Every year the IIA audits a percentage of CIA renewals, and for the people selected the question changes from “did I do 40 hours?” to “can I prove that each hour I declared qualifies and was counted correctly?” Most of the claims that fail are real learning, badly counted or badly evidenced. A conference day is logged at eight hours when it contained five and a half hours of instruction. Two presentations of the same talk are both given preparation credit. A book chapter is claimed beyond the cap. Ethics hours sit inside a certificate that does not show them. A certificate is lost in a former employer’s learning system. None of these is dishonest, and all of them can cost the designation. Anyone who fails to provide the audit information by the stated deadline is moved to revoked status, and anyone found short has six months to earn and document the missing hours.
This guide goes through twenty mistakes that make claims fail, in six groups: measurement, category, caps and conversions, evidence, the reporting period, and status and attestation, plus the traps for holders of several credentials. Each group has worked calculations under the IIA’s Annual Certification Renewal Policy, checked in September 2026, and the guide ends with a one-line test for an audit-proof claim. The rules in summary are in the guide to CIA CPE requirements. The renewal and audit process itself is in the step-by-step renewal guide.
In this guide
- How an audit tests your claims
- Measurement mistakes
- Category mistakes: activities that are not CPE
- Cap and conversion mistakes
- Evidence mistakes
- Reporting-period mistakes
- Status and attestation mistakes
- Mistakes for holders of several credentials
- Five cases from the audit file
- The twenty mistakes at a glance
- An audit-proof claim in one line
- Questions about CPE claims
- Related guides
How an audit tests your claims
The policy puts the burden squarely on the certified individual: it is your responsibility to show that an activity qualifies and meets the requirements. A CPE audit therefore works like any other test of a population. Each claim must pass six tests, and a claim that fails any one of them is removed from your total. If what remains is below the requirement, you have a shortfall to make up.
| Test | The question | Where claims typically fail |
|---|---|---|
| Qualifies | Is it a formal program of learning (or a listed contribution category) that meets the policy’s criteria? | Work experience, reading, networking and sales demonstrations claimed as CPE |
| Relevant | Does the content relate to the subject areas of the certification? | Personal-interest courses with no link to internal audit work |
| Measured correctly | Are the hours counted on the 50-minute rule, using instruction time only? | Calendar time, 60-minute hours and rounded-up short sessions |
| Within caps | Are contribution categories within their annual limits? | Presentations, writing and committee work over the cap |
| In the period | Were the hours earned in the year declared, and counted only once? | December and January courses, and hours used for a prior-year shortfall |
| Evidenced | Is there independent written evidence of completion with the required details? | Lost certificates, registration receipts and calendar entries |
The rest of this guide takes the tests in turn. The mistakes are numbered, and the table near the end lists all twenty with their fixes.
Measurement mistakes
The policy measures participation by actual program length, with one 50-minute period equal to one CPE hour. Programs shorter than 50 minutes may be reported in 10- or 25-minute increments. Four mistakes come from ignoring those two sentences.
- Mistake 1: counting 60-minute hours. A six-hour course of instruction is 360 minutes, which is 7.2 CPE hours, not 6. Counting in clock hours understates. Counting the calendar block overstates, which is the more common error.
- Mistake 2: counting breaks, meals, networking and keynotes with no instructional content. A conference day from 9:00 to 17:00 is not eight hours of CPE. Only instruction counts.
- Mistake 3: rounding short programs up to a full hour. A 30-minute live session is not one hour. Under the 10-minute increment it is 0.6. A self-study module is different: claim the credit its sponsor assigns.
