Most people earn the Certified Internal Auditor designation by passing three exams. A smaller group can earn it by passing one. The CIA Challenge Exam is a single, 150-question exam that the IIA offers to professionals who already hold a qualifying credential or, since 2026, a long record of relevant experience, on the reasoning that they have already demonstrated much of what the three parts test. For the right candidate it is the fastest route to the letters. For the wrong one it is a more expensive, less forgiving version of the same destination.
The program changed substantially in 2026. On 1 April the IIA announced a single unified exam for every pathway from 1 June 2026, year-round applications, four testing windows a year, recognition of seventeen more accounting bodies and a pilot pathway for experienced professionals without a qualifying credential. Much of what is written about the Challenge Exam predates those changes. This guide sets out who qualifies under each pathway, what the exam covers and how it is scored, what it costs and which rules differ from the three-part route, the decision math for the most common candidate profiles, the other accelerated routes into the CIA, and how to prepare. The facts come from the IIA’s Challenge Exam, pricing and scoring pages and its candidate handbook as they stood in September 2026; where the IIA’s own pages were silent or inconsistent, we say so.
In this guide
- What the Challenge Exam is, and what changed in 2026
- Who qualifies: the three pathways
- The exam: format, syllabus and scoring
- What it costs, and the rules that differ
- Applying, step by step
- The decision math: one exam or three?
- Other accelerated routes into the CIA
- How to prepare for one 150-question exam
- Questions candidates ask about the Challenge Exam
- Related guides
What the Challenge Exam is, and what changed in 2026
The Challenge Exam leads to exactly the same designation as the three-part route. A CIA earned through the Challenge Exam holds the same letters, appears the same way when the credential is verified, and carries the same obligations afterwards, including 40 hours of continuing professional education a year for a practicing CIA, two of them in ethics. What differs is the route: one exam, covering the whole CIA syllabus at a compressed depth, instead of three exams that cover it in full.
For years the Challenge Exam was a niche offering for chartered and certified public accountants from specific accounting bodies, with fixed application windows and separate exams for different candidate groups. The April 2026 announcement changed the model. From 1 June 2026 there is one unified exam for every pathway, aligned to the Global Internal Audit Standards and to the same content as the three-part exam. Applications are open all year instead of in windows. Testing happens in four windows a year, in February, June, September and November. The accounting pathway was widened to seventeen additional accounting bodies. And a new experience-based pathway was launched as a pilot for professionals with ten or more years in internal audit or related fields. The June 2026 window was used to collect data and set the passing standard for the new exam, which is why candidates in that window waited up to eight weeks for results; from 1 September 2026 the IIA releases official Challenge Exam results within three weeks of the exam date, in line with the three-part exam.
The logic behind the exam has not changed. An accountant who has qualified with a recognized body has already been examined on financial reporting, controls, audit evidence, ethics and professional judgment, and an active CISA has been examined on the audit of information systems. The Challenge Exam tests what those credentials do not: the internal audit profession’s own framework, its Standards and the way a function is governed, managed and held to quality. Before 2026 the accountant’s version of the exam was built from the three parts of the 2019 syllabus, and holders of the IIA’s retired specialty designations, the CCSA, CFSA and CGAP, had a separate specialty challenge exam that closed in June 2021. The unified exam replaces the older versions with a single syllabus aligned to the Global Internal Audit Standards, which is why study material written for the pre-2026 exams should be treated with caution.
