Most candidates who fail a CIA part did not fail for want of intelligence or effort. They failed because of a handful of avoidable errors: they studied from a book written for the old syllabus, they read far more than they practiced, they answered from their own department’s habits rather than from the Standards, they ran short of time on the last twenty questions, or they let a registration lapse and sat before they were ready to avoid losing the fee. None of those is a knowledge gap, and all of them can be fixed before exam day.
This guide replaces our earlier list of mistakes, which was written to the 2019 syllabus. It covers twenty errors that cost candidates a pass under the 2025 syllabus and the IIA’s current rules, grouped by the stage at which they happen: planning, materials, study method, exam technique, exam day, and after the exam. For each, it describes what the mistake looks like from the inside, what it costs, and how to fix it. For the whole exam, start with the CIA exam guide.
In this guide
- The twenty mistakes at a glance
- Planning mistakes
- Materials mistakes
- Study-method mistakes
- Exam-technique mistakes
- Exam-day and administrative mistakes
- Mistakes after the exam
- Mistakes specific to each part
- Mistakes by candidate profile
- A self-check before you book
- If you spot a mistake late
- Questions candidates ask about CIA mistakes
- Related guides
The twenty mistakes at a glance
| # | Mistake | Stage | What it typically costs |
|---|---|---|---|
| 1 | Applying long before you are ready to study | Planning | Months of the three-year program window |
| 2 | Letting a part registration lapse | Planning | The part fee, or an unready sitting to save it |
| 3 | Planning hours without a diagnostic | Planning | Hours spent evenly on strong and weak domains |
| 4 | Preparing two parts at once | Planning | Neither part reaches exam standard |
| 5 | Studying from 2019-syllabus material | Materials | Hours on content that is no longer tested |
| 6 | Practicing on questions you have memorized | Materials | Practice scores that overstate readiness |
| 7 | Never reading the Standards themselves | Materials | Answers that are sensible but not required |
| 8 | Reading more than practicing | Method | Knowledge that does not convert into answers under time |
| 9 | Skipping rationales, especially for correct answers | Method | Lucky guesses mistaken for knowledge |
| 10 | Ignoring the syllabus weights | Method | Too little time on the domains that decide the result |
| 11 | Never practicing under time | Method | Unanswered or rushed final questions |
| 12 | No miss log and no review week | Method | Early mistakes never repaired |
| 13 | Answering from your own department’s practice | Technique | The distractor written to match common practice |
| 14 | Changing answers without a specific reason | Technique | Correct first answers lost to doubt |
| 15 | Getting stuck on hard questions | Technique | Time taken from easier questions later |
| 16 | Misreading the qualifier in the stem | Technique | The right answer to a different question |
| 17 | An ID or name problem at check-in | Exam day | Being turned away, and the fee |
| 18 | Late changes, late arrival and room rules | Exam day | A forfeited appointment or lost minutes |
| 19 | Treating a fail report as a verdict | After | A second fail with the same method |
| 20 | Breaking the confidentiality agreement or misusing the letters | After | Consequences for the candidacy or the designation |
Planning mistakes
1. Applying long before you are ready to study. The CIA program window is three years, and it starts when the IIA approves your application, not when you begin studying or sit your first part. Candidates who apply to “get the admin done” in January and start studying in the autumn have already spent most of a year. Three years is ample when the clock starts with the study, and tight when it does not; if it runs out, passed parts are forfeited unless you have bought the one-time 12-month extension, $275, beforehand. The fix is simple: apply when your first study block is scheduled, with your documents ready, as the requirements guide describes.
2. Letting a part registration lapse. Each part registration is valid for 180 days, or until the program window closes if that comes sooner. Candidates who register the moment they decide to study, then lose a month to work, find themselves with a few weeks left and a choice between sitting unready and losing the fee. The IIA offers one 75-day extension for $100, requested before the registration expires. Better still, register a part about a third of the way into its study plan, so the 180 days cover the practice-heavy weeks, and book the Pearson VUE appointment the same day.
3. Planning hours without a diagnostic. Planning from a figure in a forum thread, or from a colleague’s experience, gives you somebody else’s hours. A timed diagnostic of fifty unseen questions, taken before you study, tells you where in the range you sit and which domains need the time. The free practice bank gives a score by domain in under an hour, and the study hours guide turns the score into a number of hours.
4. Preparing two parts at once. Alternating between Part 1 and Part 3 reading feels efficient and usually leaves both below exam standard, with two registrations running. The parts test different applications of the same Standards; they are learned best one at a time. The efficient overlap is small and comes after sitting a part: start the next part’s reading while the result is on its way, which since April 2026 takes up to three weeks.