- Mistake 4: claiming the scheduled length of a session you left early. A webinar you left after 35 minutes usually earns nothing at all, because most providers require a minimum attendance and polling responses before they issue a certificate. The IIA’s own webinars, for example, require at least 50 minutes and responses to 75 percent of the alertness checks.
| Situation | Wrong claim | Correct claim | Working |
|---|---|---|---|
| Conference day, 9:00 to 17:00, with a 60-minute lunch, two 15-minute breaks, a 30-minute motivational keynote and a 45-minute vendor showcase | 8.0 | 6.3 | 480 minutes less 165 of non-instruction leaves 315; 315 ÷ 50 = 6.3 |
| Three-hour workshop with a 20-minute break | 3.0 | 3.2 | 160 minutes of instruction ÷ 50 = 3.2 |
| 75-minute session | 1.0 or 1.25 | 1.5 | 75 ÷ 50 = 1.5 |
| 30-minute live web session | 1.0 | 0.6 | Three 10-minute increments |
| 45-minute chapter talk | 1.0 | 0.8 | Four complete 10-minute increments; a 25-minute increment would give 0.5 |
| One-hour webinar left after 35 minutes, no certificate | 1.0 | 0 | No evidence of completion; the provider’s attendance rule was not met |
| Self-study course marked by its sponsor as 2.4 CPE, completed in about 90 minutes | 1.8 (time taken) | 2.4 | Self-study is claimed at the credit the sponsor assigns and records on the certificate |
| A certificate showing 8 CPE for a conference with an itemized agenda | 8.0 if the agenda shows 8 hours of instruction | As evidenced | Keep the agenda; the certificate and agenda must agree |
The self-study row surprises people. The policy records hours “as indicated by the course or program sponsor”, and self-study sponsors assign credit by their own measurement method, not by how long you took. Claim what the certificate says, no more and no less. The guide to self-study CPE explains how sponsors set that figure.
Category mistakes: activities that are not CPE
The policy recognizes educational programs and a short list of contribution categories: passing exams, authoring, translating, presenting, volunteering as a subject matter expert, and taking part in external quality assessments. Anything outside those is not CPE, however much you learned from it. Four mistakes account for most of the category failures.
- Mistake 5: claiming work as learning. A first fraud investigation, a new industry, a SOX implementation: all valuable, none of them CPE. Experience is not an educational program.
- Mistake 6: claiming reading and study. Reading the Standards, a journal or a book on your own earns nothing. Reading counts only inside a formal self-study program that meets the policy’s criteria and provides evidence of completion. Exam study earns nothing either. Passing the exam part is what counts.
- Mistake 7: claiming commercial or social sessions. Product demonstrations, vendor showcases, receptions and motivational keynotes are not instruction, even when they appear on a CPE certificate.
- Mistake 8: claiming service outside the listed categories. Volunteering counts when it is as an officer or committee member of the IIA or another professional body related to internal auditing. Sitting on a charity’s board, or on your company’s ethics committee, does not.
| Claim | Qualifies? | Reasoning |
|---|---|---|
| A vendor-run training class on your audit software, with an agenda, exercises and a certificate | Yes | Instruction on a tool used in the work |
| A vendor demonstration of new features at a conference | No | Commercial presentation |
| Your employer’s methodology training, run with objectives and attendance records | Yes | A formal in-house program |
| Writing your function’s methodology manual | No | Internal work product, not a publication |
| A published 1,800-word article on continuous auditing | Yes, 9 hours | Authoring: one hour per 200 words, up to 15 for articles |
| Studying for and passing a CISA exam | The pass: yes, 10 hours; the study: no | Passing an auditing exam is a listed category; preparation is not |
| Serving as treasurer of your IIA chapter | Yes, one hour per 50 minutes of qualifying participation, up to 15 | Volunteer officer of the IIA |
| Serving on the audit committee of a local charity | No | Not a professional body related to internal auditing |
| Mentoring a junior auditor | No | Valuable, but not a listed category |
| Teaching a session in your company’s graduate program on internal controls | Yes, as a presentation | In-house training is named in the presentation category |
| A university course you passed, relevant to your work | Yes | Unless you needed it for the bachelor’s degree, or equivalent, that met the exam’s education requirement |
| A free webcast on personal tax planning | Unlikely | Not related to the subject areas of the certification |
Cap and conversion mistakes
Educational programs have no cap. The contribution categories all do, and each has its own conversion rule. Four mistakes come from this part of the policy, and they are the easiest to check in advance.
