Every CIA who reports hours must complete two hours of ethics training a year. It is the smallest part of the renewal requirement and the one most easily left to the last week of December, because it has to be a specific kind of training and cannot be earned by accident. The two hours sit inside the annual total rather than on top of it: a practicing CIA needs 40 hours, of which at least two are ethics, and a non-practicing CIA needs 20, of which two are ethics. At renewal you attest that you have completed them, so an ethics shortfall is not something you can report around. You either have the hours or you cannot truthfully renew.
This guide covers the ethics requirement on its own: the rule by designation and status, what counts as ethics training and what does not, what the hours should cover now that the IIA’s ethics requirements are Domain II of the Global Internal Audit Standards, where to get them free or cheaply, how the requirement lines up with the ethics rules of other credentials, and what to do if you reach December without them. The rules are from the IIA’s Annual Certification Renewal Policy. The sources and prices were checked in September 2026. The full CPE rules, including every category and cap, are in the guide to CIA CPE requirements.
In this guide
- The rule: two hours a year, inside the total
- What counts as ethics training
- What the two hours should cover
- Choosing a course worth two hours
- Where to get the two hours
- Free ethics CPE, specifically
- Ethics across your other credentials
- Timing, evidence and the attestation
- Short of ethics hours in December
- Running ethics training for your team
- Questions CIAs ask about ethics CPE
- Related guides
The rule: two hours a year, inside the total
The policy requires certified individuals to complete two CPE hours on the subject of ethics each year. The IIA does not prescribe where the training comes from, but it must take place within the reporting period. The requirement is the same for every IIA designation and applies whenever you owe hours, so it covers practicing and non-practicing holders alike. Retired holders are exempt from all renewal requirements, ethics included. Hours are measured the same way as the rest of your CPE: one CPE hour is a 50-minute period, and a program shorter than 50 minutes can be reported in 10- or 25-minute increments. Two ethics hours are therefore 100 minutes of qualifying instruction, not two clock hours.
| Designation | Status | Total hours a year | Of which ethics |
|---|---|---|---|
| CIA | Practicing | 40 | At least 2 |
| CIA | Non-practicing | 20 | At least 2 |
| CRMA, IAP, CCSA, CFSA, CGAP, QIAL | Practicing | 20 | At least 2 |
| CRMA, IAP, CCSA, CFSA, CGAP, QIAL | Non-practicing | 10 | At least 2 |
| Any IIA designation | Retired | 0 | None |
| CIA with another IIA designation | Practicing | 40, which can cover both | At least 2, once |
One wording point confuses people. In the renewal attestation, the ethics statement refers to completing the “recommended” two hours of ethics training. The policy’s requirements section is clear that certified individuals are required to complete them, and the attestation asks you to confirm that you have. Treat the two hours as mandatory. A renewal submitted without them rests on a statement that is not true, and the policy says false information in the self-declaration can lead to disciplinary action.
The requirement runs on the calendar year like everything else. Ethics hours earned in December count for the year in which you complete them, and the renewal for that year closes on 31 December. The guide to maintaining the CIA covers the renewal cycle and the status you declare. The renewal walkthrough covers the attestation step by step.
What counts as ethics training
Ethics hours have to meet two tests. The first applies to all CPE: the activity must be a qualifying program. The policy’s criteria are that it is a formal program of learning that contributes directly to your professional competence, states its objectives, states any prerequisites, is developed by people qualified in the subject and in instructional design, has current content, and provides evidence of completion with the hours earned. The second test is that the content is on the subject of ethics. The policy does not limit that to the IIA’s own standards. A professional ethics course from another body is still ethics training, although, as the next section argues, the IIA’s own framework is the more useful content for a CIA.
