Forty hours a year is the floor of the CIA requirement, not the goal. The Global Internal Audit Standards say internal auditors must maintain and continually develop their competencies (Standard 3.2), and that each internal auditor is responsible for continually developing the competencies their responsibilities require (Standard 3.1). A CPE plan is how those two sentences become something concrete. It decides in January what the year’s hours are for, so they build a skill the next engagement or the next role needs, instead of being whatever webinar ran in December. For anyone who also holds a CPA license, a CISA or a CFE, the plan does a second job: one set of well-chosen courses can satisfy every body at once.
This guide builds that plan in five steps. First, find the gap, using the audit plan, your next role and the IIA’s competency framework. Second, stack the requirements of every credential you hold. Third, find the overlap. Fourth, choose sources and budget. Fifth, put the hours in the calendar. It closes with plans by career stage, a team version for chief audit executives, and the mid-year review. The CIA rules are in the guide to CIA CPE requirements. Other bodies’ rules below were checked on their own sites in September 2026.
In this guide
- Why plan at all
- Step 1: find the gap
- Step 2: stack the requirements
- Step 3: find the overlap
- Step 4: choose sources and budget
- Step 5: put it in the calendar
- Planning around the Topical Requirements
- A one-page plan, filled in
- Plans by career stage
- Planning a non-practicing year
- Planning for a team
- Reviewing the plan during the year
- Planning mistakes
- Questions about planning CPE
- Related guides
Why plan at all
Unplanned CPE has a recognizable shape. A few courses early in the year, nothing through the busy months, and a scramble in the fourth quarter for whatever is available and cheap. It meets the requirement, usually. It rarely develops anything, and it produces the December renewals and weak evidence that cause most of the problems covered elsewhere in this series. Planned CPE has a different shape: the ethics hours in the first quarter, depth in one or two subjects the year actually needs, and free sources filling the rest at a steady pace.
The Standards give the planned version an official footing. They require continuing professional development, not just CPE hours, and an external quality assessment will ask how the function’s development is linked to its work. The individual benefit is simpler. Four hundred hours over a decade is a lot of learning, and a plan decides whether it adds up to a career or to a pile of certificates.
Step 1: find the gap
Four sources tell you what the year’s CPE should be for. Use all four, then pick one or two priorities. A plan with seven priorities has none.
- Next year’s audit plan. Which engagements need skills you do not have yet? A first cloud review, full-population analytics, a third-party engagement under the new Topical Requirement, a culture audit.
- Last year’s work. Where did review notes, quality findings or an audit committee question expose a weakness? Report writing and sampling show up here more often than technical subjects.
- Your next role. The move from senior to manager, or manager to chief audit executive, calls for leadership, planning and stakeholder skills that fieldwork does not teach.
- The IIA’s competency framework. The Internal Auditing Competency Framework, updated in June 2025, is the profession’s map of what internal auditors need to know. Rate yourself against it once a year.
The framework groups competencies into four categories: internal auditing, professional, governance and risk management, and operational areas. Each competency has four proficiency levels: basic, intermediate, advanced and expert. Data analysis sits in the professional category, sustainability and organizational resilience in governance and risk management, and cybersecurity and information technology in operational areas. The table shows how the categories translate into typical gaps and the CPE that closes them.
| Framework category | Typical gaps | CPE that closes them |
|---|---|---|
| Internal auditing | Applying the Global Internal Audit Standards and Topical Requirements; engagement planning; sampling; findings and reporting | Standards and Topical Requirement courses; methodology training; report-writing workshops |
| Professional | Data analysis; communication; influence; critical thinking; project management | Analytics courses built on real data; writing and presentation training; facilitation practice |
| Governance and risk management | Risk assessment; governance; fraud risk; sustainability and resilience | Risk and governance programs; fraud risk courses; resilience and sustainability sessions |
| Operational areas | Cybersecurity and IT; industry and process knowledge | IT audit and cyber courses; industry updates; process-specific training for the audit universe |
Turn the result into two lines at the top of the plan, for example: “Priority 1: full-population analytics for the accounts payable and payroll engagements (12 hours). Priority 2: writing shorter, sharper findings (6 hours).” Everything else in the year fills around those two. The site’s guides to data analytics skills, soft skills and the IIA Topical Requirements are starting points for the most common priorities.
