Passing the CIA exam is a project with an end date; keeping the designation is a routine with none, and the routine is where certifications quietly die. The requirement is 40 hours of continuing professional education a year for a practicing CIA, including two hours of ethics, renewed in the IIA’s Certification Candidate Management System between 1 October and 31 December. Miss the deadline and the designation drops into grace status, in which you may not call yourself a CIA; stay there for more than 24 months and it is revoked, and the road back is sitting Part 1 again. None of that is hard to avoid. It happens because the renewal falls in the busiest quarter of the year, because the hours were earned but never logged, and because the rules on what counts, and how much of each kind counts, are read once at certification and never again.
This guide sets out the current IIA Annual Certification Renewal Policy as it applies to the CIA and, where they differ, to the IIA’s other designations. It contains the hours table by designation and status, the renewal calendar with the first-year rule, a table of every qualifying activity with how it is counted and the cap that applies, a worked 40-hour year built three ways, the status ladder from active to revoked with the way back from each rung, the audit and record-keeping rules, the cost of compliance for members and non-members, a tracking log you can copy, and the mistakes that cost people their designation. It was rewritten in September 2026 against the IIA’s current renewal policy and CPE pages. The exam side of the credential is covered in the site’s CIA exam requirements and CIA exam cost guides.
In this guide
- The hours required, by designation and status
- The renewal calendar, the first-year rule, and the attestation
- What counts: qualifying activities, how they are measured, and the caps
- A 40-hour year built three ways
- The status ladder: active, grace, revoked, and the way back
- CPE audits and what to keep
- The cost of compliance
- A tracking system that survives December
- What does not count, and managing CPE for a team
- Common CPE mistakes
The hours required, by designation and status
The IIA sets the requirement by designation and by the status you declare at renewal. Practicing means you are working in internal audit or a related field; non-practicing means you hold the designation but are not currently performing that work, which is a declaration you make yourself and can change year to year; retired means you have left the workforce and are not offering internal audit services. Each hour is a 50-minute hour, the convention used across the profession, so a full conference day of six sessions is usually six to eight hours, not eight to ten. Ethics hours count toward the total, so a practicing CIA needs 40 hours of which at least two are ethics, not 42.
| Designation | Practicing | Non-practicing | Retired | Ethics (all statuses that report hours) |
|---|---|---|---|---|
| CIA | 40 hours a year | 20 hours a year | 0 | At least 2 hours, included in the total |
| CRMA | 20 hours a year | 10 hours a year | 0 | At least 2 hours |
| CCSA, CFSA, CGAP | 20 hours a year | 10 hours a year | 0 | At least 2 hours |
| QIAL | 20 hours a year | 10 hours a year | 0 | At least 2 hours |
| Internal Audit Practitioner (IAP) | 20 hours a year | 10 hours a year | 0 | At least 2 hours |
| Holder of a CIA plus another IIA designation | The hours satisfy both: 40 hours covers the CIA and a CRMA in the same year | 20 hours covers both | 0 | At least 2 hours, once |
The last row is the one dual-designation holders miss in the other direction: they assume 60 hours are needed and either over-buy training or, more often, conclude the requirement is unmanageable and let one designation lapse. Hours are reported once and apply to every IIA designation you hold, provided the content is relevant to each. Where the IIA’s policy and a national institute’s local requirements differ, which happens for members of some affiliates outside North America, the affiliate’s rules govern the renewal you complete through it; the policy is explicit that renewal fees vary by membership status, designations held, and location, and the same is true of some administrative details.
The renewal calendar, the first-year rule, and the attestation
The reporting period is the calendar year, 1 January to 31 December, and renewal is completed in CCMS during the window that opens on 1 October and closes on 31 December. The first period for a newly certified CIA runs from the certification date through 31 December of the following year, so someone certified in March 2026 first renews by 31 December 2027, reporting the hours earned since certification, and is then on the ordinary annual cycle. Renewal is not merely a hours count. It is an attestation, made under the Code of Ethics, that you have complied with the ethics and professionalism requirements of the Global Internal Audit Standards, completed the ethics training, hold the conformance status you declare, and have no criminal convictions to disclose; a false attestation is itself a disciplinary matter, independent of the hours.
