Tracking CIA CPE is a small records job with a large consequence. The IIA’s renewal is a self-declaration, and nothing is submitted when you renew. But if your renewal is selected for audit, you have to produce, for every hour you declared, evidence that meets the policy’s requirements. The policy also asks you to keep that evidence for at least three years. The system that works takes under a minute per activity: one log with one row per activity, one folder of evidence per year, and a short routine that closes the year cleanly. The system that fails is reconstruction, done in December from email searches and memory.
This guide sets out a tracking system built around what the IIA’s Annual Certification Renewal Policy requires, checked in September 2026. It covers the records to keep, a log template with sample rows, evidence by activity type, a folder and naming system, the tools, tracking several credentials at once, the monthly and annual routine, and how to recover missing records. The rules on what counts are in the guide to CIA CPE requirements. How the log is used at renewal is in the step-by-step renewal guide.
In this guide
- What the IIA expects you to keep
- The log: one row per activity
- Setting up the spreadsheet
- Logging the awkward cases
- Capturing evidence, activity by activity
- A certificate for in-house sessions
- The folder and naming system
- Tools: spreadsheet, app or learning system
- Tracking several credentials in one log
- The routine: minutes a month, an hour a year
- Closing a year: a worked example
- What a reviewer looks for in a log
- Recovering missing records
- Tracking for a team
- Questions about tracking CPE
- Related guides
What the IIA expects you to keep
The policy lists the elements your records should contain, and it says that supporting documentation should not be submitted during the renewal but kept for at least three years. It also puts the burden of proof on you: it is the certified individual’s responsibility to show that an activity qualifies. The list is short, and every good tracking system is built on it.
| Record element in the policy | Where it usually comes from | Where it usually goes missing |
|---|---|---|
| Title of the program or description of its content | Certificate, agenda or course page | Calendar entries that say only “training” |
| Dates attended | Certificate or learning-system record | Multi-day events logged as a single date |
| Location | Certificate or registration confirmation; “online” for virtual programs | In-house sessions with no venue recorded |
| Sponsoring organization | Certificate letterhead | In-house training with no named sponsor; record the employer and department |
| Number of CPE hours, as indicated by the sponsor | Certificate, or agenda timings on the 50-minute rule | Calendar blocks claimed instead of instruction time |
| A letter, certificate or other written independent attestation of completion | The provider or employer | Registration receipts kept instead of completion records |
| Documentation for publications, presentations and committee work | The publication, the program naming you, the organization’s confirmation | Slides kept without any record of the event |
Two points follow. First, “written independent attestation” means the evidence comes from someone other than you: a provider, an employer’s training record, an organization’s confirmation. Your own notes support a claim, but they cannot prove it. Second, the policy asks for at least three years without saying when the three years start, so the cautious reading counts them from the renewal each record supports. At any moment, then, you hold at least three years of folders. Keeping longer costs nothing if the system is digital.
The log: one row per activity
The log is a spreadsheet, or anything that behaves like one, with one row per activity and columns that answer the questions an audit asks. The columns below cover the policy’s record elements, the arithmetic of the 50-minute rule and the caps, the ethics requirement, and a reference to the evidence file. Add a column per credential if you hold more than one, as described later.
| Column | What to enter | Why it matters |
|---|---|---|
| Date completed | The completion date, or each date for multi-day events | Decides which year the hours belong to |
| Activity | Title and a few words on content | Shows relevance |
| Sponsor | The organization that ran it | A required record element |
| Format | In person, live online, self-study, in-house, presentation, publication, committee | Different formats need different evidence |
| Category and cap | Educational program (uncapped) or the contribution category | Lets you apply the caps as you go |
| Minutes of instruction | Instruction time only, from the agenda; for self-study, leave blank | The basis of the 50-minute calculation |
| CPE hours | Minutes ÷ 50, the increment for short programs, the sponsor’s figure for self-study, or the category’s conversion | What you will declare |
| Ethics hours | The part of the hours that was ethics | The two-hour requirement at a glance |
| Evidence file | The file name in the year’s folder | Makes an audit a matter of exporting |
| Used for | The renewal year, or “prior-year shortfall” | Prevents counting an hour twice |
| Running total | Cumulative hours and ethics hours | Shows at any moment where you stand |
The sample rows below show a practicing CIA’s first half-year, with each category handled correctly. The file names follow the convention in the folder section, and the instruction minutes behind each figure appear in brackets after the activity.