Step 2: stack the requirements
Next, write down every requirement you face in one place. For a CIA with no other credential this is short: 40 hours, two of ethics, in the calendar year, renewed between 1 October and 31 December. For a multi-credential holder it is the heart of the plan, because the bodies differ in amount, cycle, ethics rules and subject requirements. The table sets out the main credentials held alongside the CIA, as each body published its rules in September 2026.
| Credential | Hours | Ethics | Other conditions | Year and deadline |
|---|---|---|---|---|
| CIA (IIA) | 40 practicing, 20 non-practicing | 2 a year | Educational programs uncapped; contribution categories capped; no accreditation required | Calendar year; renew 1 October to 31 December |
| CRMA, IAP (IIA) | 20 practicing, 10 non-practicing | 2 a year | Relevant CIA hours can cover these too | As for the CIA |
| CISA, CRISC, CISM (ISACA) | 20 a year minimum and 120 over three years | None; comply with ISACA’s code | From 2027, at least 90 of the 120 must align with the certification’s exam content outline; hours can count for several ISACA credentials | Calendar year; three-year cycle |
| CFE (ACFE) | 20 a year | 2 a year | At least 10 fraud-related; up to 10 can carry over if the fraud and ethics minimums are met | Ends with your anniversary month |
| CMA (IMA) | 30 a year | 2 a year | IMA membership must be kept; up to 10 can carry over | Calendar year |
| CPA (model rules) | Minimum 20 a year, average 40 (120 over three years) | Average 2 a year | At least half technical; each state sets its own rules | Varies by state |
| CPA, New York | 24 (concentrated) or 40 a calendar year | 4 every three calendar years | No carryover | Calendar year |
| CPA, California | 80 over two years, at least 20 a year | 4 per two-year period; a two-hour Board-approved Regulatory Review course every six years | Extra requirements for accounting and auditing work, including fraud hours | Two-year license period |
| CPA, Texas | 120 over three years, at least 20 a year | A four-hour Board-approved Texas ethics course every two years | No carryover | Birth-month deadline |
| ACCA | 40 units a year | No fixed minimum | At least 21 verifiable units; employer and IFAC-body routes available | Calendar year; declare by 1 January |
| CFA charter (CFA Institute) | 20 credits encouraged | 2 standards, ethics and regulations credits encouraged | Voluntary for charterholders | Program year |
| CISSP (ISC2) | 120 over three years; 40 a year suggested | None | 90 must be Group A | Three-year cycle |
Two features of the table drive the rest of the plan. The IIA’s rule is the most permissive: any qualifying, relevant program counts, with no accreditation or subject minimums. The other bodies add conditions: fraud hours for the CFE, exam-outline alignment for ISACA from 2027, technical hours and state ethics for CPAs. The strategy follows directly. Choose courses that meet the strictest body’s condition, and they will almost always count for the CIA as well.
Step 3: find the overlap
The IIA’s policy neither mentions nor forbids reporting the same course to other bodies. Its only rule on counting hours twice concerns its own designations and its own reporting periods. So a relevant course can generally serve several credentials, provided each body’s own conditions are met and nothing in their rules restricts it. A few providers do restrict their credit. The ACFE, for example, says its Fraud Magazine quiz credits apply only to the CFE. The worked plan below is for a CIA who also holds the CISA and the CFE, which is a common combination in IT and fraud-heavy functions.