In practice, certificates from sponsors registered with NASBA (the body that keeps the US registry of CPE sponsors) label the field of study, and ethics usually appears as Ethics, Behavioral Ethics or Regulatory Ethics. The IIA’s own on-demand ethics courses carry these labels, as do the ACFE’s. A certificate that names ethics as the field of study is the cleanest evidence you can have. The IIA does not require NASBA registration for CPE in general, so a certificate without the label can still count. It just has to show, through the title, the agenda or the course description, that the content was ethics.
| Activity | Ethics hours? | Why |
|---|---|---|
| An on-demand course on applying the ethics and professionalism domain of the Standards | Yes | Formal program on the subject, with a certificate labelled ethics |
| A behavioral ethics webinar from a registered sponsor | Yes | Ethics content; live-webinar attendance rules apply |
| A chapter session on professional courage in audit reporting | Yes, if the certificate or agenda records the hours | Technical sessions at chapter meetings are listed programs |
| A state CPA board’s required ethics course | Yes | Ethics training, even if much of it is regulatory; useful if you are also a CPA |
| An ethics module inside a longer audit course | Yes, for the ethics minutes | Only if the certificate or agenda separates the module and its length |
| Your employer’s annual code-of-conduct e-learning | Only if it meets the program criteria and records its duration | Many corporate modules state no objectives or hours; check before relying on one |
| Anti-bribery or data-protection compliance training | As general CPE, usually; as ethics only if the content is professional ethics | Compliance rules are not the same subject as ethical judgment |
| Reading Domain II of the Standards | No | No program, no instruction, no evidence of completion |
| Auditing the ethics hotline or the code of conduct | No | Work experience, not training |
| Serving on the company’s ethics committee | No | Service, not education |
| A conference keynote on trust and integrity | Only if the agenda shows ethics instruction and the certificate itemizes it | Motivational sessions without instructional content do not qualify |
| Presenting an ethics session to your team | As presentation hours under that category | The presenter earns presentation credit; complete two hours as a participant as well |
| An ethics course completed last December | For last year, not this one | The policy says ethics training must occur annually, within the reporting period |
What the two hours should cover
Since the Global Internal Audit Standards took effect on 9 January 2025, the IIA’s ethics requirements are no longer a separate Code of Ethics. They are Domain II, Ethics and Professionalism: five principles (demonstrate integrity, maintain objectivity, demonstrate competency, exercise due professional care, maintain confidentiality) and thirteen standards beneath them. The first statement in the renewal attestation commits you to the IIA’s standards of ethics and professionalism, which in practice means Domain II. So the most useful ethics hours for a CIA are hours spent on that domain and on the situations in which it gets tested.
Two hours a year is not much time, and the same general “ethics refresher” taken every year teaches less each time. A better pattern rotates through the domain over five years, one theme a year, using a case from your own work as the discussion material. The GIAS Domain II guide covers each standard in depth. The table below shows one way to spread it.
| Year | Theme | Standards | A question to work through |
|---|---|---|---|
| 1 | Integrity and professional courage | 1.1 Honesty and Professional Courage; 1.2 Organization’s Ethical Expectations; 1.3 Legal and Ethical Behavior | When did you last soften a finding because of who owned it, and what would professional courage have looked like? |
| 2 | Objectivity | 2.1 Individual Objectivity; 2.2 Safeguarding Objectivity; 2.3 Disclosing Impairments to Objectivity | You are asked to audit a process you designed eighteen months ago. What do you disclose, to whom, and what changes? |
| 3 | Competency, due care and skepticism | 3.1 Competency; 3.2 Continuing Professional Development; 4.1 Conformance with the Global Internal Audit Standards; 4.2 Due Professional Care; 4.3 Professional Skepticism | An engagement needs data skills nobody on the team has. When is proceeding a due-care failure? |
| 4 | Confidentiality and the use of information | 5.1 Use of Information; 5.2 Protection of Information | Is pasting interview notes into a public AI tool a confidentiality breach? What controls would make it acceptable? |
| 5 | Behavioral ethics: pressure and rationalization | All five principles, applied | Which of the three sides of the fraud triangle has your own function seen in its staff, and how was it handled? |
The rotation also answers a question chief audit executives ask: what should the team’s ethics session be about this year? The same five themes work for a function-wide session, and they tie the training to the conformance evidence an external quality assessor looks for under Domain II.
