The CIA renewal is done in the IIA’s Certification Candidate Management System (CCMS) between 1 October and 31 December, and it takes a few minutes if the year’s work is in order. It is not an upload. You do not list your courses or attach certificates. You make a self-declaration: your status, that you have met the CPE requirement including the two ethics hours, and four attestations about your conduct. Then you pay any fee and submit. The records behind the declaration stay with you. If your renewal is picked for audit, an email arrives straight after you submit, and you have six months to produce the evidence.
Because the renewal itself is short, almost everything that goes wrong happens before or after it. Hours are counted wrongly, the ethics certificate is missing, the email address is stale, the fee is misunderstood, or the deadline passes. This guide works through the year end in order: the checklist before you log in, the steps in CCMS as the IIA describes them, the attestations, the fees, the audit, renewing a lapsed year from grace, special cases and a timeline. The rules come from the IIA’s Annual Certification Renewal Policy and its renewal and pricing pages, checked in September 2026. CCMS screens change from time to time, so follow the on-screen instructions where they differ in detail. What counts as CPE, and how much of each kind, is in the guide to CIA CPE requirements.
In this guide
- What the renewal is, and what it is not
- Before you log in: the pre-renewal checklist
- The renewal in CCMS, step by step
- The four attestations
- Fees and payment
- After you submit: confirmation and the audit
- Building an audit pack in an afternoon
- Renewing a lapsed year from grace
- Special cases
- A year-end timeline
- Running renewals for a team
- Mistakes at renewal time
- Questions about the CIA renewal
- Related guides
What the renewal is, and what it is not
The CPE year is the calendar year: the policy’s renewal period begins on 1 January and ends on 31 December, and the renewal must be completed in CCMS by 31 December. The renewal window opens on 1 October. The IIA also says plainly that you do not need to wait until the end of December. The policy says supporting documentation, such as certificates, should not be submitted during the renewal. It also says it is the certified individual’s responsibility to show that each activity qualifies. The renewal is a declaration made on your own authority, and your records are what back it up.
| Item | What applies |
|---|---|
| Where | CCMS, the IIA’s certification system, at ccms.theiia.org (some national institutes handle renewals for their members) |
| When | 1 October to 31 December; hours earned 1 January to 31 December |
| What you declare | Your status, compliance with the hour and ethics requirements, and four attestations |
| What you submit | Nothing but the declaration and any fee; no certificates |
| Hours owed (CIA) | 40 practicing, 20 non-practicing, 0 retired; two ethics hours in each year that requires hours |
| Fee (CIA) | Included for IIA members in North America with an active designation; $30 for other members; $120 for non-members |
| Per designation | Each IIA designation you hold is renewed; one set of relevant hours can cover the CIA and another IIA designation |
| Audit | A percentage of renewals is audited; the notice comes by email straight after you submit; six months to complete |
| Records | Keep all supporting documentation for at least three years |
| If missed | Grace Period (Inactive) status from 1 January; revoked after more than 24 months in grace |
Two things the renewal is not. It is not your IIA membership renewal: the two are separate, and a lapse in one does not renew or cancel the other. And it is not optional for anyone who owes hours. A non-practicing CIA owes 20 hours and still renews every year. Only retired holders, whose status the IIA has recorded after a request through CCMS, are exempt as a matter of course. Anyone else facing serious hardship or military service can ask for a partial or complete exemption, through a CCMS support case with supporting documentation, before 31 December.
Before you log in: the pre-renewal checklist
Every item below is something you are about to declare, or something an auditor would ask for if your renewal were selected. Run the list in September, while there is still time to fix what it turns up, and again on the day you renew.