| Activity | Hours | CIA | ISACA: aligned to the CISA outline? | ACFE: fraud-related? | Ethics |
|---|---|---|---|---|---|
| IIA on-demand course on ethics under the Standards | 2.2 | Yes | No | No | 2.2 |
| IT general controls and cybersecurity audit course | 12 | Yes | Yes | No | 0 |
| ISACA member webinars: IT risk, cloud, AI governance | 12 | Yes | Yes | No | 0 |
| Cloud or AI auditing on-demand course | 6 | Yes | Yes | No | 0 |
| ACFE sponsored webinars on fraud schemes | 4 | Yes | No | Yes | 0 |
| Fraud data analytics course | 6 | Yes | No | Yes | 0 |
| Chapter meetings: third-party risk and the Topical Requirements | 2 | Yes | No | No | 0 |
| Total | 44.2 | 44.2, with 2.2 ethics | 30 aligned | 10 fraud-related | 2.2 |
Read the totals against each requirement. The CIA needs 40 with two of ethics, and gets 44.2. ISACA needs 20 a year and 120 over three years. From 2027 at least 90 of those 120 must align with the exam content outline, which averages 30 aligned hours a year, and the plan provides exactly that. The ACFE needs 20 a year with 10 fraud-related and 2 of ethics. The plan supplies the fraud and ethics hours, and the rest of the ACFE’s 20 comes from the plan’s other hours, as far as the ACFE accepts them as relevant. Check each body’s own rules before relying on a column. The point of the method is that one set of 44 hours does the work of three separate plans.
Overlap fails in predictable places. State CPA boards may require their own ethics course. Some boards limit how much credit certification programs can provide. Recordings that the IIA accepts may not carry NASBA credit for a CPA. And each body has its own year: the ACFE’s ends with your anniversary month, and ISACA runs a three-year cycle. Keep one log with a column for each body, as the CPE tracking guide describes, and the overlap stays visible.
Step 4: choose sources and budget
With the priorities and the overlap settled, choose where each block of hours comes from. The general rule is to pay for depth and take breadth free. The priority subjects get a structured course: a certificate program, a multi-hour workshop or a well-reviewed self-study series. Updates, general risk and control topics, and much of the ethics come from free sources: member benefits, firm webcasts, chapters and employer training. The guide to free CIA CPE lists the free sources and their credit rules. The guide to affordable CPE compares paid options per hour, and the guide to online CPE covers formats and how to vet providers.
| Block of the plan | Hours | Best source | Why |
|---|---|---|---|
| Priority skill 1 | 8 to 16 | A structured course or certificate program, paid if necessary | Depth needs structure and practice |
| Priority skill 2 | 4 to 8 | A workshop, a self-study series, or an in-house session built around your own work | Applied learning sticks |
| Ethics | 2 | An IIA member course, a chapter session or an employer session, in the first quarter | It cannot be left to December |
| Standards and Topical Requirements | 2 to 4 | IIA webinars, chapters | The requirements change; keep current |
| Breadth and updates | 10 to 20 | Firm webcasts, member webinars, chapter meetings | Free, current, easy to fit around fieldwork |
| Contribution | 0 to 8 | A presentation of what you learned to your team | Spreads the learning and earns presentation credit |
Step 5: put it in the calendar
A plan that lives in a spreadsheet and not in the calendar is a wish list. Book the priority course and the ethics hours now, with dates, around the fieldwork calendar you already know. Then set a light rhythm for the breadth hours, such as one webcast a fortnight or one chapter meeting a month, and put the three control dates in: 30 June for the mid-year check, 1 September for the pre-renewal checklist, and early October to renew. The guide to fitting CPE into a busy year shows quarter-by-quarter patterns for functions with heavy seasons.
Planning around the Topical Requirements
One input deserves its own step because it comes with dates. The IIA’s Topical Requirements are mandatory for assurance work: depending on the function’s risk assessment, internal auditors must apply a requirement when providing assurance services on its topic, and for advisory work the IIA recommends them without requiring them. Four have been issued, each effective a year after release. If next year’s audit plan touches one of them, the learning belongs in the plan before the engagement starts, and ideally before the requirement takes effect.