Choosing a course worth two hours
A great deal of the ethics CPE on the market was written for the IIA’s old Code of Ethics, which the Standards replaced in January 2025. Those courses still count as ethics training, because the subject is still ethics, but they teach a framework that is no longer the one you attest to. The differences are not cosmetic. Due professional care has moved inside the ethics domain, professional courage and skepticism are now named requirements, and every standard now comes with examples of the evidence an assessor expects. A course built on the old Code will tell you nothing about any of that. The IPPF to GIAS mapping sets out the full crosswalk.
| Topic | The 2017 Code of Ethics | Domain II of the Standards (effective 9 January 2025) |
|---|---|---|
| Structure | Four principles (integrity, objectivity, confidentiality, competency) with twelve rules of conduct | Five principles with thirteen standards, each with requirements, considerations for implementation and examples of evidence of conformance |
| Due professional care | A separate standard (1220) outside the Code | Principle 4, inside ethics and professionalism |
| Professional courage | Not named | Standard 1.1, Honesty and Professional Courage |
| The organization’s ethical expectations | Not addressed as a requirement | Standard 1.2, Organization’s Ethical Expectations |
| Professional skepticism | Implied | Standard 4.3, Professional Skepticism |
| Competency and development | A Code principle, with development in Standard 1230 | Standards 3.1 Competency and 3.2 Continuing Professional Development |
Beyond currency, five signs separate an ethics course worth your two hours from one that merely fills them. First, it is built on internal audit situations, not generic corporate compliance. Second, it asks you to make decisions in cases, rather than recall definitions. Third, it names the standards it covers, so you know which part of Domain II you have refreshed. Fourth, it ends with an assessment and a certificate that states the hours and the field of study. Fifth, it runs at least 100 minutes of instruction, so one course meets the requirement. A course that fails the first three can still satisfy the rule, but the two hours will have taught you little.
Where to get the two hours
Ethics CPE is widely available, but not all of it is aimed at internal auditors, and prices range from nothing to about $50 an hour. The table lists sources checked in September 2026, with the prices the providers published then. The IIA’s member benefits described here apply to members in the United States, Canada and the Caribbean. National institutes elsewhere set their own benefits.
| Source | Cost (September 2026) | CPE | Format | Notes |
|---|---|---|---|---|
| IIA on-demand ethics courses (six titles) | Free to IIA members in North America; $59 to $109 for non-members | 1.4 to 2.2 each | On-demand | Ethical Applications of the Global Internal Audit Standards (2.2) is the one built on Domain II |
| IIA Ethics Essentials Bundle | $99 to $129 | 3.2 | On-demand | For non-members who want more than the minimum in one purchase |
| IIA course on the AICPA Code of Professional Conduct | $69 | 3 | On-demand | Regulatory ethics built for CPAs (the AICPA Code, IESBA standards and IRS Circular 230); the cheapest IIA ethics option per hour for non-members |
| IIA chapter ethics sessions | Often free or low cost to members | Usually 1 to 2 per session | Live, in person or virtual | Houston’s December 2025 two-hour ethics webinar was free; check your chapter’s calendar |
| AGA ethics webinars | $59 for AGA members, $99 for non-members | 2 | Live webinar | Public-sector focus; sessions listed for November 2026 and April 2027 |
| ACFE Practical Ethics for Fraud Examiners | $99, or $79.20 for ACFE members | 2 | Self-study | Labelled regulatory ethics; also serves the CFE’s ethics requirement |
| CPA society ethics courses | Varies; CalCPA includes a four-hour course with its $275 membership for non-CPA financial professionals | 4 | On-demand | Written for state licence renewal, so partly regulatory |
| An in-house ethics session at your employer | Free to you | As delivered | Live | Counts if it meets the formal-program criteria and records attendance and duration |
For most CIAs the choice is simple. If you are an IIA member in North America, take one of the free member courses early in the year and you are done. If you are not a member, look first at your chapter’s calendar, since chapters often schedule ethics sessions, and buy one on-demand course only if nothing suitable appears. If you also hold the CFE or a CPA license, choose a course that serves both, as the section on other credentials explains.
Free ethics CPE, specifically
Free ethics hours are easier to find than people expect, but the sources are narrower than for CPE in general. The large firms’ free webcasts, which cover much of a CIA’s technical CPE, rarely offer ethics sessions. The reliable free sources are these five.