| Date | What happens | What you do |
|---|---|---|
| 1 January | New reporting period opens | Start a fresh page in the log; carry forward any surplus from the prior period as a note, since it can only cover a deficiency |
| Through the year | Hours are earned | Log each activity within a week, with the certificate or evidence filed |
| 30 June (suggested) | Mid-year check | If under 20 hours, book the second half now; conference and webinar calendars fill in the autumn |
| 1 October | Renewal window opens in CCMS | Renew as soon as the 40 hours and the 2 ethics hours are logged; there is no advantage in waiting |
| 31 December | Renewal deadline; reporting period closes | Anything not renewed by midnight moves to grace status on 1 January |
| Following January to March (typical) | Random CPE audit notices issued to a sample of renewers | If selected, provide the documentation within the six-month audit period; failure to do so results in revocation |
| Year after certification | First renewal for new CIAs | Report hours from the certification date; the requirement is the annual figure, not pro-rated by month |
Two practical notes on the calendar. Renewing on 2 October rather than 30 December is the single best habit in this guide, because the December window coincides with year-end close, audit committee reporting, and holidays, and every year some fraction of the profession misses it by a day. And the ethics hours have to be ethics content, delivered as training: a session on the IIA Code of Ethics, a professional ethics course, an ethics module inside a broader program; an audit of an ethics hotline does not count as ethics training, however educational it was. The site’s GIAS Domain II guide covers the content the two hours are meant to refresh.
What counts: qualifying activities, how they are measured, and the caps
The IIA’s policy is generous about sources and specific about caps. Educational programs, meaning courses, seminars, conferences, webinars, and self-study with a completion assessment, have no cap: all 40 hours may come from them. Everything else is capped per year so that a designation cannot be maintained on writing or speaking alone. The table gives each category, the measurement rule, the CIA cap, and the evidence an auditor would want to see if your renewal is selected for audit. Caps for the other designations are lower (typically 10 hours where the CIA’s is 25) and are noted in the last column.
| Activity | How hours are measured | CIA annual cap | Evidence to keep | Other IIA designations |
|---|---|---|---|---|
| Formal educational programs: courses, seminars, conferences, chapter meetings with a training component | One hour per 50 minutes of instruction; breaks and networking excluded | No cap | Certificate of attendance or completion showing provider, title, date, and hours; agenda if the certificate lacks detail | No cap |
| Webinars and virtual training | Same 50-minute rule; live or recorded with an assessment | No cap | Completion certificate; for recorded content, the assessment result | No cap |
| Self-study programs | Hours assigned by the provider, based on a completion test | No cap | Certificate with the assigned hours and the test result | No cap |
| Employer in-house training | 50-minute rule; must have an internal audit, risk, control, governance, or business-relevant subject and a qualified instructor | No cap | Attendance record signed or system-logged, agenda, presenter, duration; the function’s training log is acceptable | No cap |
| Passing professional examinations | Hours assigned per exam or part passed | 40 hours | Score report or certificate | 40 hours |
| Authoring or contributing to publications | Hours based on the work; articles, books, chapters, guidance | 25 hours | Copy of the publication with your name and the publication date | 10 hours |
| Translating publications | Hours based on the work | 25 hours | The translation and evidence of your role | 10 hours |
| Delivering oral presentations | Hours for delivery and, per policy, preparation; a repeat of the same presentation does not earn again | 25 hours | Agenda or program naming you as presenter, date, duration | 10 hours |
| Subject matter expert volunteering with The IIA (committees, exam development, guidance review) | Hours assigned by the IIA for the work | 20 hours | IIA confirmation of the role and hours | 10 hours |
| Participating in external quality assessments | Hours for the assessment work | 20 hours | Engagement confirmation from the assessed function or assessment lead | 10 hours |
| University or college courses | Treated as an educational program; the policy sets the conversion from academic credit to CPE hours, so check it before counting a semester course | No cap | Transcript or grade report | No cap |
Three interpretive points that come up every renewal season. Relevance is judged against your professional responsibilities, not against a fixed list: a data analytics course, a cybersecurity fundamentals program, a leadership seminar for a new audit manager, and a course on the industry you audit all qualify, and the IIA’s guidance is that content should contribute to your competence as an internal auditor. Provider accreditation is not required; the IIA does not run a sponsor registry the way some state accountancy boards do, so a course from a university, a professional body, a vendor, or your employer counts if it is documented and relevant. And surplus hours carry forward in one narrow way: hours earned in the immediately prior period beyond the requirement may be used to make up a deficiency in the current period, and no hour may be counted in two periods, so a 55-hour year followed by a 30-hour year renews cleanly, while a 30-hour year followed by a 55-hour year does not, because the deficiency came first.