| Topical Requirement | Issued | Effective | Plan the learning |
|---|---|---|---|
| Cybersecurity | 5 February 2025 | 5 February 2026 | Now in force; build cyber audit skills before the next cyber engagement |
| Third-Party | 15 September 2025 | 15 September 2026 | Now in force; before any third-party or outsourcing engagement |
| Organizational Behavior | 15 December 2025 | 15 December 2026 | In 2026, before culture and behavior engagements scheduled for 2027 |
| Organizational Resilience | 30 April 2026 | 30 April 2027 | In the first half of 2027, before resilience engagements |
| Anti-Corruption | To be issued in the fourth quarter of 2026, per the IIA | About a year after issue, if the pattern holds | Watch for release; plan for 2027 or 2028 |
| Talent Management | Public consultation planned for January 2027 | Not yet set | Follow the consultation |
Two to four hours per requirement is usually enough to understand what it demands of an engagement: a session from the IIA or a chapter, followed by reading the requirement against your own audit program. The site’s guides to the Cybersecurity Topical Requirement and the Third-Party Topical Requirement map each requirement to audit steps, which makes a good basis for an in-house session.
A one-page plan, filled in
The five steps produce a plan that fits on one page. The example below is for a senior auditor at a manufacturer who holds the CIA only, works in a function with a modest training budget, and wants to move toward IT audit over the next two years. Every line is something they can act on in January.
| Plan line | Entry |
|---|---|
| Status and requirement | Practicing CIA: 40 hours, 2 of ethics, renew in early October |
| Priority 1 | IT general controls and access reviews, for the ERP upgrade review in the third quarter: 12 hours |
| Priority 2 | Writing findings that land with management, after review notes on the last two reports: 6 hours |
| Ethics | IIA member course on ethics under the Standards, January: 2.2 hours |
| Standards and Topical Requirements | Cybersecurity Topical Requirement session, February; third-party session, chapter, May: 4 hours |
| Breadth | Firm webcasts on controls and technology risk, fortnightly outside fieldwork: about 14 hours |
| Contribution | Present what I learn on access reviews to the team in October (original, 50 minutes): 4 hours |
| Total planned | About 42 hours |
| Budget | $290 IIA membership (employer); $450 for the IT controls course (employer, business case tied to the ERP review) |
| Calendar | Course booked for April, before fieldwork; webcasts on alternate Tuesdays outside fieldwork; 30 June and 1 September checks |
| Longer aim | Decide by year end whether to start the CISA next year |
Laid out by quarter, the same plan looks like this. The ethics and the priority course come before the fieldwork that needs them, and the contribution comes last, when there is something to share.
| Quarter | Planned activity | Hours | Running total |
|---|---|---|---|
| January to March | Ethics course; Cybersecurity Topical Requirement session; six fortnightly webcasts | 2.2 + 2 + 6 = 10.2 | 10.2 |
| April to June | IT controls course (12); third-party session at the chapter (2); three webcasts (3) | 17 | 27.2 |
| July to September | Findings-writing workshop (6); two webcasts (2); fieldwork on the ERP review | 8 | 35.2 |
| October to December | Team presentation on access reviews (4); three webcasts (3); renew in early October if at 40, otherwise in November | 7 | 42.2 |
Note the business case in the budget line. The course is tied to a named engagement, which is what gets training funded, and the October presentation turns one person’s course into the team’s learning. The guide to affordable CPE has a one-page funding request in the same shape.
Plans by career stage
The same 40 hours should buy different things at different points in a career. The table suggests where the depth should go at each stage. The breadth, the ethics and the Standards updates stay constant.
| Stage | Where the depth should go | A typical 40-hour mix |
|---|---|---|
| Staff auditor, first CIA years | Audit craft: sampling, evidence, workpapers, findings; one technical area (analytics or IT) | 12 craft, 8 technical, 2 ethics, 18 breadth |
| Senior auditor | A specialism the function needs; writing and presenting; engagement planning | 12 specialism, 6 communication, 2 ethics, 20 breadth |
| Audit manager | Leading teams; review and coaching; risk assessment and audit planning; stakeholder management | 10 leadership, 8 planning and risk, 2 ethics, 20 breadth, perhaps a first presentation |
| Chief audit executive | Governance and the audit committee; strategy; the Standards’ Domain III and IV duties; emerging risks | 10 governance and strategy, 8 emerging risk, 2 ethics, 20 breadth and contribution |
Moves between stages are the best moments to change the plan’s depth. The internal audit career ladder sets out what each level is expected to do, and the certification roadmap covers when a second credential makes sense, which changes the plan again.