- Mistake 9: giving repeat presentations preparation credit. An original presentation earns one hour per 50 minutes of presentation plus preparation credit of three times the presentation time. Subsequent presentations of the same material earn presentation time only, and repeats are capped at five hours a year for a CIA.
- Mistake 10: claiming writing beyond the category caps. Authoring converts at one hour per 200 words. Articles, research papers and blogs stop at 15 hours, books at 25, and accepted IIA exam questions at 20, within an overall authoring cap of 25.
- Mistake 11: counting preparation and report writing in quality assessments. External quality assessment hours are for onsite time only. Advance preparation and writing the report earn nothing.
- Mistake 12: forgetting the combined caps. Volunteering stops at 20 hours in total across committee work (15), guidance contributions (10) and exam content review (20). Presentations stop at 25 in total, including repeats.
| Activity in the year | Raw calculation | Allowed | Rule applied |
|---|---|---|---|
| One original 50-minute presentation | 1 + 3 preparation = 4 | 4 | Presentation plus three times for preparation |
| The same presentation given twice more | 1 + 1 = 2 | 2 | Repeats earn presentation time only (repeat cap 5) |
| One original 100-minute presentation | 2 + 6 preparation = 8 | 8 | Presentation total now 14, within the 25 cap |
| A 2,400-word published article | 2,400 ÷ 200 = 12 | 12 | Articles cap 15 |
| A second article of 1,600 words | 1,600 ÷ 200 = 8 | 3 | Articles together capped at 15 (12 + 3) |
| A 6,000-word book chapter | 6,000 ÷ 200 = 30 | 10 | Books cap 25, but authoring overall is capped at 25, and 15 is already used by articles |
| Twelve 90-minute chapter committee meetings | 1,080 ÷ 50 = 21.6 | 15 | Committee and officer cap 15 |
| Two contributions to IIA guidance | 2 × 5 = 10 | 5 | Guidance cap 10, but volunteering overall is capped at 20, and 15 is already used |
| A one-week external quality assessment, onsite for four days | Onsite time | Up to 10 | One-week assessment cap 10; preparation and report writing excluded |
| Three CPA exam sections passed in the year | 3 × 10 = 30 | 30 | Ten per part, up to 40 in the year passed |
Note what the table shows about the caps. The contribution categories reward real work generously: a single 100-minute talk earns eight hours. But apart from exam passes, no single category can carry a year: presenting stops at 25 hours, authoring at 25 and volunteering at 20. Combined, they could reach 40 only for someone presenting, writing and volunteering at a pace few auditors keep up. Build the year on educational programs and let contributions top it up.
Evidence mistakes
The policy lists what the records should show: the title or content description, the dates, the location, the sponsoring organization, the number of hours as indicated by the sponsor, and a letter, certificate or other written independent attestation of completion. Publications, presentations and committee participation need their own documentation. You must keep all of it for at least three years, and it is not submitted at renewal. Three evidence mistakes come up again and again.
- Mistake 13: relying on proof of registration instead of proof of completion. A receipt, a registration email or a calendar invitation shows that you meant to attend. It does not show that you completed anything.
- Mistake 14: losing certificates to other people’s systems. Employer learning systems, provider portals and transcripts are convenient until you change jobs or the provider changes platforms. Download each certificate the week it is issued.