Materials mistakes
5. Studying from 2019-syllabus material. The 2025 syllabus replaced the old one for English-language exams on 28 May 2025 and for other languages on dates the IIA published language by language. It did not keep the old parts with new names: Part 3 in particular went from business knowledge, IT and financial management to the management of the internal audit function. A second-hand Part 3 book, a free video series from 2023 or a question bank that still cites numbered standards from the former framework will teach content that is no longer tested, in vocabulary the exam no longer uses. The table shows the most common tells.
| If the material says | It was written for the old syllabus or framework. The current term is |
|---|---|
| Part 1: Essentials of Internal Auditing | Part 1: Internal Audit Fundamentals |
| Part 2: Practice of Internal Auditing | Part 2: Internal Audit Engagement |
| Part 3: Business Knowledge for Internal Auditing | Part 3: Internal Audit Function |
| Consulting engagement | Advisory services |
| Standard 1100, Standard 2200 and other four-digit numbers | The Global Internal Audit Standards, numbered 1.1 to 15.2 |
| The Code of Ethics as a separate document | The five principles of Domain II, Ethics and Professionalism |
| Basic and proficient topics | No cognitive-level labels; the verb in each topic signals depth |
| Online proctored exam from home | Test centers only since 28 May 2025 |
The fix is to check the date and the vocabulary of every source before you pay for it or spend an hour on it. The 2025 syllabus guide lists what changed, and the IPPF to GIAS mapping translates old standard numbers into new ones if you must use an older source for background.
6. Practicing on questions you have memorized. By the third pass through the same question bank, most candidates recognize the questions and remember the answers. Their scores rise, and their readiness does not. Practice scores only measure readiness on questions you have not seen before. Keep a reserve of unseen questions for timed sets and the final simulation, rotate between sources, and treat any score on a repeated question as a memory check rather than a readiness check.
7. Never reading the Standards themselves. Review courses summarize the Standards well, and a summary is not the requirement. The exam’s answers follow what the Standards require, often in their exact terms, and questions on the board’s role, independence, quality and risk acceptance turn on details that summaries flatten. You do not need to read every consideration for implementation, but you should read the requirements of the standards in the domains you are sitting. The Standards reference map shows where each one sits, and the CIA flashcards carry all 52 of them in short form.
Study-method mistakes
8. Reading more than practicing. Reading feels like progress because pages turn. The exam, though, is scenario questions answered in about 72 seconds each, and the skill it rewards, recognizing which requirement a scenario is testing and choosing between close options, is built by answering questions, not by reading about them. A useful rule is that at least three-quarters of your hours should be spent on questions, rationales and review, and no more than a quarter on first reading.
9. Skipping rationales, especially for correct answers. A correct answer can be a lucky guess or the right answer for the wrong reason, and the only way to tell is to read the rationale. Candidates who read explanations only for their misses miss half the learning. The rationale is also where the exam’s logic becomes visible: why the plausible option is wrong, which standard decides the question, and what word in the stem pointed to the answer. Every rationale in the free practice bank links to the guide that covers the topic in depth.
10. Ignoring the syllabus weights. The weights tell you where the marks are. Engagement Planning is half of Part 2, the heaviest domain on the exam; Engagement Results and Monitoring is 45 percent of Part 3; Foundations of Internal Auditing is 35 percent of Part 1. Candidates who give every domain the same time, or spend it on the domains they find interesting, starve the ones that decide the result. Allocate practice hours by weight, then shift some toward domains where your diagnostic was weak, never below the weight of a heavy domain. The study schedule guide divides a part’s hours domain by domain.
11. Never practicing under time. Part 1 is 125 questions in 150 minutes, and Parts 2 and 3 are 100 questions in 120 minutes each: 72 seconds a question throughout. Candidates who only ever practice in study mode, with unlimited time and the rationale one click away, meet the clock for the first time on exam day. Start timed sets of fifty in the second half of each part’s plan, and take at least one full-length simulation before the exam.
12. No miss log and no review week. Mistakes made in the first weeks of study are forgotten by the last, unless they were written down. A miss log, recording each missed question’s topic, the answer you chose, the correct answer and the standard behind it, becomes the syllabus for the final week. Candidates without one spend the last week learning new material, which is the lowest-value use of it. Nothing new in the final week; re-read the log.