| Check | How to check it | If it fails |
|---|---|---|
| Total hours meet your status (40 practicing, 20 non-practicing) | Sum the log, counting instruction time on the 50-minute rule, not calendar time | Earn the balance before 31 December; see the guide to CPE for busy auditors |
| At least two ethics hours | Find the ethics certificate, or the agenda that separates the ethics session | Take a two-hour ethics course now |
| Every hour has evidence | Open the folder: one certificate or record per log row | Download missing certificates from providers, or drop the hours you cannot evidence |
| Caps respected | Presentations up to 25 (repeats up to 5); authoring up to 25; volunteering up to 20; quality assessments up to 20; exam passes up to 40 | Count only up to the cap; replace the excess with courses |
| No hour counted twice | Check that nothing was already applied to last year’s renewal or a prior-year shortfall | Remove it from this year’s total |
| Status is honest | Practicing if your work was internal audit or related; non-practicing only if it was not | Declare practicing and meet 40 hours |
| The conviction statement is true | No criminal conviction since the prior reporting period | Do not submit; raise a support case in CCMS |
| Your CCMS email works | Log in and check the contact details | Update them before you renew, since the audit notice goes there |
| Fee and payment method | Confirm membership status and whether your renewal is included | Arrange a card, or ask your employer to pay |
| Other IIA designations | List every designation you hold (CRMA, IAP, legacy designations) | Renew each one; the same hours can serve both if relevant |
The cap check is the one people skip. A CIA who presented three new sessions of 50 minutes has earned twelve hours, because preparation credit is three times the presentation time. If the same CIA also repeated one of them twice, the repeats add only presentation time. The whole category stops at 25. The guide to CPE claims that fail an audit works through the calculations for every category. The CPE tracking guide has a log with the cap arithmetic built in.
The renewal in CCMS, step by step
The IIA publishes the renewal as three steps. Log in to CCMS. Select Renew for the certification you wish to renew. Follow the on-screen instructions and select Submit when prompted. In outline, the on-screen instructions take you through the self-declaration (your status and your compliance with the requirement), the attestation statements and payment of any fee. The table adds what to have ready at each point.
| Step | What you do | Have ready |
|---|---|---|
| 1. Log in | Sign in to CCMS with your IIA account; the IIA’s support site lists the browsers that work best with CCMS | Your login details; a desktop browser rather than a phone |
| 2. Select Renew | Choose Renew for the designation you are renewing (a certification in grace shows the prior-period route instead; see below) | The list of designations you hold |
| 3. Declare | Confirm your status and that you have met the hour and ethics requirement for it | Your log total, ethics total and status decision |
| 4. Attest | Confirm the four attestation statements | The ethics certificate and a clear answer on convictions |
| 5. Pay | Pay the renewal fee if one applies to you | A payment card, or confirmation that membership covers it |
| 6. Submit | Select Submit when prompted | A few minutes without interruption |
| 7. Keep the record | Save or screenshot the confirmation and any receipt; check the certification shows as active | The year’s evidence folder, where the confirmation belongs |
| 8. Check your email | If your renewal was selected for audit, the notice arrives straight after you submit | Time in the next weeks to assemble the audit pack |
Renew in one sitting on a computer, early in the window, with the log and folder open. The renewal is short, but an interrupted payment or an expired session on 31 December is how a routine task turns into grace status. If something in CCMS does not behave as expected, the IIA’s support site takes cases. Raising one in October leaves time for an answer. Raising one on 30 December may not.
The four attestations
The policy lists four statements you confirm at renewal. In paraphrase: you will abide by the IIA’s standards of ethics and professionalism. You will not bring the IIA into disrepute or otherwise discredit it. You have completed the two hours of ethics training. And you have had no criminal convictions since the prior reporting period. The policy states that false information in the self-declaration can lead to disciplinary action, including revocation, and that anyone found falsifying documentation is referred to the IIA’s Professional Responsibility and Ethics Committee.
| Statement (paraphrased) | What backs it up | If you cannot confirm it |
|---|---|---|
| I will abide by the IIA’s standards of ethics and professionalism | Your conduct under Domain II of the Global Internal Audit Standards | Resolve or disclose the issue through the proper channel before renewing |
| I will not bring the IIA into disrepute | Accurate use of the designation and honest representation of your credentials | Correct any misuse, such as the designation shown during a lapse, before renewing |
| I have completed the two hours of ethics training | An ethics certificate, or an agenda separating the ethics session, dated this year | Complete the ethics hours first; the attestation calls them “recommended”, but the policy requires them |
| No criminal convictions since the prior reporting period | Your own knowledge | Do not submit; contact the IIA through a CCMS support case |
The ethics statement causes the most trouble, because it is easy to believe you did an ethics course this year when it was last year. Open the certificate before you tick. The guide to CIA ethics CPE covers what qualifies and the fastest legitimate way to finish the hours. The GIAS Domain II guide explains what the first statement commits you to.