- Mistake 15: lump-sum certificates with no detail. A conference certificate for “8 CPE” does not show which sessions you attended, which were ethics, or that the hours were instruction. Keep the agenda, marked with the sessions you attended.
| Activity | Evidence that passes | Evidence that fails |
|---|---|---|
| External course or seminar | Certificate with sponsor, title, date and hours | Invoice or receipt |
| Live webinar | Certificate issued after attendance and polling checks | Registration confirmation |
| Conference | Certificate plus the agenda marked with sessions attended | Badge photo or lanyard |
| In-house training | Attendance record with times, agenda with objectives, presenter name | Team meeting invitation |
| Self-study | Completion certificate showing the passed assessment | Course access email |
| Presentation | Program naming you as presenter with date and length | Your slides alone |
| Article or blog | The published piece with your name and date | An unpublished draft |
| Committee work | Organization’s confirmation or minutes recording attendance and meeting length | A profile entry |
Reporting-period mistakes
The renewal period is the calendar year, and the policy’s only flexibility between years is narrow. Surplus hours from the immediately prior period may make up a deficiency in the current one. Hours earned in the next calendar year may make up a deficiency in the year just ended. And no hour may count in both. Two mistakes live at the year boundary.
- Mistake 16: counting the same hours in two periods. A course completed in January and used to repair last year’s shortfall cannot also count for this year. Mark it in the log when you use it.
- Mistake 17: claiming hours in the wrong year. Hours belong to the year in which they were earned: for a course, when you completed it; for a multi-day event, the days attended. A self-study course bought in November and finished in February is a February hour.
| Situation | Counts in | Note |
|---|---|---|
| Self-study bought 20 November 2026, completed 8 January 2027 | 2027 | Completion date decides |
| Two-day conference, 30 and 31 December 2026 | 2026 | Days attended |
| 2025 total of 55 hours; 2026 total of 32 | 2026 renews using 8 of the 15 surplus 2025 hours | Surplus from the immediately prior period may cover a current deficiency |
| 2026 total of 31; renewal missed; 12 hours earned in early 2027 | 9 of the 2027 hours complete 2026 when the prior period is renewed from grace | Those 9 cannot count again for 2027 |
| A course certificate dated in December, logged in January | The certificate’s year | The log date does not move the hour |
| First period after certification (certified March 2026) | March 2026 to 31 December 2027 | First renewal by 31 December 2027; plan on the full annual requirement |
Status and attestation mistakes
Two mistakes are made at the renewal itself, and both turn a counting problem into a conduct problem. The policy states that false information in the self-declaration can lead to disciplinary action, including revocation.
- Mistake 18: declaring a status that halves the requirement. Non-practicing means not performing internal audit or related activities. An auditor who spent the year in a second-line risk or compliance role, or in external audit, is doing related work. Declaring non-practicing to need 20 hours instead of 40 is a false declaration.
- Mistake 19: attesting to ethics hours you cannot show. The attestation asks you to confirm that you completed the two hours of ethics training. If the certificate is not in the folder, you have not. A course from last year (ethics training must take place within the reporting period), a conference session with no itemized record, and reading the Standards do not count.
The guide to CIA ethics CPE covers what counts as ethics training and the fastest legitimate way to complete it. The guide to maintaining the CIA covers which status fits which situation.
Mistakes for holders of several credentials
One mistake covers a family of errors made by CIAs who also hold another body’s credential. Mistake 20 is assuming one body’s rules apply to another. The IIA’s rules are among the least restrictive: any qualifying, relevant program counts, with no accreditation requirement. Other bodies add conditions. A course that is fine for the CIA may fail elsewhere, and a few credits issued by other bodies are restricted to their own credential.
| Assumption | Why it fails | What to do |
|---|---|---|
| “My CPA ethics course covers my CIA ethics, so my CIA ethics course covers my CPA ethics.” | State boards often require their own state-specific ethics course | Take the stricter body’s course; it also counts for the IIA |
| “Twenty hours of anything covers my CFE.” | The ACFE requires at least 10 fraud-related hours and 2 of ethics within its 20 | Tag fraud hours in your log |
| “ISACA hours are just hours.” | From 2027 ISACA requires at least 90 of each 120-hour cycle to align with the certification’s exam content outline | Tag ISACA-aligned hours from 2027 |
| “The magazine quiz credit counts everywhere.” | The ACFE says Fraud Magazine quiz credits apply only to the CFE | Do not claim them for the CIA |
| “An IIA member webinar recording counts for my CPA too.” | Where the IIA marks a recording eligible, it is for IIA CPE only, not NASBA credit | Use live sessions or registered self-study for CPA hours |
| “Passing my CIA parts counts toward my CPA.” | Some state boards limit credit from certification programs | Check your board’s rules before claiming |
The fix is one log with a column for each body, filled in as each activity is logged. The guide to planning your CPE year sets out each body’s rules side by side, and the guides to the CFE and CIA vs CPA cover those credentials. The CPE tracking guide has the log.