- IIA membership, in North America. The IIA lists ethics training among the benefits for members in the US, Canada and the Caribbean. Six on-demand ethics courses are marked free for members there: Ethical Applications of the Global Internal Audit Standards (2.2 CPE), Ethical Behavior (1.8), Ethical Scenarios for Internal Auditors (1.4), Ethical Scenarios for Financial Services Auditors (2.2), Ethical Scenarios for Technology (2.2) and Ethical Scenarios for the Public Sector (1.4). Each of the three 2.2-hour courses meets the requirement by itself; the shorter three need topping up, and any two of them together clear it.
- Your chapter. Chapters often schedule ethics content because every member needs it, and chapter events are often free for members. Some schedule it in the last quarter, when members are closing out the year: the Houston chapter’s free two-hour ethics webinar in December 2025 is one example.
- Your employer. An in-house ethics session counts when it is built as a formal program, with objectives, a qualified presenter, a record of attendance and a stated duration. The last section of this guide shows how to design one.
- Your national institute, outside North America. The IIA benefits listed above apply in the US, Canada and the Caribbean. Elsewhere, membership runs through national institutes with their own learning portals and events, so check whether yours includes ethics content before paying for it.
- Other bodies you already belong to. If you pay dues to a CPA society, the ACFE or another body for a second credential, check what ethics content the membership already includes before buying anything.
Treat “free” offers from unknown providers with care. A course that is free to take but charges for the certificate is not free, and a course that issues no certificate leaves you nothing to show an auditor. The guide to free CIA CPE covers the wider free sources for the other 38 hours.
Ethics across your other credentials
Many CIAs hold a second credential, and the ethics rules differ in amount, cycle and, above all, in what content they accept. The IIA’s rule is the least restrictive: any genuine ethics training counts. Several accountancy boards are the most restrictive, because they require ethics courses on their own state’s rules. The practical consequence is that the course you take for the strictest body usually also satisfies the IIA, while a general ethics course taken for the IIA may not satisfy the strictest body.
| Credential | Ethics requirement | What it means for a CIA |
|---|---|---|
| CIA, CRMA, IAP (IIA) | 2 hours every year | Any genuine ethics training that meets the program criteria |
| CFE (ACFE) | 2 hours every year, within 20 hours of which 10 must be fraud-related | One ethics course can serve both; the ACFE accepts CPE from other organizations |
| CMA (IMA) | 2 hours every year, within 30 | One course can serve both if it meets each body’s criteria |
| CPA, New York | 4 hours of acceptable professional ethics every three calendar years | Take a course acceptable to the New York board; it also counts as IIA ethics |
| CPA, California | 4 hours of ethics in each two-year period, plus a two-hour Board-approved Regulatory Review course when six years have passed since the last one | State-specific; the course also counts as IIA ethics in the year taken |
| CPA, Texas | A four-hour Board-approved Texas ethics course every two years | In the year you take it, it covers the IIA’s two hours twice over |
| CFA (CFA Institute) | Voluntary program: 2 standards, ethics and regulations credits encouraged each year | Not a requirement; any ethics course you take for the CIA may also be logged there |
| CISA, CRISC, CISM (ISACA) | No ethics hours; holders must comply with ISACA’s Code of Professional Ethics | Nothing extra to plan |
| CMIIA (Chartered IIA, UK) | 2 hours of ethics every year | The Chartered IIA says CIA holders report their 40 hours to the IIA; no separate submission |
Two cautions. First, state rules change and differ in detail, so check the board’s own page in the year you plan. The figures above are from the New York, California and Texas boards’ pages as of September 2026. Second, the cycles do not line up. A Texas CPA takes four ethics hours every other year, but the CIA needs two every year, so the off-years still need an IIA ethics course. The guide to planning your CPE year builds one plan across all the credentials you hold. The CFE guide and CIA vs CPA cover those credentials in full.
Timing, evidence and the attestation
Book the ethics hours in the first quarter. It is the single most effective habit for this part of the requirement. Ethics is the one component you cannot make up with whatever webinar is running in December, and a first-quarter course takes it off the list for the year. If your function runs a team ethics session, schedule it for January or February for the same reason.