Who qualifies: the three pathways
There are three ways in. Two rest on a credential you already hold; the third, still a pilot in 2026, rests on experience. In every case the candidate applies in CCMS, the IIA’s candidate portal, and uploads proof of eligibility and a government-issued photo ID.
| Pathway | Who qualifies | What you upload | Experience proof |
|---|---|---|---|
| Accounting | Holders of a CPA or CA designation from one of the accounting bodies on the IIA’s approved list, which after the 2026 expansion names more than thirty bodies worldwide | A letter of good standing or a current license from the body, and photo ID | Not required |
| Information systems | Active holders of ISACA’s Certified Information Systems Auditor (CISA) | Proof from ISACA’s public registry that the CISA is active, and photo ID | Not required |
| Professional (pilot) | Professionals with ten or more years of experience in internal audit or related fields: quality assurance, risk management, audit or assessment disciplines, compliance, external audit or internal control | An experience verification form, and photo ID; the IIA may contact employers to confirm | Required: that is the pathway |
The accounting list is the part most candidates get wrong, in both directions. The bodies named on the IIA’s page include, among many others, the Institute of Chartered Accountants in England and Wales, the Institute of Chartered Accountants of Scotland, the Association of Chartered Certified Accountants, Chartered Accountants Ireland, CPA Ireland, CPA Australia, CPA Canada, Chartered Accountants Australia and New Zealand, the Hong Kong Institute of CPAs, the Institute of Chartered Accountants of India, the South African Institute of Chartered Accountants and bodies in Germany, the Netherlands, Denmark, Portugal, Turkey, Saudi Arabia, Singapore, Malaysia, the Philippines and across Africa. Being a chartered or certified accountant is not enough on its own; your body must be on the list, your membership must be in good standing, and the IIA did not publish which seventeen bodies were added in 2026, so check the current list on the IIA’s Challenge Exam page for your specific body before you plan around it.
The professional pilot deserves a note of caution. In its first cycle, applications ran from 1 April to 30 September 2026, with testing in the June, September and November windows. A pilot is by definition subject to change, and the IIA has not said whether it will continue in the same form after 2026. A candidate with ten years of risk or compliance experience who is attracted to the pilot should confirm on the IIA’s page that applications are open before planning around it, and should weigh it against the three-part route, which is open to the same person without conditions.
Two further rules apply to everyone. Candidates living in the United Kingdom, Ireland or South Africa must be IIA members to apply, as they must for the CIA, the IAP and the CRMA. And a candidate already enrolled in the three-part CIA program must deactivate that program before applying for the Challenge Exam, with no refunds or transfers of fees already paid; passed parts do not carry across.
The exam: format, syllabus and scoring
The Challenge Exam has 150 multiple-choice questions in 180 minutes, taken at a Pearson VUE test center; the IIA ended online proctoring for all its exams on 28 May 2025. That is 72 seconds a question, exactly the pace of the three-part exam. It is offered in English, French and Spanish, with Simplified Chinese registration opening in October 2026 for delivery in mainland China from December 2026. Like every IIA exam, it is scored on a scale from 250 to 750 with 600 needed to pass, and a passing report shows no number.
The syllabus that took effect with the unified exam in June 2026 has five sections. Its structure is condensed mostly from the Part 2 and Part 3 headings of the three-part syllabus, with Part 1’s ethics and quality material at the front; Part 1’s foundations, governance, risk and control, and fraud content appear as topics inside the sections rather than as sections of their own. That reading of the structure is ours, not the IIA’s, but it matches the section contents.
| Section | Weight | Questions at that weight | What it covers | Closest three-part material |
|---|---|---|---|---|
| A. Professionalism and Quality | 20% | About 30 | Ethics, objectivity, due professional care, conformance and the quality program | Part 1 Ethics and Professionalism; Part 3 Quality |
| B. Operations and Audit Plan | 15% | About 22 | Running the function: strategy, methodologies, resources, the audit universe and the risk-based plan | Part 3 Operations and Plan; Part 1 Foundations |
| C. Engagement Planning | 20% | About 30 | Objectives, scope, criteria, risk assessment and work programs, including fraud risk | Part 2 Engagement Planning; Part 1 Fraud Risks |
| D. Engagement Performance | 25% | About 38 | Evidence, analysis, data analytics and AI, findings, workpapers and conclusions | Part 2 Information Gathering, Analysis, and Evaluation |
| E. Results and Monitoring | 20% | About 30 | Communicating results, action plans, risk acceptance, follow-up and escalation | Part 3 Engagement Results and Monitoring |
What the table means for a qualified accountant or IT auditor is that the exam does not test the material they already know best. It does not ask a chartered accountant about accounting or a CISA about information systems as subjects; it asks both about internal auditing as the Global Internal Audit Standards define it. The marks are in the profession’s own vocabulary: the mandate and the charter, objectivity and its safeguards, the engagement sequence in Domain V, the elements of a finding, and what the chief audit executive must communicate and to whom. An external auditor will find the evidence and sampling material familiar and the quality program, the risk-based plan and the handling of risk acceptance unfamiliar. A CISA will find the planning of technology risks familiar and the ethics domain and the results-and-monitoring chain new.