Exam-technique mistakes
13. Answering from your own department’s practice. This is the mistake experienced auditors make most. Many exam questions include an option that describes what a reasonable department actually does, and one that describes what the Standards require. Where they differ, the exam wants the second. The chief financial officer approving the audit plan, the auditor designing the control while advising on it, the finding closed when management says it is fixed: each is common, and each is a distractor. Before choosing, ask what the Standards require, not what you have seen work. A practical test: if an option would pass an internal quality review of your own department but you cannot point to the requirement behind it, it is probably the distractor, and the option that names the requirement is probably the answer. The guide to the hardest CIA exam topics walks through the ten places where practice and the Standards most often part company.
14. Changing answers without a specific reason. On review, a second reading can make a correct answer look doubtful. Change an answer only when you can name the specific reason: a word in the stem you misread, a requirement you now recall, a fact in the scenario you missed. A vague sense that another option “might be better” is not a reason, and acting on it turns right answers into wrong ones as often as the reverse.
15. Getting stuck on hard questions. Every part contains questions you cannot answer with confidence. Candidates who spend four minutes on one of them take that time from easier questions at the end. Answer every question with your best choice, flag the doubtful ones, and move on; there is no penalty for a wrong answer, so never leave one blank. Checkpoints keep you honest about pace.
| Part | Questions and time | Be at question | By minute | Aim to finish by |
|---|---|---|---|---|
| Part 1 | 125 in 150 minutes | 50, then 100 | 55, then 110 | Minute 140, leaving 10 minutes for flagged questions |
| Part 2 | 100 in 120 minutes | 50 | 55 | Minute 110, leaving 10 minutes for flagged questions |
| Part 3 | 100 in 120 minutes | 50 | 55 | Minute 110, leaving 10 minutes for flagged questions |
16. Misreading the qualifier in the stem. Many questions turn on one word: which action should come first, which is the best evidence, which is most likely, which is not a responsibility of the board. A candidate who reads quickly answers a different question from the one asked, correctly, and loses the mark. Read the last sentence of the stem twice before reading the options, and underline, mentally, the qualifier: first, best, most, least, primary, except, not. A question that asks what the chief audit executive should do first after learning of an impairment has several sensible actions among its options and only one that comes first in sequence; candidates who read “should do” and miss “first” pick an action that is right but premature.
Exam-day and administrative mistakes
17. An ID or name problem at check-in. The name on your government-issued photo ID has to match the name in your CCMS profile. A missing middle name, a changed surname or an expired document found at the test center can mean being turned away, and a turned-away candidate can lose the appointment and the fee. Check the ID and the profile when you apply and again a week before each exam, and fix any mismatch through the IIA well before the day.
18. Late changes, late arrival and room rules. Three rules catch candidates on the day or just before it. Appointments can be rescheduled for $75 up to 48 hours before; inside 48 hours no change is possible, and a no-show forfeits the fee. Candidates must arrive at least 30 minutes before the appointment to check in; arriving later can mean being refused entry and treated as a no-show. And the testing room allows nothing of your own: personal items go in a locker, there is no food or drink in the room, and if you take a break the exam clock keeps running. The exam day guide covers check-in step by step.
| When | Check | If you skip it |
|---|---|---|
| When you apply | CCMS name matches your ID exactly | A mismatch surfaces at the test center |
| When you register a part | Book the appointment the same day | Popular dates fill; the registration window runs |
| A week before | ID valid on the exam date; center address; start time | An expired ID or the wrong center on the day |
| Three days before | Is a reschedule needed? Decide now | Inside 48 hours no change is possible |
| The day before | Rest; plan the journey with a margin | Fatigue and a late arrival |
| Exam day | Arrive at least 30 minutes early | Refused entry counts as a no-show |
Mistakes after the exam
19. Treating a fail report as a verdict. Since 1 April 2026 results arrive within three weeks rather than on screen, and a fail report shows your scaled score, out of the 600 needed on a scale of 250 to 750, and the domains to improve. It is a diagnosis. The mistakes after a fail are predictable: booking the earliest possible retake, 30 days after the attempt, out of frustration; repeating the same method with more hours; and restudying everything instead of the flagged domains. The fix is to read the report as an auditor would read a control failure: find the cause, change the method, and set the retake date by the size of the gap. The retake plan sets out 30, 60 and 90-day calendars for near, clear and wide misses. You have up to eight attempts at each part within the program window, so one fail changes the timeline, not the outcome.