Keep the certificate with the rest of the year’s evidence. The policy asks you to retain supporting documentation for at least three years and not to submit it at renewal. For ethics, the certificate should show the title, the sponsor, the date, the hours and, ideally, the field of study. Conference certificates are the weak point. A single certificate for “8 CPE” at a regional conference does not show that two of those hours were ethics, so keep the agenda with the ethics session marked, or ask the organizer for an itemized certificate. Live webinars have their own rules. The IIA, for example, awards webinar credit for attending at least 50 minutes and responding to at least 75 percent of the alertness checks, so an ethics webinar left running in a background tab may not produce a certificate at all.
| Format | Evidence that works | Common gap |
|---|---|---|
| On-demand ethics course | Completion certificate with hours and field of study | Course started but the final assessment not passed, so no certificate |
| Live ethics webinar | Certificate issued after attendance and polling checks | Registered but did not meet the attendance rules |
| Chapter ethics session | Chapter certificate or attendance record naming the session and hours | Sign-in sheet with no hours or session title |
| Ethics session within a conference | Itemized certificate, or the general certificate plus the marked agenda | One lump-sum certificate with no session detail |
| In-house ethics training | Attendance record, agenda, objectives, presenter and duration | A calendar invitation and nothing else |
| A short ethics module (under 50 minutes) | Certificate or record showing the minutes, reported in 10- or 25-minute increments | Rounded up to a full hour |
A worked example shows how the pieces add up. A practicing CIA completes a 1.8-hour on-demand ethics course in March, which leaves 0.2 hours to find. In June she attends a chapter meeting with a 25-minute ethics segment, recorded separately on the chapter’s certificate. That segment counts as 0.5 hours under the 25-minute increment, bringing her ethics total to 2.3 hours. Both certificates go in the year’s folder, the log shows 2.3 in the ethics column, and the ethics statement at renewal takes seconds to confirm.
The attestation is the final check. Before you tick the ethics statement at renewal, open the certificate. If it is not there, you have not finished the requirement, whatever you remember attending. The CPE tracking guide includes an ethics column in its log template so the check takes seconds.
Short of ethics hours in December
If you reach December without ethics hours, the fix is usually one evening. Work through these steps in order.
- Check your records first. A conference or a longer course earlier in the year may have included an ethics session. If the agenda shows it and you attended, you may already have the hours. Get the evidence together now.
- Take an on-demand course. An on-demand ethics course of about two CPE hours can be finished in one sitting, and the certificate arrives on completion. IIA members in North America have six free options, three of which meet the requirement alone. Non-members can buy one for $59 to $109, or the IIA’s three-hour course on the AICPA Code of Professional Conduct for $69. Check the access period: at least one IIA ethics course lists a 30-day course expiration.
- Look for a live session. Chapters and other bodies schedule ethics webinars in the last quarter. The AGA, for example, listed a two-hour ethics webinar for 18 November 2026. Live sessions need attendance and polling, so block the time.
- Renew only when the certificate is in hand. The window closes on 31 December. Renew the day you finish, not at the end of the month.
- If you truly cannot finish, do not attest. If the cause is serious, such as military service or personal hardship, the policy lets the IIA grant a partial or complete exemption on request: open a CCMS support case before 31 December and attach supporting documentation. Otherwise the designation moves to grace status on 1 January. You can then complete the ethics hours in the new year and renew the prior period, counting those hours once. It costs the grace fee and some weeks without the designation, which is far better than a false attestation.