What it costs, and the rules that differ
The fees are the IIA’s North American prices as published in September 2026; IIA institutes in other countries may price the program differently.
| Item | Challenge Exam, member | Challenge Exam, non-member | Three-part CIA, member | Three-part CIA, non-member |
|---|---|---|---|---|
| Application | $150 | $380 | $120 | $240 |
| Exam fees, first attempt | $845 | $1,245 | $870 (three parts) | $1,275 (three parts) |
| Total, first attempt | $995 | $1,625 | $990 | $1,515 |
| Cost of one failed attempt | $845 again | $1,245 again | $280 to $310 for the failed part only | $415 to $445 for the failed part only |
| Extensions | None: the IIA states there are no program or exam extensions | None | Registration extension $100; one-time 12-month program extension $275 | Same |
Three rules change the risk profile. First, there are no extensions of any kind on the Challenge Exam, where the three-part route offers a 75-day registration extension and a 12-month program extension. Second, the exam runs only in the four testing windows, so a candidate who misses a window or fails waits for the next one rather than booking any available date. Third, it is all or nothing: a failed Challenge Exam leaves no partial credit, whereas a three-part candidate who fails one part keeps the parts already passed. An IIA support article dated September 2024 gave the registration as valid for 180 days or until the program expires, whichever is sooner; the IIA’s Challenge Exam FAQ, rather than third-party sites that disagree with each other, is the place to confirm the current retake rules and program length before you apply.
The requirements after the exam are lighter than on the three-part route for the credential pathways. Accounting and CISA pathway candidates do not submit proof of experience, because the qualifying credential stands in for it; the current candidate handbook no longer requires the character reference that older guides mention. Once certified, every CIA reports continuing professional education annually, 40 hours for a practicing CIA including 2 of ethics, and the IIA charges an annual renewal fee, $30 for members and $120 for non-members, which some local institutes pay on their members’ behalf. The CIA CPE guide covers the renewal rules in full.
Applying, step by step
The application runs through CCMS, the same portal the three-part program uses, and the sequence is short. The order below matters mainly because the testing windows are fixed: work backwards from the window you want, and leave time for the documents that take longest to obtain, which for most accounting-pathway candidates is the letter of good standing from their body.