20. Breaking the confidentiality agreement or misusing the letters. Before each exam you accept a nondisclosure agreement that forbids recording, disclosing or reproducing exam questions or answers, including in online forums and study groups. Discussing topics and study methods is fine; describing specific questions is not, and it puts the candidacy at risk. The letters are the second trap. “CIA” belongs to certified individuals, not to candidates who have passed some or all of the parts but are not yet certified, nor to holders whose certification has lapsed into grace status for missing CPE. After certification, practicing CIAs report 40 hours of continuing professional education a year, including two of ethics, by 31 December; the CIA CPE guide covers the rules.
Mistakes specific to each part
The twenty mistakes apply to every part, but each part also has a characteristic trap of its own, tied to what it tests. Knowing the trap for the part you are sitting tells you where to look when a practice score will not move.
| Part | The characteristic mistake | What it looks like | The fix |
|---|---|---|---|
| Part 1: Internal Audit Fundamentals | Treating ethics and independence as common sense | Scores in Ethics and Professionalism below the other domains; misses on who discloses what to whom | Learn the five principles and their thirteen standards as requirements, and the difference between the function’s independence and the auditor’s objectivity |
| Part 1 | Skipping the board’s role | Choosing senior management where the Standards name the board | List the decisions reserved for the board and test yourself on them until the list is automatic |
| Part 2: Internal Audit Engagement | Blurring objectives, scope, criteria and procedures | Picking a procedure when the question asks for an objective | Rewrite three planning memos with the four as separate headings |
| Part 2 | Counting exceptions instead of evaluating findings | Rating significance by the number of errors | Evaluate cause and effect on objectives, not only frequency |
| Part 3: Internal Audit Function | Studying the old business-knowledge Part 3 | Hours on ratios, IT architecture or managerial accounting | Study only 2025-syllabus material: operations, the plan, quality, results and monitoring |
| Part 3 | Answering as an in-charge auditor rather than a chief audit executive | Resolving disagreements personally; closing findings on management’s word | Follow the escalation sequences in the Standards, especially for risk acceptance and overdue actions |
The Part 3 rows deserve emphasis, because Part 3 is where the 2025 syllabus changed the most and where old habits of preparation do the most damage. Engagement Results and Monitoring carries 45 percent of the part, so a candidate who is weak there can be strong everywhere else and still fall short of 600. The part guides for Part 1, Part 2 and Part 3 go domain by domain.
Mistakes by candidate profile
Candidates at different stages make different mistakes, and a good plan is built against your own profile’s weaknesses rather than against a generic list.
New auditors and students tend to make the method mistakes. They read diligently, highlight thoroughly and practice too little, because reading is what university rewarded. Their knowledge of the Standards is often good, sometimes better than their managers’, and what they lack is the practical sense of an engagement that Part 2’s scenarios assume. The fix is to move to questions early, and to ask to see real planning memos, workpapers and reports at work, which turns abstract domains into things they have seen.
Experienced auditors make the technique mistakes, above all mistake 13. Years of practice give them fast, confident answers, and many of those answers describe their department rather than the Standards. They also tend to under-plan hours, trusting experience to carry them, and to skip the Standards themselves. The fix is humility about habits: read the requirements for the domains being tested, and treat every quick, confident answer to a governance or quality question as worth a second look.
Career switchers from external audit, risk or compliance make the materials and planning mistakes. They assume Part 3 is still the accounting-heavy business knowledge part, or that their audit background covers Part 2’s planning, and discover late that internal audit’s approach to scoping, criteria and follow-up differs from what they know. The fix is a diagnostic in each part before planning, and 2025-syllabus material only.
Managers and chief audit executives make the administrative mistakes. Their knowledge fits Part 3 well, but their calendars do not: registrations lapse during busy quarters, appointments are moved inside the 48-hour window, and study weeks disappear into meetings. The fix is to treat the exam like a project with a plan, dates and a sponsor, and to delegate what can be delegated in the final week.
Whatever the profile, the most useful single habit is to treat your own preparation the way you would treat an audit: set objectives, gather evidence of progress with timed scores rather than impressions, find the root cause when results disappoint, and follow up. The root cause analysis guide was written for audit findings, and its five-whys method works just as well on a stubborn practice score.
