member prices | Registering for an exam without checking what membership saves | Price the membership first; it often pays for itself on the first exam |
| Forgetting that credentials lapse | Letting CPE, dues or renewal slide after the letters arrive | One learning log and one calendar for every body |
Questions auditors ask about certifications
Which internal audit certification is the most respected?
For internal audit itself, the CIA. It is the only globally recognized internal audit certification and the one chief audit executives and audit committees read as proof of command of the Standards; in the IIA’s own member research, 70 percent of chief audit executives said they prefer to hire CIAs. Within specialisms, the CISA and the CFE carry equal weight in their own fields, and the accountancy qualifications carry more weight than any audit credential in finance roles.
Do I need a certification to work in internal audit?
No. Internal audit hires graduates, accountants, IT specialists and career changers without credentials, and most people earn the CIA after joining. Certification becomes more important with seniority, and at manager level and above an internal auditor without one draws questions. The honest assessment of internal audit as a career covers how people get in.
Which certification pays the most?
The published figures come from the awarding bodies’ own surveys and are hard to compare: IMA reports a 21 percent higher median compensation for CMAs than for noncertified peers, and the ACFE’s 2024 compensation guide reported a 32 percent premium for CFEs. Surveys like these measure people who chose to certify, so they overstate what the letters alone are worth. Pay follows the role more than the credential; choose the credential for the role you want and let the pay follow.
Which is the easiest to get?
The IAP is the shortest, one exam with no experience requirement, and the CFE is the quickest specialist credential for an auditor who already qualifies on points and experience. The CIA takes longer but has no education gate once you hold a degree or the IAP. “Easiest” is the wrong test, though: the right credential is the one that opens the door you want, and an easy credential for the wrong door is a year spent on the wrong thing.
Can I get the CIA without sitting three exams?
Yes, if you qualify for the Challenge Exam: qualified CPAs and chartered accountants from approved bodies, CISA holders, and, in the 2026 pilot, professionals with ten or more years in internal audit or related fields. The pilot’s first application cycle runs until 30 September 2026. Everyone else sits the three parts, or Parts 2 and 3 with the IAP’s Part 1 waiver.
Related guides
- The CIA exam, explained — requirements, parts, fees, scoring and study plans.
- A certification roadmap by career stage — what to earn when.
- The CIA Challenge Exam — the one-exam route for qualified holders.
- IAP vs CIA — the entry route for students and auditors without a degree.
- CIA vs CMA — auditing the finance function or running it.
- CIA vs ACCA — certification or full accountancy qualification.
- CIA review courses compared — choosing the study material.
- Internal audit exit opportunities — where the credentials lead outside audit.
- Free CIA practice questions — 156 questions across all three parts.
- The IIA’s specialty and retired credentials — the rest of the IIA’s alphabet.
- Planning your CPE year — one plan that satisfies several credentials.
- Brink’s Modern Internal Auditing by Robert Moeller: Summary and How to Use It — the common body of knowledge, part by part.
Leave a Reply