Fees and payment
The policy says renewal fees vary with membership, the designations held and location. The IIA’s pricing page gives the amounts below as of September 2026. For IIA members residing in North America with active designations, the annual renewal fee is included in membership. The IIA’s support site notes that fees also depend on whether you renew directly with the IIA through CCMS or through your local institute.
| Designation | Member, active | Non-member, active | Member, from grace | Non-member, from grace |
|---|---|---|---|---|
| CIA | $30 (included in North American membership) | $120 | $60 | $240 |
| IAP, CRMA, CCSA, CFSA, CGAP | $20 (included in North American membership) | $120 | $40 | $240 |
| QIAL | $30 | $120 | $60 | $240 |
If your employer pays, arrange it before the window opens. Expense approvals in December are slow, and a renewal delayed for a reimbursement is still a missed renewal. If you hold two designations as a non-member, budget for two fees. And note the grace column: every missed deadline doubles the price of putting it right, before counting the weeks without the designation.
After you submit: confirmation and the audit
Each year the IIA, or an organization acting for it, audits a percentage of renewals, selected at random. The IIA’s CPE page says the notification is sent by email immediately after you complete your renewal, with the requirements set out in the email, and that you have six months to complete the audit. Two outcomes in the policy matter. Anyone who fails to provide the information by the stated deadline is moved automatically to revoked status. If the audit shows too few qualifying hours, you are given six months to earn the missing hours and submit the documentation. The first outcome is the dangerous one, and the easiest way into it is a notice sent to an address you no longer read.
The evidence the policy expects for each activity is the title or description, the dates, the location, the sponsoring organization, the number of hours as indicated by the sponsor, and a letter, certificate or other written independent attestation of completion. Publications, presentations and committee work need their own documentation. If your log and folder follow that list, answering an audit means exporting the year’s folder.
| Activity | What to provide | Weak evidence to avoid relying on |
|---|---|---|
| Course, seminar or conference | Certificate with sponsor, title, date and hours; the agenda if the certificate is not itemized | Registration confirmation or receipt only |
| Live webinar | Certificate issued after the attendance and polling checks | A calendar entry showing you registered |
| Self-study course | Completion certificate showing the passed assessment and the hours | A screenshot of an unfinished course |
| In-house training | Attendance record with times, agenda with objectives, presenter, and a certificate or system record | A team meeting invitation |
| Presentation | Program or agenda naming you as presenter, with the date and length; your slides | Slides without any record of delivery |
| Published writing | The publication with your name and date, and a word count | A draft that was never published |
| Committee or officer role | Confirmation from the organization, meeting records showing your participation and their length | A LinkedIn entry |
| External quality assessment | Confirmation of your role and the onsite days | The report, which does not show onsite time |
| Exam part passed | Score report or pass letter dated in the year | A study plan |
Whether or not you are audited, keep the year’s folder, including the renewal confirmation, for at least three years. The policy sets three years as the minimum, and keeping the folder longer costs nothing.
Building an audit pack in an afternoon
If the audit email arrives, treat it like any other request for evidence: read the requirements, assemble the documents in the order of your claim, and show your arithmetic. An auditor of your CPE is checking two things. Does each activity qualify, and do the hours add up to what you declared? A pack that answers both questions on its own page closes quickly. The sequence below assumes you kept a log and a folder during the year. If you did not, the same sequence tells you what to reconstruct.
| Order | Document | What it shows | Where it comes from |
|---|---|---|---|
| 1 | A one-page cover note | Your name, the designation, the renewal year, your declared status, total hours and ethics hours | You |
| 2 | The CPE log for the year | One row per activity: date, title, sponsor, category, minutes, hours, ethics hours, evidence reference | Your log, exported to PDF |
| 3 | The cap and calculation schedule | How each presentation, publication, committee, assessment and exam claim was converted, and that each category is within its cap | A short table built from the log |
| 4 | Evidence files, numbered to match the log | Certificates, attendance records, agendas, publications, confirmations | The year’s folder |
| 5 | The ethics evidence, flagged | That at least two hours were ethics, dated in the year | The ethics certificate or marked agenda |
| 6 | Notes on any gaps | What is missing, what you have asked the provider for, and when you expect it | Your correspondence with providers |
Keep the cover note factual and short. State the year and status, the declared totals, and that the enclosed log and evidence support them. Then list any activity you are withdrawing because you cannot evidence it. Withdrawing a weak claim yourself is better than having it rejected, and if the remaining hours still meet the requirement, the audit closes. If they do not, the policy’s six-month period to earn and document the missing hours applies. Send the pack well inside the deadline, keep a complete copy, and note the date you sent it in the log.
Renewing a lapsed year from grace
If 31 December passes without a completed renewal, the certification moves automatically from Active to Grace Period (Inactive) status, and you may no longer claim to be certified. The IIA’s steps for a certification in grace are the same as for an active one, except that when prompted you select Renew Prior Period. The IIA requires the previous period to be renewed before the current one. The price is higher: $60 for members and $240 for non-members for the CIA.