Planning a non-practicing year
A CIA on a career break, on parental leave or working outside audit and risk for a while declares non-practicing status and owes 20 hours, two of them ethics. It is tempting to treat those hours as a formality. The better use is to plan for the return. Twenty hours is enough to keep the Standards current, follow the Topical Requirements as they take effect, and keep one technical skill from going stale. A returning auditor who has kept up with the profession is far easier to hire than one who has not.
| Block | Hours | Purpose |
|---|---|---|
| Ethics | 2 | The annual requirement |
| Standards and Topical Requirements | 6 | Returning current, not two cycles behind |
| One technical skill | 8 | Keeping analytics or IT audit skills usable |
| The target sector | 4 | Industry updates for where you plan to return |
| Total | 20 | Non-practicing requirement met, with a plan for re-entry |
Free member webinars and on-demand courses make this easy without an employer’s budget. Declare practicing again at the first renewal after you return to internal audit or related work. The guide to maintaining the CIA covers how status choices work.
Planning for a team
A chief audit executive’s version of this exercise starts from the audit plan rather than the individual. List the skills next year’s engagements need, compare them with the skills the team has, and assign the gaps. Some go to individuals as their priority, some are covered by in-house sessions for everyone, and some by co-sourcing where building the skill would take too long. Individual plans then inherit their priorities from the function’s plan, which is how CPE starts to serve the audit plan instead of competing with it.
| Audit plan need | Team capability now | Response | CPE produced |
|---|---|---|---|
| Full-population testing in payables and payroll | One auditor with scripting skills | Two auditors take a 12-hour analytics course; the specialist runs three 100-minute in-house sessions | 24 course hours; 6 hours each for the team; presentation credit for the specialist |
| First engagement under the Third-Party Topical Requirement | General awareness only | A two-hour in-house session on the requirement, using the site’s mapping | 2 hours each |
| Cloud security review | No cloud experience | Co-source the engagement; one auditor shadows and takes a cloud audit course | 6 to 12 hours for one auditor |
| Culture audit | No behavioral methods | Ethics session built on culture cases; a behavioral interviewing workshop | 2 ethics hours for everyone; 4 hours for the engagement team |
The GIAS Domain IV guide covers the chief audit executive’s resourcing duties. The Third-Party Topical Requirement guide is one example of material a two-hour in-house session could be built on.
Reviewing the plan during the year
Plans meet reality, and three events should trigger a review. The first is the mid-year check on 30 June: are you at 20 hours or more, is the ethics done, and has the priority course happened? The second is a change in the audit plan. An engagement added or dropped changes which skills matter, and the plan should follow. The third is an engagement that exposes a gap nobody saw. A finding the team struggled to write, or an analysis nobody could run, belongs in this year’s plan if there is time, and next year’s if not. Each review takes ten minutes, and together they keep the plan honest.
| Trigger | Question | Typical action |
|---|---|---|
| 30 June | At least 20 hours? Ethics done? Priority course taken or booked? | Book the missing pieces for the third quarter, before the renewal window |
| The audit plan changes | Does a new or dropped engagement change which skill matters most? | Swap a priority; move a course before the new engagement’s fieldwork |
| An engagement exposes a gap | What could the team not do, and would training fix it? | Add a short course now, or make it next year’s priority |
| A job or status change | Has the requirement changed (practicing or non-practicing), or the next role? | Adjust the hours and the priorities to match |
| A new credential or Topical Requirement | Is there a new body’s rule or a new requirement to meet? | Add it to the requirement stack and re-check the overlap |
Keep the changes on the plan itself, with a date and a reason. At the year end, the plan and its changes show how your learning followed the work. That is the kind of evidence of continuing professional development the Standards have in mind, and it makes next year’s plan quicker to write.