A 40-hour year built three ways
The requirement looks heavy to a first-year CIA and trivial to a training manager, and both are right, because the cost depends entirely on how the hours are sourced. The three profiles below each reach 40 hours with two of ethics; the caps are checked in the last column so you can see where a profile would hit one.
| Source | Profile A: employer-funded, in a mid-sized function | Profile B: sole practitioner or small function, low budget | Profile C: presenter and author | Cap check |
|---|---|---|---|---|
| Employer in-house training (methodology refresh, systems, industry updates) | 16 hours | 4 hours | 8 hours | No cap |
| IIA chapter meetings and local seminars | 6 hours | 8 hours | 4 hours | No cap |
| Free and low-cost webinars (IIA, regulators, Big Four, software vendors with a training component) | 8 hours | 18 hours | 4 hours | No cap |
| Paid conference or course | 8 hours (one two-day event) | 0 | 0 | No cap |
| Ethics training | 2 hours (IIA ethics webinar) | 2 hours (chapter ethics session or a low-cost online course) | 2 hours | Minimum 2, counts in total |
| Self-study with assessment (a standards update course, a data analytics module) | 0 | 8 hours | 0 | No cap |
| Presentations delivered | 0 | 0 | 12 hours (three distinct sessions) | Under the 25-hour cap |
| Articles published | 0 | 0 | 10 hours (two practitioner articles) | Under the 25-hour cap |
| Total | 40 | 40 | 40 | — |
| Approximate out-of-pocket cost | $0 to the individual; $600 to $1,500 to the employer for the conference | $0 to $150 | $0 to $100 | — |
Profile B is the one to notice. A CIA with no training budget can meet the requirement every year for under $150 from chapter events, free webinars, and one self-study module, and the site’s guide to low-cost and free CIA CPE lists the recurring sources. Profile C shows why the caps exist and why they rarely bite: a heavy presenter and author still needs 18 hours from educational programs, which is the policy’s intent, and even a prolific one would need more than 25 hours of speaking before the cap mattered.
The status ladder: active, grace, revoked, and the way back
The consequences of a missed renewal are laid out in the policy as a ladder, and the rung that surprises people is the second: the moment the deadline passes, you may not represent yourself as certified, even though the designation has not been revoked. A CIA in grace status who signs a report “CIA” or lists the designation on a résumé is misrepresenting a credential, and the IIA treats that as a Code of Ethics matter.
| Status | How you get there | What you may do | The way back |
|---|---|---|---|
| Active | Renewal completed by 31 December with the required hours and attestation | Use the designation freely | — |
| Grace (inactive) | The 31 December deadline passes without a completed renewal | You may not represent yourself as certified; the designation should not appear after your name, on reports, or in profiles | Complete the outstanding renewal in CCMS: report the hours for the missed period and pay the applicable renewal fees; the designation returns to active once accepted |
| Revoked | More than 24 months in grace status; or failure to complete a CPE audit within the six-month audit period; or a disciplinary finding | Nothing; the policy requires the certificate to be destroyed and the designation removed from all materials | Recertification: for the CIA and the IAP, pass Part 1 again; for the CRMA, pass the CRMA exam again; the CCSA, CFSA, CGAP, and QIAL have no recertification route once revoked |
| Retired (declared) | Declared at renewal by a holder who has left the workforce and is not providing internal audit services | Retain the designation in retired status, displayed as the IIA’s current rules allow; no CPE hours required | Returning to practice means declaring practicing status and meeting the hours from that year; the IIA may audit retired declarations |
| Non-practicing (declared) | Declared at renewal by a holder not currently performing internal audit or related work | Use the designation; report 20 hours a year for the CIA | Change the declaration at the next renewal when you return to practice |
The economics of the ladder are stark. A missed renewal caught in January costs a renewal fee and an afternoon. A designation left in grace for two years and a day costs the $310 Part 1 fee, the study hours to pass a 125-question exam under the 2025 syllabus, and, for many, a year without the credential on their résumé during a job search. The hours are not the problem; a practicing auditor earns 40 hours by accident in most years. The renewal act is the problem, and it is a calendar problem, which the tracking section below is designed to solve.