| Date | Activity | Sponsor | Category | CPE | Ethics | Evidence file | Total |
|---|---|---|---|---|---|---|---|
| 2026-01-21 | Ethical Applications of the Global Internal Audit Standards (on-demand) | IIA | Educational, self-study | 2.2 | 2.2 | 2026-01-21_IIA_Ethics-GIAS_2.2h.pdf | 2.2 |
| 2026-02-10 | Chapter meeting: auditing third-party risk (100 minutes) | IIA chapter | Educational, in person | 2.0 | 0 | 2026-02-10_Chapter_Third-party_2.0h.pdf | 4.2 |
| 2026-03-04 | Methodology training: sampling and evidence (160 minutes) | Employer (internal audit) | Educational, in-house | 3.2 | 0 | 2026-03-04_Employer_Sampling_3.2h.pdf | 7.4 |
| 2026-03-19 | Webcast: revenue controls update (100 minutes) | Accounting firm | Educational, live online | 2.0 | 0 | 2026-03-19_Firm_Revenue-controls_2.0h.pdf | 9.4 |
| 2026-04-15 | Presented “Full-population testing in accounts payable” to the team (original, 50 minutes) | Employer | Presentation (cap 25) | 4.0 | 0 | 2026-04-15_Presentation_AP-analytics_4.0h.pdf | 13.4 |
| 2026-05-28 | Regional conference, day 1, sessions attended per agenda (315 minutes) | IIA chapter | Educational, in person | 6.3 | 0 | 2026-05-28_Conference-D1_6.3h.pdf + agenda | 19.7 |
| 2026-06-12 | Same presentation, repeated at the chapter (50 minutes) | IIA chapter | Presentation, repeat (cap 5) | 1.0 | 0 | 2026-06-12_Chapter-talk_repeat_1.0h.pdf | 20.7 |
At the 30 June check this CIA has 20.7 hours, including 2.2 of ethics, and the half-year is done. The presentation rows show the cap arithmetic in action: the original earns four hours, and the repeat earns presentation time only. The guide to CPE claims that fail an audit works through every category’s conversion.
Setting up the spreadsheet
A log does its job when the arithmetic runs itself: the hours, the ethics total, the caps and the gap to the requirement all visible without a calculator. Four pieces of set-up make that happen, and none of them needs more than basic spreadsheet skills.
- A drop-down list for the category column. Use a fixed list: educational program, presentation (original), presentation (repeat), authoring (article or blog), authoring (book), authoring (exam questions), translating (book), translating (IIA guidance or article), volunteering (committee or officer), volunteering (guidance contribution), volunteering (exam review), quality assessment, exam part passed. Fixed labels are what make the cap totals work.
- A rule for the hours column. For live programs of 50 minutes or more, the hours are the instruction minutes divided by 50. For programs under 50 minutes, count complete 10-minute increments at 0.2 each, or complete 25-minute increments at 0.5 each. For self-study, enter the sponsor’s figure. For contributions, apply the category’s conversion: presentation minutes divided by 50, times four for an original; words divided by 200 for writing and translating; one hour per accepted exam question.
- A cap schedule. A small table beside the log that totals each category and compares it with its cap, so the allowed hours are the lower of the two.