A self-check before you book
Most of the twenty mistakes can be caught with a short check before you book an appointment. If you can answer yes to each line, you have removed the errors that cost candidates the most.
| Check | Covers mistakes |
|---|---|
| My program window and registration dates are in my calendar, with the latest safe reschedule date marked | 1, 2 and 18 |
| My hours come from a timed diagnostic, and my plan divides them by syllabus weight | 3 and 10 |
| Every source I use was written for the 2025 syllabus, or I am testing in a language that has not moved yet and have matching material | 5 |
| I have a reserve of unseen questions for timed sets and a full simulation | 6 and 11 |
| At least three-quarters of my hours are questions, rationales and review | 8 and 9 |
| I keep a miss log with the standard behind each miss | 7 and 12 |
| My timed-set scores on unseen questions are consistently around 75 percent or better, with no domain far behind | 13, 15 and 16 |
| My ID is valid on the exam date and matches my CCMS name exactly | 17 |
The readiness line is a planning heuristic rather than an IIA rule: the exam is scored on a scaled score, not a percentage, so no practice figure converts exactly into a pass. It is still the best early warning available. If you are well short of it a fortnight before the exam, a $75 reschedule is almost always cheaper than a failed part. The CIA Study Planner keeps the dates, the scores and the miss log in one place, and warns when the remaining hours no longer fit before the appointment.
If you spot a mistake late
Most candidates recognize at least one of the twenty in their own preparation, often later than they would like. Late is still early enough for most of them, provided the response is quick and proportionate.
If you discover halfway through a plan that your material was written for the old syllabus, switch sources the same week rather than finishing the book you started; keep what you learned about the Standards, and re-map the rest to the 2025 domains using the syllabus guide. If a fortnight before the exam your timed scores on unseen questions are well short of where you want them, reschedule while more than 48 hours remain, for $75, rather than sitting to protect the date. If the registration itself is the constraint, the one-time 75-day extension, $100, buys the time, provided you request it before the registration expires. If you find an ID or name problem, contact the IIA at once; it is the one mistake that cannot be fixed at the test center.
And if the discovery comes in the form of a fail report, treat it as the late warning it is. The report tells you which domains to repair, the 30-day retake rule gives you time to repair them, and the eight attempts per part within the program window mean a single fail is a setback in the schedule, not the end of the plan.
Questions candidates ask about CIA mistakes
What is the most common reason candidates fail the CIA?
The IIA does not publish reasons for failure, but the same patterns recur in candidates’ accounts and in how practice scores respond to changes in method: too much reading and too little timed practice, answers drawn from workplace habit rather than the Standards, and, since 2025, study material written for the old syllabus. The guide to how hard the CIA is looks at the failure patterns part by part.
Is there a penalty for guessing?
No. A wrong answer scores the same as a blank one, so answer every question, flag the ones you are unsure of, and return to them if time allows.
Can I use an older review course if it has been updated?
Yes, if the update covers the 2025 syllabus, which you can check against the vocabulary table above. Print or used copies of older editions are the risk: the course may have been updated while the copy in your hands was not. The review course comparison covers the current editions.
How soon can I retake a failed part?
Thirty days after the attempt, at the full part fee again, with up to eight attempts at each part within the program window. Whether you should retake that soon depends on the size of the gap in your fail report.
Does a review course prevent these mistakes?
It prevents some. A current course removes the materials mistakes and supplies the question volume and simulations the method needs. It cannot stop you reading instead of practicing, answering from habit, or letting a registration lapse; those are yours to manage, and they account for many of the twenty.
Is it a mistake to prepare without a course?
Not necessarily, for an experienced auditor with a strong diagnostic and discipline. It does make two mistakes more likely: too little question volume and no full-length simulation. If you go without a course, spend part of the saving on a question bank that includes timed simulations, and read the Standards’ requirements for every domain yourself.
Should I take the CIA parts in a particular order to avoid mistakes?
For most candidates, Part 1 first: it teaches the structure and vocabulary of the Standards that the other parts assume, and it has the lowest pass rate of the three. The timing guide covers the exceptions.
Related guides
- The CIA exam, explained — the rules, fees and plans in one place.
- The hardest CIA exam topics — where workplace habit and the Standards part company.
- Free CIA practice questions — timed sets and rationales linked to guides.
- CIA flashcards — the standards and terms that fade between study and exam.
- The CIA Study Planner — dates, scores and the miss log in one plan.
- CIA study hours — planning hours from a diagnostic.
- CIA study schedule — the weekly pattern and catch-up rules.
- The 2025 CIA exam syllabus — what is tested now.
- CIA exam day — booking, check-in and pacing.
- Failed a CIA part? — reading the report and planning the retake.
- How to study for the CIA exam — the practice-first method, the research behind it and a weekly routine.
- CIA exam passing score — how the 250-to-750 scale and the 600 cut score work.
Leave a Reply