| Step | What you do | What to watch |
|---|---|---|
| 1. Confirm eligibility | Find your accounting body on the IIA’s list, confirm your CISA is active in ISACA’s registry, or confirm the professional pilot is open and that you have ten years of qualifying experience | Eligibility depends on the issuing body, not on the letters; lapsed memberships and CISAs in grace periods do not qualify |
| 2. Gather documents | A letter of good standing or license, registry proof, or the experience verification form; a government-issued photo ID in the exact name you will test under | The name on the ID must match your CCMS profile exactly, or the test center can turn you away |
| 3. Decide on membership | Join the IIA first if you want member pricing, or if you live in the United Kingdom, Ireland or South Africa, where membership is required | Member pricing saves $630 against non-member pricing, more than a year of individual membership at $290 |
| 4. Apply in CCMS | Submit the Challenge Exam application with your documents and pay the application fee: $150 for members, $380 for non-members | If you are already in the three-part program, deactivate it first; nothing transfers |
| 5. Register and book | Once approved, register for the exam, pay the exam fee of $845 or $1,245, and book a Pearson VUE seat in your chosen testing window | Seats in popular centers fill early; book as soon as the window is chosen |
| 6. Sit the exam | 150 questions in 180 minutes at the test center; arrive at least 30 minutes early with your ID | Nothing appears on screen at the end |
| 7. Results and certification | The official result reaches CCMS within three weeks; certification follows once the result and eligibility are confirmed | Annual CPE reporting begins after certification |
Two practical notes. First, choose the window before you start studying, not after: the exam’s fixed windows are its biggest constraint, and a study plan with no date drifts. Second, keep copies of every document you upload and every confirmation email; if a result is flagged for additional review, which the IIA says can extend the wait to four to six weeks, your documentation is what resolves queries quickly.
The decision math: one exam or three?
On fees alone the two routes are almost identical for a member: $995 against $990. The real differences are time, risk and fit, and they point in different directions for different people.
| Factor | Challenge Exam | Three-part route |
|---|---|---|
| Exam time | One sitting of 180 minutes | Three sittings totalling 390 minutes |
| Typical preparation | A concentrated period of study covering the whole syllabus once, for a candidate already strong in audit and accounting concepts | Three study blocks, typically 250 to 400 hours across the parts, spread over months |
| Calendar | Four windows a year; certified within weeks of passing | Any available date; usually a year or more from start to finish |
| Risk of a fail | High cost and no partial credit; the next attempt waits for a window | Lower cost per failure; passed parts are kept |
| Depth tested | The whole syllabus in 150 questions, so fewer questions per topic and less room to recover from a weak area | Each part in 100 to 125 questions, so more questions per topic |
| Flexibility | No extensions | Registration and program extensions available |
| Who it suits | Experienced professionals with a qualifying credential who can prepare intensively and sit once | Candidates earlier in their careers, or anyone who prefers to bank progress part by part |
Four profiles show how the math plays out. A chartered accountant from a listed body who has moved from an audit firm into an internal audit manager role is the Challenge Exam’s core candidate: evidence, sampling, controls and reporting are familiar, and a focused study period on the Standards, the ethics domain, the quality program and results and monitoring is usually enough. An IT auditor with an active CISA is a strong candidate for the same reasons, provided they give real time to the ethics and results-and-monitoring material that IT audit work does not exercise. A risk or compliance professional with twelve years’ experience, eligible only through the professional pilot, faces a harder choice: the pilot’s future is uncertain and the exam assumes internal audit fluency that second-line work does not always build, so the three-part route, starting with Part 1, is often the safer plan. And an accountant whose body is not on the list has no Challenge route at all and should plan the three parts, perhaps with a lighter Part 2 thanks to audit experience.
The deciding question is usually this: could you pass a 150-question exam across the whole syllabus, at 72 seconds a question, in one sitting four to ten weeks from now? If the honest answer is yes, the Challenge Exam saves a year. If it is “probably, with luck”, the three-part route costs about the same and forgives a bad day. The certification roadmap by career stage sets the CIA against the other credentials for each profile, and the CIA versus CPA and CIA versus CISA comparisons cover the combinations in detail.