Planning mistakes
| Mistake | What happens | Better |
|---|---|---|
| Too many priorities | Hours spread thin; no skill actually built | One or two priorities a year |
| All breadth, no depth | Forty hours of updates and nothing you can now do that you could not before | At least one structured course in a priority skill |
| A plan that is not in the calendar | The fourth-quarter scramble anyway | Book the priority course and the ethics hours in January |
| Ethics left to the end | A December search for a qualifying course | Ethics in the first quarter |
| Planning for the CIA alone when you hold other credentials | Duplicate courses, or a missed fraud or state-ethics requirement | Stack every requirement before choosing courses |
| No link to the audit plan | Training that competes with the work instead of preparing for it | Priorities drawn from next year’s engagements |
| Never revisiting the plan | A plan for an audit plan that changed in March | Review at mid-year and whenever the audit plan changes |
| Buying hours instead of skills | Money spent on compliance that free sources would have covered | Pay for depth; take breadth free |
Questions about planning CPE
Can one course count for the CIA and my CPA license?
Often, yes. The IIA accepts any qualifying, relevant program. Your state board decides what it accepts, usually programs from registered sponsors in recognized fields of study, and it may require its own ethics course. Choose courses that satisfy the board, and they will generally satisfy the IIA too.
I hold the CIA and the CRMA. Do I need 60 hours?
No. The IIA’s policy lets hours earned for its other designations apply toward the CIA. A practicing CIA and CRMA holder who completes 40 hours relevant to internal auditing and risk management assurance meets both requirements.
What if my audit plan has no obvious skills gap?
Then plan for your next role or for the risks the profession sees rising. The IIA’s Risk in Focus 2026/2027 survey put cybersecurity and digital disruption, including artificial intelligence, at the top of chief audit executives’ risk rankings, with digital disruption and geopolitical uncertainty rising most. Either is a sound default priority.
Should the plan include a second certification?
Only if the credential serves where your career is going. Exam study earns no CPE, but the policy gives ten hours for each part passed of an accounting or auditing exam, up to 40 in the year, and names the CIA, CPA and CA as examples. A year spent passing CPA sections can therefore cover much of the CIA requirement while building a specialism. The CISA is a single exam, so it could earn ten hours at most, and the policy names neither it nor the CFE, so confirm with the IIA before counting either. The certifications compared guide helps decide which, if any.
How detailed should the plan be?
One page. The priorities and their hours, the ethics booking, the sources for the breadth hours, the budget, the dates and the review points. Anything longer tends not to be read again. The value is in deciding the priorities and booking them, not in documenting every webinar in advance.
Does my manager need to approve my CPE plan?
Not for the IIA, which asks only that the hours qualify. But a plan agreed with your manager is far more likely to happen, because it gets time as well as money. If your function sets development objectives, make the CPE plan part of them.
My employer’s training calendar is fixed. Can I still plan?
Yes. Treat the employer’s sessions as the base and plan around them. Count what the calendar already gives you, find where it falls short of your priorities, and fill that gap with targeted courses or self-study. A fixed calendar usually covers breadth well and depth poorly, which is exactly where your own plan should focus.
What should a chief audit executive’s own priorities be?
Usually the things only the chief audit executive does: working with the board and audit committee, setting strategy, meeting the Standards’ governance and management requirements, and understanding the emerging risks the plan has to cover. The team’s technical skills are better developed through the team’s own plans than through the chief audit executive’s CPE.
Related guides
- CIA CPE requirements — the rules the plan must satisfy.
- CPE for busy auditors — scheduling the plan around fieldwork.
- Tracking CIA CPE — one log for several credentials.
- Free CIA CPE — the breadth hours, free.
- Affordable CPE — paying for depth.
- CIA ethics CPE — the two hours, and other bodies’ ethics rules.
- What internal auditors need to learn now — the trends behind next year’s priorities.
- CISA for internal auditors — ISACA’s rules in full.
- The CFE for internal auditors — the ACFE’s rules in full.
- The CIA exam, explained — the hub for every CIA guide.
Leave a Reply