Running ethics training for your team
For a chief audit executive, one well-built session covers the whole team’s ethics requirement and does more than an individual course. It uses the team’s own cases, it reinforces the function’s expectations, and it produces conformance evidence for Domain II. To count as CPE it has to be a formal in-house program: stated objectives, content developed by someone qualified in the subject, current material, a record of who attended and for how long, and a certificate or equivalent record for each participant. A 100-minute session is two CPE hours.
| Segment | Minutes | Content | Output |
|---|---|---|---|
| Objectives and the standards | 15 | This year’s theme from the five-year rotation, and the standards behind it | Stated learning objectives, recorded on the agenda |
| Case one | 30 | An anonymized situation from the function’s own work, discussed in small groups | Each group’s answer to “what should the auditor have done?” |
| Case two | 30 | A situation from another sector or a published case | Comparison with case one |
| What we will do differently | 20 | Changes to methodology, disclosure practice or escalation | Actions recorded for the quality program |
| Knowledge check and close | 5 | Five questions on the standards covered | Completion record for each participant |
| Total | 100 | Two CPE hours | Attendance list, agenda, objectives and certificates filed |
The presenter earns presentation hours under the policy’s presentation category (one hour per 50 minutes of presentation plus preparation credit of three times the presentation time, capped). The policy does not say whether presenting satisfies the presenter’s own ethics requirement, so the cautious course is for the presenter to complete two ethics hours as a participant somewhere else. File the session materials with the function’s quality evidence. The QAIP playbook shows where they fit. The GIAS Domain IV guide covers the chief audit executive’s responsibility for the function’s development.
Questions CIAs ask about ethics CPE
How many ethics hours does a CIA need?
Two a year, counted inside the total: two of the 40 for a practicing CIA and two of the 20 for a non-practicing CIA. Retired CIAs are exempt from renewal requirements.
Do the ethics hours have to come from the IIA?
No. The policy asks for training on the subject of ethics that meets its program criteria, from any provider. The IIA’s courses are the most directly relevant, because they are built on the Standards, but a CPA society, ACFE, IMA or AGA ethics course counts too.
Can I carry extra ethics hours into next year?
The policy’s make-up rules speak of CPE hours in general. Surplus hours from the prior period can cover a current deficiency, and next-year hours can cover a shortfall in the year just ended. The rules do not single out ethics. The attestation, though, is made each year, so the safe practice is to complete two ethics hours inside every year and not rely on carryover.
Does my employer’s code-of-conduct training count?
Only if it meets the program criteria and you can evidence the duration. Many annual compliance modules state no objectives and record no hours. Some are closer to legal compliance than to professional ethics. If yours issues a completion record with a duration and the content is about ethical conduct, it can count. Otherwise use it as good practice and take a qualifying course as well.
Do I send the ethics certificate to the IIA?
No. Supporting documentation is not submitted at renewal. Keep it for at least three years. If your renewal is selected for audit, the notice arrives by email straight after you renew, and you have six months to provide the evidence.
Is behavioral ethics really ethics, or is it psychology?
For CPE purposes it is ethics. It is the study of why well-meaning people make unethical decisions under pressure, and it is the field of study the IIA itself assigns to several of its ethics courses. For internal auditors it is arguably the most useful kind, because most failures of objectivity and courage are behavioral, not a matter of not knowing the rules.
I hold the IAP. Do I need ethics hours?
Yes, from 2026. The IIA now requires IAP holders to renew annually with 20 CPE hours if practicing, or 10 if non-practicing, and the same two ethics hours apply. If you are working toward the CIA, the ethics hours you earn now build the habit you will need as a CIA.
Can the ethics hours be self-study?
Yes. The policy lists formal correspondence and self-study programs relevant to internal auditing, provided they meet its criteria and give evidence of completion. An on-demand ethics course with a final assessment and a certificate is the most common way CIAs meet the requirement.
Related guides
- CIA CPE requirements — every category, cap and rule behind the 40 hours.
- GIAS Domain II: ethics and professionalism — the content the two hours are meant to refresh.
- How to maintain your CIA — renewal, status, fees and the way back.
- Free CIA CPE — free sources for the rest of the hours.
- How to renew in CCMS — the attestation and the audit, step by step.
- CPE claims that fail an audit — including ethics hours without evidence.
- Tracking CIA CPE — a log with an ethics column.
- The CFE for internal auditors — a credential with its own ethics requirement.
- CIA vs CMA — another credential with two ethics hours a year.
- Old IPPF to new GIAS — how the Code of Ethics became Domain II.
- The CIA exam, explained — the hub for every CIA guide.
Leave a Reply