Other accelerated routes into the CIA
The Challenge Exam is the best-known shortcut, but it is not the only way to shorten the path, and for many candidates another route fits better.
| Route | How it works | Who it suits |
|---|---|---|
| The IAP route | Since 28 May 2025 the Internal Audit Practitioner exam is CIA Part 1, and an active IAP carries Part 1 forward into the CIA program. The IAP has no education requirement, and it became a permanent designation in July 2025. IAPs awarded after 27 May 2025 keep the Part 1 waiver for four years from the award; earlier IAPs had to apply to the CIA by 31 May 2026 to use it | Candidates without a degree, students, and anyone who wants a credential after the first exam rather than the third |
| The student route | Students enter through the IAP: its exam is CIA Part 1, student fees are $45 to apply and $165 for the exam, and an active IAP applies to the CIA with a Part 1 waiver; IIA student membership is free in the United States, Canada and the Caribbean for students taking six or more credits | Students who want to pass Part 1 while study habits are fresh |
| Sitting before the experience | Candidates with a degree, or with the IAP, can pass all three parts first and verify their experience later, within the program window | Early-career auditors who want the exams behind them before the busiest years of their careers |
| The CIA Specialty Challenge Exam | A bridge exam for holders of the retired CCSA, CFSA and CGAP designations, closed on 30 June 2021 | No one now; it appears in older guides and is no longer offered |
The IAP route in particular has changed the calculation for candidates without a degree. A candidate without a degree who does not hold the IAP still needs five years of experience before entering the CIA program. The IAP, which asks only for identification, changes that: it is Part 1 itself, and an active IAP can enter the CIA program without a degree and certify once five years of experience are verified, two of them within the last three. The CIA requirements guide sets out the entry paths in detail, and the timing guide covers when in a career each route makes sense.
How to prepare for one 150-question exam
Preparing for the Challenge Exam is a different problem from preparing for a single part. The syllabus is the whole CIA, the exam samples it thinly, and the candidate is by definition experienced, so the risk is not ignorance but misplaced confidence: an accountant or IT auditor who assumes that professional experience covers the internal audit Standards. The preparation that works starts with a diagnostic, spends most of the time on the material the candidate’s background does not cover, and ends with timed, mixed practice at the full length.
What the candidate’s background covers depends on the pathway. The table is a starting point for the diagnostic, not a substitute for it.
| Background | Usually familiar | Usually new, and where the marks are |
|---|---|---|
| Chartered or certified accountant from an audit firm | Evidence, sampling, controls testing, reporting, professional ethics codes | The mandate, charter and independence of an internal audit function; advisory work; the quality program; the risk-based plan; risk acceptance and escalation; the Three Lines Model |
| Accountant working in industry or finance | Financial controls from the process owner’s side, the close, reporting | The engagement methodology itself: planning sequence, criteria, work programs, the elements of a finding, workpapers, and the Standards throughout |
| IT auditor with an active CISA | Planning for technology risks, general and application controls, evidence and sampling in systems audits | Domain II ethics and professionalism, governance of the function, fraud schemes outside technology, and the whole results-and-monitoring chain |
| Risk or compliance professional on the professional pilot | Risk concepts, appetite and responses, compliance programs, control frameworks from the second line | Third-line independence and objectivity, the audit engagement methodology, evidence standards, and reporting and follow-up as the Standards require them |
| Week | Focus | What to do |
|---|---|---|
| 1 | Diagnostic and the Standards’ map | A mixed diagnostic of 50 or more questions across all five sections; read the structure of the Global Internal Audit Standards and Domain I; list the three weakest sections |
| 2 to 3 | Professionalism and Quality; Operations and Audit Plan | Domains II, III and IV of the Standards; a one-line rule for each standard; the quality program, conformance and nonconformance; the risk-based plan |
| 4 to 5 | Engagement Planning and Performance | Domain V, Standards 13.1 to 14.6, in sequence; planning scenarios; evidence, analytics and the elements of a finding |
| 6 | Results and Monitoring | Recommendations and action plans, risk acceptance, follow-up and escalation; every chief audit executive scenario you can find |
| 7 | Mixed timed practice | Three timed sets of 50 at the Challenge weights; review every miss the next day |
| 8 | Full simulation and review | A full 150-question simulation in 180 minutes; repair what it exposes; one light set; rest; sit |
Eight weeks at ten to twelve hours a week is a realistic schedule for a strong candidate; stretch it to ten or twelve if the diagnostic shows gaps across several sections. For material, the Challenge Exam has its own dedicated review products: Becker, the IIA’s review partner, introduced a Challenge Exam course with the IIA in December 2025, and the three-part review courses cover the same content at greater depth. The free CIA question bank on this site is written to the three-part 2025 syllabus, which covers the same content, and it is a good diagnostic: run a mixed set from each part in the first week. The 2025 syllabus guide lists every topic with what the exam is really checking, and the CIA Study Planner can lay out the weeks around your calendar if you plan the Challenge as a single part with the hours you choose.