CPE audits and what to keep
The IIA selects a sample of completed renewals for audit each year and asks the selected individuals to produce evidence that the reported activities meet the policy’s criteria. The selected individual has a six-month period to complete the audit, and the policy is unambiguous about the consequence of not doing so: revocation. Most audits are administrative and end with a confirmation; the ones that go badly are those where the hours were real but the records were not kept, which is why the policy requires supporting documentation to be retained for at least three years after the renewal it supports. An internal auditor should find this requirement familiar, because it is the same standard applied to any control: the activity has to be evidenced by a record made at the time, by someone other than the person claiming it, with enough detail to be re-performed.
| Record element | What the policy expects | Where it usually comes from | Common gap |
|---|---|---|---|
| Program or activity title | The name of the course, session, publication, or engagement | Certificate, agenda, or byline | Calendar entries with “training” and no title |
| Date or dates | When the activity took place or was completed | Certificate or LMS record | A year-end reconstruction from memory |
| Location or format | City and venue, or online | Certificate or registration confirmation | Missing for in-house sessions |
| Sponsoring organization | Who delivered it | Certificate letterhead | In-house training with no named sponsor; record the employer and the department |
| CPE hours claimed | Computed on the 50-minute rule or as assigned by the provider | Certificate, or agenda with timings | Claiming the calendar block (a full day as 8 hours) rather than instruction time |
| Attestation of completion | Evidence you completed it: certificate, signed attendance record, assessment result, or system log | Provider or employer LMS | Webinar registrations with no proof of attendance |
| Ethics designation | Identification of which hours were ethics training | Course title or agenda | Ethics hours buried in a conference certificate with no session detail |
Keep the records as files in one folder per reporting year, named with the date, the sponsor, and the hours, and keep the folder for three years after the renewal. Employer training portals are the most common point of failure: people change jobs and lose access to the LMS that held five years of certificates, so download the certificates as they are issued, or at minimum at each renewal. The site’s guide to tracking and organizing CIA CPE covers folder structures and tools in more detail.
The cost of compliance
The renewal itself is included in IIA membership for members in North America; non-members pay an annual renewal fee that the policy describes as varying by location and designation and that has been in the region of $120 in North America, to be confirmed in CCMS at the time. The hours can cost nothing or several thousand dollars depending on how they are sourced, as the three profiles above show. The table puts the realistic range together, with the membership decision made explicit, because for a certified professional the $290 individual dues are usually cheaper than the non-member renewal fee plus the paid CPE that membership would otherwise have provided free.
| Item | IIA member (North America) | Non-member | Notes |
|---|---|---|---|
| Annual renewal fee | Included in membership | About $120, confirm in CCMS | Payable each year at renewal; missed years are payable to return from grace |
| Membership dues | $290 individual; $200 public sector or educator; free for students | $0 | Membership also brings free and discounted CPE through webinars, chapter events, and publications |
| Ethics training (2 hours) | $0 to $50 | $0 to $100 | IIA and chapter ethics sessions are frequently free to members |
| Remaining 38 hours, low-cost profile | $0 to $150 | $100 to $400 | Chapter events, free webinars, employer training, one self-study module |
| Remaining 38 hours, conference profile | $800 to $2,500 | $1,000 to $3,000 | One major conference plus travel covers 14 to 20 hours; the rest from free sources |
| Realistic annual total | $290 to $2,900 | $220 to $3,500 | Most practicing CIAs in a function with any training budget spend under $500 personally |
| Cost of letting it lapse beyond 24 months | $310 Part 1 fee plus 70 to 130 study hours | $445 plus the same hours | And the period without the credential |
A tracking system that survives December
The system that works is the one that takes under a minute per activity and produces the renewal in October without a search. One spreadsheet, one row per activity, one folder of evidence, three calendar entries. The columns below are the ones that map to what CCMS asks for at renewal and what an auditor asks for in an audit; the example rows are a partial year for a practicing CIA in a mid-sized function.