Five cases from the audit file
The cases below are composites, built from the patterns above rather than from any individual, but each is the kind of file an audit of CIA renewals produces every year. Each shows the claim as made, what the audit found, and what would have prevented the problem.
The senior auditor and the lump-sum conference
A senior auditor at a regional bank declared 41 hours, including a two-day conference logged at 16 hours from a certificate that said “16 CPE”. The agenda showed that each day ran from 8:30 to 17:00 but included a lunch, two breaks, an awards lunch and an exhibitor hour. Instruction came to about 5.5 hours a day, or 13.2 CPE across the two days. The claim fell by 2.8 hours and the total to 38.2, below the requirement. She had six months to earn the missing hours, which she did with two firm webcasts. What would have prevented it was logging the conference from the agenda rather than the certificate, which would have shown the gap in June, not in the audit.
The manager who gave the same talk three times
An audit manager developed a 50-minute session on continuous auditing and gave it at three chapter meetings, claiming four hours each time, twelve in all. The policy gives preparation credit to the original only, and subsequent deliveries earn presentation time. The correct claim was four for the first delivery and one for each repeat, six in total. The six-hour reduction left him at 37. The fix, had he known, was to vary the talk substantially for each audience or to log the repeats correctly and take one more course.
The chief audit executive who wrote a book chapter
A chief audit executive contributed a 7,000-word chapter to a practitioner book and published two articles in the same year. She claimed 35 hours for the chapter and 20 for the articles, and treated the rest of the year’s courses as surplus. The policy converts at one hour per 200 words, but books stop at 25, articles at 15 and authoring as a whole at 25. Her authoring claim was therefore 25, not 55, and with 12 hours of courses her year totalled 37. The lesson is that authoring tops a year up. On its own it cannot carry one, however much was written.
The auditor who changed employers in November
An IT auditor left one company in November and renewed in December with 44 hours, 30 of them from his former employer’s learning system. When the audit email arrived, he no longer had access to that system. The former employer’s training team eventually supplied a transcript for 22 of the hours. The rest could not be evidenced, and he spent the six-month period earning replacements. Downloading certificates as they were issued, or at the latest before his last day, would have made the audit a formality. The CISA guide covers the separate rules he also had to meet as an ISACA credential holder.
The controls consultant who declared non-practicing
A CIA who had moved from internal audit to a consulting firm’s SOX practice declared non-practicing status and reported 22 hours. Her work was testing internal controls for clients. That is related to internal audit by any sensible reading of the policy, even though the policy does not define related activities. The honest status was practicing, with 40 hours. She corrected it through a support case and completed the hours, but a declaration that halves the requirement is the kind of claim that turns a counting problem into a conduct question. When in doubt, declare practicing.