If the problem was a shortfall of hours rather than a forgotten renewal, the policy allows hours earned in the next calendar year to make up the deficiency, provided those hours are not also counted toward the current year. The worked example shows how it runs in practice.
| When | What happens | Hours position |
|---|---|---|
| During 2026 | A practicing CIA earns 31 hours, including two of ethics, then a heavy fourth quarter stops all training | 2026: 31 of 40 |
| 31 December 2026 | No renewal completed | Status moves to grace on 1 January 2027; designation removed from signature and profiles |
| January to March 2027 | Earns 12 hours in the new year | 12 hours earned in 2027 |
| March 2027 | Selects Renew Prior Period in CCMS, applies 9 of the 2027 hours to 2026 and pays the $60 or $240 grace price | 2026 complete at 40; 3 hours remain for 2027 |
| Rest of 2027 | Earns 37 more, including two new ethics hours, and renews for 2027 in October | 2027 complete at 40; none of the 9 counted twice |
Two limits frame all of this. Grace lasts at most 24 months: a certification that stays in grace for more than 24 months is revoked, and a revoked CIA returns only through a recertification application and CIA Part 1. And every day in grace is a day you may not use the designation. The guide to maintaining the CIA covers the whole status ladder and the cost of each rung.
Special cases
Your first renewal
Newly certified CIAs do not renew in the year of certification. The first period runs from the certification date to 31 December of the following year. The policy’s example is a certification on 20 February 2022 with the first renewal due by 31 December 2023. Plan on the full annual requirement within that period, and renew in the window of the following year.
Holding more than one IIA designation
Renew each designation. The policy lets hours earned for the CRMA, IAP and the legacy designations apply toward the CIA, so a practicing CIA and CRMA holder with 40 relevant hours meets both requirements. Non-members pay a fee for each renewal. The CRMA guide and the IAP vs CIA guide cover those designations.
Holding a legacy designation
Holders of the IIA’s discontinued designations (the CCSA, CFSA, CGAP and QIAL) renew them the same way, with 20 hours if practicing and 10 if non-practicing, and the same ethics hours, which the CIA hours can cover. Take particular care with these. The policy has no provision to recertify them once revoked, so a lapse that runs past 24 months in grace ends the designation for good. The guide to the IIA’s specialty and retired credentials covers what each is still worth.
Renewing through a national institute
Some institutes handle renewal for their members, and the fee follows the institute’s pricing. The requirement does not change. The Chartered IIA in the UK, for example, tells its members who hold the CIA to report their 40 hours to the IIA, with no separate submission to the institute. If you are unsure where you renew, ask your institute before October.
Moving to retired or non-practicing status
Non-practicing is a declaration you make at renewal when you have not been doing internal audit or related work. Retired is handled differently. The designation must be active, and you request the change by submitting a support case through CCMS. Retired holders are exempt from renewal requirements while they remain retired.
Changing jobs near the year end
Export every certificate from your employer’s learning system before your last day, update your CCMS email address, and renew before you leave if the hours are complete. An audit notice sent to a closed work mailbox is one of the quickest routes from a clean renewal to a revoked one.
A year-end timeline
| Date | Action |
|---|---|
| 30 June | Mid-year check: at least 20 hours logged and the ethics hours done or booked |
| 1 September | Run the pre-renewal checklist; book whatever is missing; check the CCMS email address |
| 1 October | Renewal window opens; renew the same week if the checklist is clean |
| The day you renew | Save the confirmation; watch for an audit email |
| 1 December | Confirm the renewal is complete and the certification shows as active; if not, renew now |
| 31 December | Deadline; anything not renewed moves to grace on 1 January |
| January | Close the year’s evidence folder; start a new log; if you missed, renew the prior period straight away |
| Three years later | The folder can be archived, having met the policy’s minimum retention |
Running renewals for a team
For a chief audit executive, each certified auditor’s renewal is an individual obligation, but a lapse is the function’s problem. It shows up in proposals, in the credentials the function reports to the audit committee, and in an external quality assessment’s review of competence and professional development under the Standards. The arrangement that prevents it is small and familiar: a shared log, a named owner and a quarterly check, run like any other recurring control.