| Date | Activity | Sponsor | Category | Hours | Ethics hours | Evidence file | Running total |
|---|---|---|---|---|---|---|---|
| 14 Jan | Global Internal Audit Standards refresher, live webinar | IIA | Educational program | 1.5 | 0 | 2026-01-14_IIA_GIAS-refresher_1.5h.pdf | 1.5 |
| 6 Feb | Chapter meeting: auditing third-party risk under the Topical Requirement | IIA chapter | Educational program | 2.0 | 0 | 2026-02-06_Chapter_TPRM_2h.pdf | 3.5 |
| 3 Mar | Department methodology training: sampling and evidence | Employer | In-house program | 3.0 | 0 | 2026-03-03_Employer_Methodology_3h.pdf (LMS export) | 6.5 |
| 22 Apr | Ethics and the internal auditor: conflicts and objectivity | IIA | Educational program (ethics) | 2.0 | 2.0 | 2026-04-22_IIA_Ethics_2h.pdf | 8.5 |
| 10 to 11 Jun | Regional conference, six sessions attended | IIA chapter | Educational program | 8.0 | 0 | 2026-06-11_Conference_8h.pdf plus agenda | 16.5 |
| 18 Sep | Presented “Continuous auditing at a distributor” to the chapter | IIA chapter | Oral presentation | 3.0 | 0 | 2026-09-18_Chapter_agenda_presenter.pdf | 19.5 |
| Planned Q4 | Data analytics self-study module; cybersecurity webinar series; employer year-end training | Various | Educational programs | 20.5 | 0 | — | 40.0 |
The three calendar entries are 30 June (“CPE: at 20 hours?”), 1 October (“Renew CIA in CCMS”), and 1 December (“CIA renewal confirmed?”), each with the spreadsheet linked. The mid-year check is what makes the system work, because autumn training calendars fill and a December scramble for 20 hours is how people end up counting a webinar they did not finish. For those who prefer a tool, any personal task manager or a shared department log does the same job; the site’s guide to planning and tracking CPE hours compares a few options, and functions that manage renewal for a team should treat the log as a control with an owner and a quarterly review.
What does not count, and how functions should manage CPE for a team
The policy’s generosity about sources has a boundary, and the activities that fall outside it are the ones people most want to claim. Doing the job does not count: an engagement in a new industry, a first fraud investigation, or a year of SOX testing is experience, not education, however much was learned. Reading counts only when it is structured as self-study with an assessment; a subscription to a professional journal, a stack of guidance downloaded from the IIA, and this website do not earn hours on their own. Time spent preparing for a certification exam does not count, although passing the exam does, up to 40 hours. Repeating a presentation earns nothing after the first delivery. Sessions with no educational content, which in practice means vendor demonstrations, networking events, and conference keynotes that are motivational rather than instructional, are excluded, and a conference certificate that lists eight hours will not survive an audit if the agenda shows two of them were a product showcase and a reception. The test to apply is the one in the policy’s own record requirements: if you cannot state the sponsor, the instructional content, the hours of instruction, and produce evidence that you completed it, it is not CPE.
For a chief audit executive the requirement is also a management obligation. The Global Internal Audit Standards require the function to maintain the collective competency to perform its work and require the chief audit executive to see that staff develop professionally; a function in which certified staff let designations lapse, or in which training is whatever a conference brochure offered, will hear about it in an external quality assessment. The practical arrangement in a well-run function is simple: a training plan built at the start of the year from the audit plan’s skill needs (analytics before the analytics-heavy engagements, cybersecurity before the cyber review, ethics in the first quarter for everyone), a shared CPE log maintained by the team with the individual evidence attached, and a line in the quarterly management review confirming that every certified auditor is on track for renewal. The site’s GIAS Domain IV guide covers the competency and development requirements, and the QAIP guide shows where team CPE evidence sits in an external assessment. In a one-person function, which has no one else to notice a lapse, the head should treat their own renewal as a control in the function’s calendar, as the site’s guide to setting up a small-company function recommends for every recurring obligation the function owns.