The reading that repays the time is the Standards themselves, read the way the exam reads them. The Standards reference map gives the structure, and the domain guides for ethics and professionalism, governing the function, managing the function and performing engagements explain each requirement with examples from real engagements. Accountants moving from external audit should also read the external-to-internal audit transition guide, because the exam tests exactly the differences it describes.
Questions candidates ask about the Challenge Exam
Is a CIA earned through the Challenge Exam any different?
No. The designation, the letters and the renewal obligations are the same whichever route you take.
Can a US CPA take the Challenge Exam?
Check the IIA’s current accounting-body list for your licensing body before you plan. The list is specific, it changed in 2026, and eligibility depends on the body that issued your designation rather than on the letters themselves. If your body is not listed, the three-part route is open to you, and an accounting background typically shortens Part 2.
Can I switch to the Challenge Exam if I have already passed a part?
You can switch, but you must deactivate your three-part program first, with no refund or transfer of fees, and a passed part does not count toward the Challenge Exam. With one or two parts already passed, finishing the three-part route is almost always cheaper and safer.
Is the Challenge Exam easier than the three parts?
It is shorter, not easier. Each topic gets fewer questions, so there is less room to recover from a weak area, and the candidates who take it are experienced, which raises the standard the exam is calibrated against. The IIA has not published a pass rate for the unified exam.
Can I take it online?
No. Every IIA exam, including the Challenge Exam, is delivered at Pearson VUE test centers; online proctoring ended on 28 May 2025.
How soon after passing am I certified?
Official results arrive within three weeks of the exam date. For the accounting and CISA pathways there is no separate experience verification, so certification follows once the result and your eligibility documents are confirmed in CCMS; the professional pathway’s experience form is verified as part of the application.
Do I need to be an IIA member?
Only if you live in the United Kingdom, Ireland or South Africa. Everywhere else membership is optional, but member pricing on the application and exam fees saves $630, which is more than the $290 cost of a year of individual membership.
What happens if I fail?
You retake in a later testing window and pay the exam fee again: $845 for members, $1,245 for non-members. There is no partial credit and no extension. Confirm the current retake rules and your program length in the IIA’s Challenge Exam FAQ before you apply, because third-party sources disagree and the rules were revised with the 2026 changes. The retake playbook applies to the Challenge Exam as much as to the three parts.
Related guides
- The CIA exam, explained — the three-part route in full, with every fee and rule.
- The 2025 CIA exam syllabus — all 62 topics the Challenge Exam draws on.
- Free CIA practice questions — a diagnostic across all three parts.
- The CIA Study Planner — a day-by-day plan around your calendar.
- CIA exam requirements — eligibility and entry paths for the three-part route.
- What the CIA costs — every fee on both routes.
- CISA for internal auditors — the credential behind the information systems pathway.
- A certification roadmap by career stage — what to earn when.
- From external audit to internal audit — the transition the accounting pathway assumes.
- The Global Internal Audit Standards, mapped — the framework the exam is written to.
- CIA vs ACCA — a specialist certification or a full accountancy qualification.
- IAP vs CIA — the IIA’s entry designation and the route to the CIA.
- Internal audit certifications compared — every credential on one page.
- CIA exam dates — every deadline from registration to results.
- CIA exam passing score — how the 250-to-750 scale and the 600 cut score work.
Leave a Reply