- A status line. Three cells at the top: hours allowed to date against the requirement for your status, ethics hours against two, and days left to 31 December.
| Cap schedule line | Total from the log | CIA cap | Allowed |
|---|---|---|---|
| Educational programs | Sum of that category | None | The total |
| Presentations, original and repeat | Sum of both | 25 in total, repeats at most 5 | Lower of the total and the cap, after limiting repeats to 5 |
| Authoring | Articles and blogs; books; exam questions | 15; 25; 20; overall 25 | Each line limited, then the three together limited to 25 |
| Translating | Books; IIA guidance, research or articles | 25; 15; overall 25 | Each line limited, then the two together limited to 25 |
| Volunteering | Committee or officer; guidance; exam review | 15; 10; 20; overall 20 | Each line limited, then the three together limited to 20 |
| Quality assessments | Onsite time | Independent validation 5; one-week 10; two-week 20; overall 20 | Limited as shown |
| Exam parts passed | 10 per part | 40 in the year passed | Lower of the total and 40 |
| Total allowed | Sum of the allowed column | Requirement: 40 practicing, 20 non-practicing | Compared with the requirement in the status line |
Add one conditional format: highlight any row whose evidence-file cell is empty. An empty cell is an hour you cannot yet prove, and it should stand out every time you open the log.
Logging the awkward cases
Most rows are simple. A handful of situations recur every year and cause most of the confusion, usually about which year an hour belongs to or how to show a contribution. The table gives a consistent way to log each.
| Situation | How to log it |
|---|---|
| A multi-day event spanning 31 December | One row per day, each in the year it fell, with the agenda showing each day’s sessions |
| A self-study course started in one year and finished in the next | One row, in the year of the completion date on the certificate |
| A presentation given several times | One row per delivery; mark the first “original” and the rest “repeat” |
| An article written over months | One row when it is published, with the word count and the published copy as evidence |
| A year of committee meetings | One row per meeting with its length, or a quarterly summary supported by the organization’s confirmation |
| An exam part passed | One row on the date of the result, at ten hours |
| Hours used to repair a prior-year shortfall | Keep the row in the year earned, and mark “used for” with the prior year so it is not counted again |
| A conference certificate that overstates instruction time | Log the instruction time from the agenda and note the difference |
Capturing evidence, activity by activity
Evidence is easy to capture on the day and hard to recover a year later. The table sets out what to save for each kind of activity, how to capture it, and the single most common gap.
| Activity | What to save | How to capture it | Most common gap |
|---|---|---|---|
| Live webinar | The certificate | Download from the email or portal the day it arrives; some firms post to a transcript instead, so save a PDF of the transcript | Certificates left in inboxes and never filed |
| On-demand or self-study course | The completion certificate showing the passed assessment and the hours | Download on completion | Courses finished but the certificate never generated |
| Conference or seminar | Certificate plus the agenda marked with the sessions attended | Photograph or annotate the agenda each day | One lump-sum certificate with no session detail |
| Chapter meeting | Certificate or attendance record with session title and hours | Ask the chapter for the certificate if none is sent | Sign-in sheet only |
| In-house training | Attendance record with times, agenda with objectives, presenter, certificate or system record | Export from the learning system, or keep the signed sheet and agenda | Calendar invitation only |
| Presentation you gave | Program or agenda naming you, date, length; slides | Save the program page when it is published | Slides with no record of delivery |
| Published article or blog | The published piece with your name and date; word count | Save a PDF of the published page | Links that break when sites change |
| Committee or officer role | Confirmation from the organization; meeting records showing attendance and length | Ask for a year-end confirmation letter | A profile entry with no record of time |
| External quality assessment | Confirmation of your role and onsite days | Ask the assessment lead for a short letter | The report, which does not show onsite time |
| Exam part passed | Score report or pass letter | Download from the exam body’s portal | Results left in a portal you later cannot access |
A habit worth adopting: file the evidence before you log the row. If the certificate is not in the folder, the row does not exist yet. That one rule prevents most of the gaps above.