| Claimed activity | Counts? | Why |
|---|---|---|
| Leading a fraud investigation for the first time | No | Work experience, not an educational program |
| Reading the Global Internal Audit Standards in full | No, unless part of a self-study course with an assessment | No sponsor, no instruction, no completion evidence |
| Completing a self-study Standards course with a final test | Yes, at the provider’s assigned hours | Structured program with an attestation of completion |
| Studying for and passing CIA Part 3 | The pass counts, up to the 40-hour exam cap; the study time does not | Passing an examination is a listed category; preparation is not |
| Presenting the same session to two chapters | The first delivery only | Repeat presentations do not earn additional hours |
| A vendor demonstration of audit software at a conference | No | No educational content; commercial presentation |
| A vendor-run training class on the same software with an agenda and exercises | Yes | Instructional content on a tool used in the work, with completion evidence |
| Sitting on a nonprofit board’s audit committee | No, as a rule | Service, not education; a governance training session for that board would count |
| Writing an internal methodology manual for your function | Generally no | Internal work product; a published article or book chapter is the listed category |
| Serving on an IIA exam development or guidance committee | Yes, at the IIA’s assigned hours, up to 20 | Listed subject-matter-expert volunteering category |
Common CPE mistakes
| Failure | What it looks like | Why it matters | Fix |
|---|---|---|---|
| Missing the 31 December deadline | Renewal left to the last week of a busy December | Immediate grace status; the designation may not be used from 1 January | Renew in the first week of October |
| Believing the hours are the deadline | Forty hours earned by September, renewal never submitted | Hours do not renew a certification; the CCMS attestation does | Calendar the renewal act, not the hours |
| No ethics hours | Thirty-eight hours of technical training and none on ethics | Renewal cannot be completed truthfully; the attestation asks specifically | Book the two ethics hours in the first quarter every year |
| Claiming calendar time | A one-day conference logged as 8 hours when instruction was 5.5 | Overstated hours fail an audit | Apply the 50-minute rule to instruction time only |
| Unfinished webinars | Registered, joined for twenty minutes, logged the full hour | No attestation of completion; fails an audit | Log only sessions with a completion certificate or attendance record |
| Lost evidence | Certificates left in a former employer’s LMS | A clean renewal becomes an audit failure and a revocation | Download certificates when issued; one folder per year, kept three years |
| Double-counting across years | A December course claimed in both the old and the new period | The policy forbids counting an hour twice | Log by completion date; use prior-year surplus only to cover a current deficiency |
| Wrong status declaration | Declaring non-practicing while working in a compliance role to halve the hours | Compliance and control work is practice; a false declaration is an ethics breach | Declare practicing if your work is in any of the fields the IIA counts as internal audit experience |
| Sitting in grace for “a bit” | A lapsed CIA who intends to sort it out next year | Twenty-four months passes quickly; revocation means Part 1 again | Renew the missed period now; the fee is small next to the alternative |
| Over-buying | A $3,000 conference bought because “I need my hours” | Forty hours are available for under $150 to anyone who plans | Build the year from free and low-cost sources first; buy the conference for its content, not its hours |
The CIA is renewed, not re-earned, and the whole requirement reduces to three habits: log activities as they happen, book the ethics hours early, and renew in October. The site’s guide to maintaining the CIA covers the broader professional-standing side, including the Standards conformance attestation, and avoiding mistakes when claiming CIA credits goes deeper on the audit-proofing of individual claims.
Related guides
- How to maintain your CIA certification — status, attestation, and professional standing
- Low-cost and free CIA CPE — the recurring sources behind Profile B
- Tracking and organizing CIA CPE — folder structures and tools
- Planning and tracking CPE hours — the annual plan for a team
- Avoiding mistakes when claiming CIA credits — audit-proofing individual claims
- CIA exam cost in 2026 — the full lifetime cost including renewal
- CIA exam requirements — the eligibility rules before certification
- GIAS Domain II: ethics and professionalism — the content of the two ethics hours
- Global Internal Audit Standards — the conformance the attestation refers to
- All Guides — the full index
Leave a Reply