The twenty mistakes at a glance
| # | Mistake | Why it fails | Fix |
|---|---|---|---|
| 1 | Counting 60-minute hours | The policy’s hour is 50 minutes | Divide instruction minutes by 50 |
| 2 | Counting breaks, meals, networking, keynotes | Only instruction counts | Work from the agenda |
| 3 | Rounding short programs up | Under 50 minutes, 10- or 25-minute increments apply | A 30-minute live session is 0.6 |
| 4 | Claiming sessions you left early | No certificate, no completion | Stay for the attendance rules |
| 5 | Work experience as CPE | Not an educational program | Log learning, not work |
| 6 | Reading and exam study | No program, no evidence of completion | Use structured self-study; claim exam passes |
| 7 | Demos, receptions, motivational talks | No instruction | Claim only instructional sessions |
| 8 | Service outside professional bodies | Not a listed volunteering category | Claim IIA and related professional roles only |
| 9 | Preparation credit for repeats | Repeats earn presentation time only; cap 5 | Mark repeats in the log |
| 10 | Writing beyond the caps | Articles 15, books 25, questions 20, total 25 | Apply caps when logging |
| 11 | Assessment preparation and report writing | Onsite time only | Log onsite days only |
| 12 | Ignoring combined caps | Volunteering 20, presentations 25, authoring 25 | Keep a cap schedule |
| 13 | Registration as evidence | Shows intent, not completion | Keep certificates |
| 14 | Certificates in other people’s systems | Lost when you move or they change platforms | Download the week issued |
| 15 | Lump-sum certificates | No session or ethics detail | Keep the marked agenda |
| 16 | Counting hours twice | No hour counts in two periods | Mark hours used for prior-year shortfalls |
| 17 | Hours in the wrong year | Hours belong to the year earned | Log by completion date |
| 18 | A status that halves the hours | False declaration | Practicing if the work was related |
| 19 | Attesting to missing ethics hours | False attestation | Check the certificate before ticking |
| 20 | Applying one body’s rules to another | Different conditions and restrictions | One log, a column per body |
An audit-proof claim in one line
Every mistake above can be caught at the moment of logging, if each log row carries the six things an audit tests: what it was, who ran it, when, how the hours were counted, which category and cap it falls under, and where the evidence is. The contrast between a weak row and a strong one is the whole of this guide in miniature.
| Field | Weak row | Audit-proof row |
|---|---|---|
| Activity | “Conference” | Regional internal audit conference, day 1: sessions on third-party risk, continuous auditing, and ethics in reporting |
| Sponsor | — | IIA chapter (named) |
| Date | “June” | 10 June 2026 |
| Hours and working | 8 | 6.3 (315 instruction minutes ÷ 50), of which 1.0 ethics |
| Category and cap | — | Educational program; uncapped |
| Evidence | “Email somewhere” | 2026-06-10_Chapter_Conference_6.3h.pdf plus marked agenda |
A log built of rows like the second column makes an audit a matter of exporting a folder. The CPE tracking guide provides the full template.
Questions about CPE claims
How likely is a CPE audit?
The IIA says only that a percentage of certified individuals is selected each year. It does not publish the rate. Assume your renewal will be audited in some year of your career, and keep records that would pass in every year.
What happens if the audit removes some of my hours?
If the remaining hours still meet the requirement, nothing further. If they do not, the policy gives six months to earn the deficient hours and submit the documentation. What costs the designation is failing to respond by the deadline, which moves it to revoked status.
Can I withdraw a doubtful claim before I renew?
Yes, and you should. Your declaration is only as good as your weakest claim. Removing one you cannot evidence, and replacing it with a documented course before 31 December, costs an evening. Defending it in an audit costs far more.
Does the IIA accept hours from any provider?
Yes, if the program meets the policy’s criteria and is relevant. The IIA does not require providers to be accredited or registered. The evidence still has to come from the provider, as an independent written attestation of completion.
Can I claim a course that ran partly in December and partly in January?
Claim the hours in the year they were earned. For a self-study course, that is normally the completion date on the certificate. For a live multi-session program, it is the sessions attended in each year, provided the certificate or attendance record shows them.
Related guides
- CIA CPE requirements — the categories, caps and rules in summary.
- How to renew in CCMS — the checklist, attestation and audit pack.
- Tracking CIA CPE — the log and folder system.
- CIA ethics CPE — what counts toward the two hours.
- How to maintain your CIA — status choices and the way back from grace.
- Planning your CPE year — one plan across several credentials.
- Self-study CPE — how sponsors assign credit.
- Free CIA CPE — free sources that produce proper certificates.
- GIAS Domain II — the ethics you attest to.
- The CIA exam, explained — the hub for every CIA guide.
Leave a Reply