| Control | Owner | When | Evidence |
|---|---|---|---|
| Register of every designation held by the team, with status and renewal due date | Team administrator or a senior auditor | Updated on joining, leaving and each renewal | The register |
| Team CPE log with each person’s hours and ethics hours to date | Each auditor, reviewed by the owner | Quarterly | The log and the quarterly review note |
| Mid-year shortfall review | Audit manager | 30 June | A plan for anyone under 20 hours or without ethics |
| Renewal confirmation | Each auditor, confirmed to the owner | By 1 November | Saved CCMS confirmation |
| Audit notices | Each auditor, reported to the owner on receipt | As they arise | The notice and the date the pack was sent |
| Fees and membership | Chief audit executive | Before 1 October | Approved budget or payment |
A function that runs its own training can make most of this automatic. If in-house sessions are built as formal programs with attendance records, the team log fills itself. The GIAS Domain IV guide covers the development requirements, and the QAIP playbook shows where the register and log sit as quality evidence.
Mistakes at renewal time
These are the errors specific to the renewal itself. Errors in individual claims are covered in the guide to CPE claims that fail an audit.
- Waiting for December. The window opens on 1 October, and nothing is gained by waiting. December is the month of year-end close and holidays, and every year somebody misses by a day.
- Renewing before the hours are done. Submitting in October with a plan to finish the hours in November makes the declaration untrue when you make it. Finish first, then renew.
- Ticking the ethics statement from memory. Open the certificate. Ethics training must fall inside the reporting period, so last year’s course does not count this year.
- Declaring non-practicing to halve the hours. If your work was internal audit or related, the honest status is practicing.
- Uploading or emailing certificates. They are not submitted at renewal. Keep them for an audit.
- Ignoring the audit email. Failing to respond by the stated deadline moves the designation to revoked. Read your email the day you renew.
- Renewing one designation and forgetting the other. Each IIA designation you hold is renewed separately.
- Confusing the membership renewal with the certification renewal. Paying dues does not renew the CIA.
Questions about the CIA renewal
Can I renew in September if my hours are done?
No. The renewal window opens on 1 October. Finish the hours whenever you like, run the checklist in September, and renew in the first days of October.
Do I enter every course in CCMS?
The renewal is a self-declaration, and the policy says supporting documentation should not be submitted during it. Keep your own itemized log and evidence. That is what an audit asks for, and it is how you know the declaration is true.
How do I know the renewal went through?
Save the confirmation and any receipt when you submit, and check that the certification shows as active in CCMS. Put a reminder in your calendar for 1 December to check again. That is early enough to renew if anything went wrong.
I declared the wrong status. What now?
Raise a support case through CCMS straight away and explain. Correcting an honest mistake promptly is very different from leaving an inaccurate declaration in place. If you declared non-practicing but were practicing, make sure you have, or quickly earn, the full 40 hours.
What if I am selected for audit and my records are incomplete?
Respond anyway, within the deadline, with everything you have. Ask providers for duplicate certificates, since most can reissue them. If the audit concludes you were short, the policy gives six months to earn the missing hours and submit the documentation. What costs the designation is not responding at all.
Does renewing my IIA membership renew my CIA?
No. They are separate transactions. Members in North America have the certification fee included, but they still complete the renewal in CCMS each year.
Is there a late fee?
In effect, yes. After 31 December the certification is in grace, and renewing from grace is priced at $60 for members and $240 for non-members for the CIA, double the active prices. The larger cost is the time without the designation.
What if something goes wrong in CCMS at the last minute?
The best answer is not to be there at the last minute. If a system or payment problem stops you from renewing, take screenshots showing the date and the error, and raise a support case through CCMS straight away. A problem found on 3 October has three months to be fixed. One found on 31 December has hours.
I am between jobs when the window opens. What do I declare?
Declare the status that describes the year. If you did internal audit or related work for most of it, practicing is the honest answer, and the requirement is 40 hours. If you were out of such work for the year, for example on a long career break, non-practicing applies and the requirement is 20. Either way the renewal is due by 31 December. Free member webinars and on-demand courses make the hours manageable without an employer’s training budget.
Related guides
- CIA CPE requirements — hours, qualifying activities and caps.
- How to maintain your CIA — status, grace, revocation and cost.
- CIA ethics CPE — the two hours behind the ethics attestation.
- Tracking CIA CPE — the log and folder that make an audit easy.
- CPE claims that fail an audit — the arithmetic of every category.
- CPE for busy auditors — finishing the hours before the window.
- Free CIA CPE — sources for a short year.
- GIAS Domain II — the ethics and professionalism you attest to.
- The CRMA — a second IIA designation renewed alongside the CIA.
- The CIA exam, explained — the hub for every CIA guide.
Leave a Reply