A certificate for in-house sessions
In-house training is the activity most often lost at audit, because nobody issues anything. If your function runs its own sessions, a one-page certificate template fixes that for everyone at once. It should carry each of the policy’s record elements, so that the certificate alone answers an audit’s questions. The fields below are the minimum.
| Field | Example |
|---|---|
| Participant | The attendee’s full name |
| Program title | Sampling and evidence: methodology refresher |
| Learning objectives | Participants will be able to select a sampling approach for a control test and document sufficiency of evidence |
| Date and location | 4 March 2026, head office training room (or “online”) |
| Sponsoring organization | The employer, internal audit department |
| Instructor | Name and role of the presenter |
| Instruction time and CPE hours | 160 minutes; 3.2 CPE hours on the 50-minute basis |
| Field of study, if relevant | Auditing; mark ethics sessions as ethics |
| Attestation of completion | A signature from the training owner, or a system-generated completion record |
Issue the certificate the same week, and keep the attendance list, agenda and slides together in the function’s training records. The presenter keeps the agenda naming them for their presentation credit. The guide to free CIA CPE explains what else an in-house session needs to qualify.
The folder and naming system
Keep one folder per reporting year, inside a single CPE folder in storage you control. Within each year, keep three kinds of file: the evidence, the log and the renewal confirmation. Name every evidence file the same way, so the folder sorts by date and can be read without opening anything: the completion date, the sponsor, a short title and the hours.
| Item | Convention | Example |
|---|---|---|
| Top folder | One folder for all CPE, in personal storage | CPE |
| Year folder | The reporting year | CPE / 2026 |
| Evidence file | Date_Sponsor_Title_Hours | 2026-03-19_Firm_Revenue-controls_2.0h.pdf |
| Ethics evidence | Add “Ethics” to the title part | 2026-01-21_IIA_Ethics-GIAS_2.2h.pdf |
| Supporting agenda | Same name with “agenda” | 2026-05-28_Conference-D1_agenda.pdf |
| Log | One file per year | CPE-log-2026 |
| Renewal record | Confirmation and receipt | 2026_CCMS-renewal-confirmation.pdf |
| Audit pack, if selected | A subfolder with the cover note and numbered evidence | CPE / 2026 / Audit |
Storage you control matters more than any other choice here. An employer’s shared drive or learning system is convenient, but it belongs to the employer and ends when the job does, sometimes in the middle of an audit period. Keep your CPE folder in personal storage, with a backup, and copy certificates out of employer systems as they are issued. Certificates carry little sensitive information beyond your name, but treat the folder as personal records all the same.
Tools: spreadsheet, app or learning system
No special software is needed. What matters is that the tool is yours, exports cleanly, and makes the arithmetic visible. The options compare as follows.
| Tool | Strengths | Weaknesses | Best for |
|---|---|---|---|
| A spreadsheet | Portable; shows the arithmetic; easy to add a column per credential; exports to PDF for an audit | Needs the discipline to update it | Almost everyone |
| A notes or task app | Quick to add entries from a phone | Weak on totals, caps and export | Capturing entries, with a spreadsheet as the record |
| An employer learning system | Records in-house training automatically | Not yours; access ends when you leave; rarely covers external CPE | A source to export from, never the only record |
| Provider transcripts and accounts (for example ISACA’s CPE record or a firm’s transcript) | Accurate for that provider | One provider each; formats vary; access can lapse | Evidence for the folder, not the log itself |
| A day log you already keep | Catches learning time as it happens | Records time, not CPE evidence | A prompt to update the CPE log |
If you already keep a time record for engagements, the site’s free myDayLog is one, and a “learning” entry there is a useful prompt to update the CPE log that week. It is not a substitute for the log and the evidence folder, which are what an audit asks for.
Tracking several credentials in one log
A CIA who also holds a CPA license, a CISA or a CFE should keep one log, not several. Most activities count for more than one body, and several logs drift apart. Add a column per credential and tag each row at the time of logging with the extra attributes that body needs. The rules differ in ways that affect tracking: different years, different ethics rules, and in some cases subject requirements.
| Credential | Extra column or tag | Why |
|---|---|---|
| CFE (ACFE) | Fraud-related (yes/no); ethics | At least 10 of the 20 annual hours must be fraud-related and 2 ethics; the ACFE’s year ends with your anniversary month |
| CISA, CRISC, CISM (ISACA) | Aligned to the certification’s exam content outline (yes/no) | ISACA requires 20 hours a year and 120 over three years; from 2027 at least 90 of the 120 must align with the certification’s exam content outline |
| CPA (state board) | Field of study; technical or non-technical; state ethics | Boards set their own hours, ethics and subject rules; many require at least half of hours to be technical |
| CMA (IMA) | Ethics | 30 hours a year including 2 of ethics |
| CRMA or IAP (IIA) | Relevant to risk management assurance (for the CRMA) | One set of relevant hours can cover the CIA and another IIA designation |
The one-log approach has a second benefit. It shows where a single course serves several bodies, which is the key to keeping multi-credential CPE affordable. The guide to planning your CPE year covers how to choose those courses. The guides to the CFE and CISA set out those credentials in full.
The routine: minutes a month, an hour a year
A tracking system is only as good as its routine. The one below costs a few minutes a month and about an hour at the year end. It puts the checks where they can still change the outcome, in June and September rather than December.
| When | What to do | Time |
|---|---|---|
| Within a week of each activity | File the evidence, then add the row | One minute |
| Last working day of each month | Check the inbox and portals for certificates not yet filed | Five minutes |
| 30 June | Mid-year check: at least 20 hours, ethics done or booked, caps in view | Ten minutes |
| 1 September | Pre-renewal checklist; book anything missing | Fifteen minutes |
| Early October | Renew in CCMS; file the confirmation in the year’s folder | Fifteen minutes |
| January | Close the year: final totals, backup, new year’s folder and log | Fifteen minutes |
| Each January | Archive folders older than three renewal years, if you choose to | Five minutes |
Closing a year: a worked example
The year-end close is where the log earns its keep. The example continues the sample rows above for a practicing CIA who kept logging through the second half of the year. At the close, the cap schedule shows what can be declared.
| Category | Logged in the year | Cap | Allowed | Comment |
|---|---|---|---|---|
| Educational programs | 31.4 | None | 31.4 | Includes 2.2 of ethics |
| Presentations: original | 8.0 | 25 overall | 8.0 | Two original 50-minute talks |
| Presentations: repeat | 3.0 | 5 | 3.0 | Three repeats at presentation time only |
| Authoring: articles | 6.0 | 15 | 6.0 | One 1,200-word article, published in November |
| Volunteering: committee | 4.2 | 15 | 4.2 | Chapter program committee, confirmed by the chapter |
| Total | 52.6 | Requirement 40 | 52.6 | Declared as meeting the 40-hour requirement; surplus of 12.6 noted |
Two things happen at the close besides the totals. First, the surplus is recorded. Under the policy, surplus hours from the immediately prior period may make up a deficiency in the next one, so the 12.6 hours are worth noting in next year’s log as available cover. Second, the folder is checked against the log row by row, backed up, and closed. If the renewal was selected for audit, that check is the audit pack, already built.
What a reviewer looks for in a log
Anyone who reviews CPE records, whether an auditor of your renewal or a manager checking a team log, reads them the way an internal auditor reads any population. It helps to know what draws attention, because each item is also a self-check before you renew.
- Round numbers everywhere. A log of 8.0-hour days and 1.0-hour webinars suggests calendar time rather than instruction time. Decimals from the 50-minute rule look like the real thing, because they are.
- A December cluster. Twenty hours in the last three weeks of the year is not wrong, but it invites a closer look at attendance evidence.
- Certificates that do not match rows. A different date, sponsor or hour figure on the certificate than in the log is the first thing a reviewer checks.
- Contribution hours near the caps. Claims close to 25 hours of presentations or writing get their conversions checked.
- The same title in consecutive years. A repeated course may be legitimate, but the reviewer will ask whether it is the same content.
- Ethics without a separate record. Two ethics hours inside a lump-sum conference certificate need the agenda to support them.
Recovering missing records
If you find a gap, whether at the September check or, worse, in an audit, most records can be recovered if you ask promptly. Providers generally keep attendance records and can reissue certificates. Chapters keep sign-in records. Former employers’ training teams can export learning histories on request. Conference organizers can confirm attendance. Ask in writing, give the date and title, and file the reply.
Some things cannot substitute for a record of completion. A bank or card statement shows you paid, not that you attended. A calendar entry shows you planned to attend. A colleague’s recollection is not written independent attestation. If a claim cannot be evidenced, withdraw it and replace it with a documented activity before you renew. If you are already in an audit, disclose it in the cover note. The policy gives six months to earn and document deficient hours, and an honest shortfall is far easier to cure than a claim that collapses under questioning.
Tracking for a team
A chief audit executive has a reason to track the team’s CPE as well as their own. The Global Internal Audit Standards require internal auditors to maintain and continually develop their competencies, and the chief audit executive is responsible for the function having the skills its plan needs. A shared team log, with each auditor responsible for their own rows and a quarterly review by a manager, gives the function its development evidence and catches lapses before they happen. Keep individual evidence folders personal. The team log needs only the totals and titles. The GIAS Domain IV guide covers the development requirements, and the QAIP documentation kit shows how development evidence fits a self-assessment.
Questions about tracking CPE
How long do I have to keep CPE records?
At least three years, under the IIA’s policy. Other bodies set their own periods. Some CPA boards require five years, for example. So a multi-credential holder should keep records for the longest period any of their bodies requires.
Do I upload my log or certificates to the IIA?
No. The renewal is a self-declaration, and the policy says documentation should not be submitted at renewal. The log and folder are for you, and for an audit if your renewal is selected.
Does the IIA track my hours for me?
Not as a complete record. The IIA issues certificates for its own programs, and other providers issue theirs, but your total across all sources exists only in your own log. The IIA’s CPE page reminds people who self-claim CPE to keep detailed records, which in practice means everyone.
What if a certificate shows different hours from my calculation?
For self-study, claim the sponsor’s figure, since the policy records hours as indicated by the sponsor. For live events, the certificate and the agenda should agree. If the certificate overstates the instruction time shown on the agenda, claim the lower, evidenced figure.
Is a template available?
The two log tables above are the template. Copy the column headings into a spreadsheet, add a column for each credential you hold, and add formulas for the running totals and the cap checks. Keeping it simple matters more than the tool.
Can one certificate support two credentials?
Yes. Keep one copy in the folder and tag the log row for each body it serves. Check each body’s own conditions first. The ACFE counts fraud-related hours separately, CPA boards may require registered sponsors or particular fields of study, and a few credits issued by one body are restricted to its own credential.
How do I log hours I used for last year’s shortfall?
Leave them in the year you earned them and mark the “used for” column with the prior year. That keeps the record true to the evidence, and it stops the same hours being counted again toward the current year, which the policy does not allow.
A provider has closed and I cannot get a duplicate. What now?
Keep whatever independent record survives, such as the original certificate email, a transcript or a confirmation from a co-sponsor, and note the situation in the log. If nothing independent survives, the claim cannot be evidenced. Replace it with a documented activity before you renew, or disclose it in an audit cover note and make up the hours in the six-month period.
What should I do with folders older than three years?
The IIA’s minimum is three years. Other bodies you belong to may require longer, and digital storage costs little, so many people simply keep everything. If you do delete old folders, check first that no credential you hold still requires them.
Related guides
- CIA CPE requirements — what counts and the caps.
- How to renew in CCMS — using the log at renewal, and the audit pack.
- CPE claims that fail an audit — the calculations behind each row.
- CIA ethics CPE — the ethics column, filled correctly.
- Planning your CPE year — deciding what goes in the log.
- How to maintain your CIA — the renewal cycle the log serves.
- Free CIA CPE — sources that issue proper certificates.
- myDayLog — a free day log for auditors.
- GIAS Domain IV — the function’s development obligations.
- The CIA exam, explained — the hub for every CIA guide.
Leave a Reply