The CIA exam changed more in 2025 than in any year since the three-part structure was introduced. The number of questions and the time limits stayed exactly where they were, which is why the change is easy to underestimate, but almost everything inside the parts moved. Part 1 became a test of the profession’s foundations and its ethics, built on the Global Internal Audit Standards. Part 2 became a test of running a single engagement from planning to conclusions. Part 3 stopped being a business-knowledge paper about accounting, information technology and security and became a test of running an internal audit function, with nearly half of it about communicating results and following them up.
This guide goes through the 2025 syllabus the way a candidate needs it: every part, every domain and weight, and all 62 topics, each one translated into what the exam is really asking and where to study it. It explains how to read the IIA’s syllabus documents now that they no longer label topics as basic or proficient, what moved from the 2019 syllabus and what disappeared, how the syllabus lines up with the Standards, what happens if you passed parts under the old syllabus, and how to turn the weights into a study plan. The facts come from the IIA’s own syllabus documents and certification pages as they stood in September 2026. For the exam as a whole, including eligibility, fees, scoring and exam day, start with the complete CIA exam guide; to practice against this syllabus, the free CIA question bank is written to exactly these domains and weights.
In this guide
- The 2025 syllabus at a glance
- How to read the syllabus, now that the levels are gone
- Part 1: Internal Audit Fundamentals, topic by topic
- Part 2: Internal Audit Engagement, topic by topic
- Part 3: Internal Audit Function, topic by topic
- What changed from the 2019 syllabus
- How the syllabus lines up with the Standards
- If you started under the old syllabus
- Turning the weights into a study plan
- Questions candidates ask about the syllabus
- Related guides
The 2025 syllabus at a glance
The exam is still three separate multiple-choice exams taken at Pearson VUE test centers, in any order, each scored on its own scale from 250 to 750 with 600 needed to pass. Part 1 has 125 questions in 150 minutes; Parts 2 and 3 have 100 questions in 120 minutes each, which works out at 72 seconds a question across the board. What the 2025 syllabus changed is the content map: the part names, the domains, the weights and the 62 topics beneath them.
| Part | Questions and time | Domains and weights | Topics | What it is really testing |
|---|---|---|---|---|
| Part 1: Internal Audit Fundamentals | 125 questions, 150 minutes | A. Foundations of Internal Auditing 35% · B. Ethics and Professionalism 20% · C. Governance, Risk Management, and Control 30% · D. Fraud Risks 15% | 27 | Whether you know what the profession is for, what the Standards require of the function and of each auditor, and the risk, control and fraud concepts every engagement rests on |
| Part 2: Internal Audit Engagement | 100 questions, 120 minutes | A. Engagement Planning 50% · B. Information Gathering, Analysis, and Evaluation 40% · C. Engagement Supervision and Communication 10% | 17 | Whether you can plan and perform one engagement the way Domain V of the Standards describes, from objectives and scope to evidence, findings and conclusions |
| Part 3: Internal Audit Function | 100 questions, 120 minutes | A. Internal Audit Operations 25% · B. Internal Audit Plan 15% · C. Quality of the Internal Audit Function 15% · D. Engagement Results and Monitoring 45% | 18 | Whether you can think like a chief audit executive: strategy, resources, the risk-based plan, quality, and above all how results are communicated, accepted, followed up and escalated |
Three numbers in that table deserve a second look. Foundations at 35 percent is the largest domain in Part 1, and it is almost entirely about the Standards’ purpose, the mandate and the charter, which rewards candidates who have read the Standards themselves rather than a summary. Engagement Planning at 50 percent means half of Part 2 is decided before a single test is performed. And Engagement Results and Monitoring at 45 percent is the largest domain in Part 3, and second only to Part 2’s Engagement Planning on the whole exam, which is why the Part 3 guide tells candidates to start there.
How to read the syllabus, now that the levels are gone
The IIA publishes the syllabus as three documents called expanded test specifications, one per part. Each lists the domains with their weights, numbers the topics within each domain, and under each topic gives a list of sub-items introduced with the phrase “may include but is not limited to”. That phrase matters: the sub-items are examples of what a question can cover, not a closed list, and candidates who treat them as a checklist are surprised by questions on neighboring material.
The bigger change is what the documents no longer say. The 2019 syllabus labeled every topic with a cognitive level, basic or proficient, which told candidates whether to expect recall or application. The 2025 syllabus drops the labels entirely; the Chartered Institute of Internal Auditors, the IIA’s institute for the United Kingdom and Ireland, confirmed that the new syllabus no longer identifies the level at which a topic is assessed. What is left is the verb at the start of each topic, and it is a reliable guide. “Describe”, “recognize” and “identify” topics are tested mostly by questions that check whether you know the concept and can spot it in a short scenario. “Interpret” topics ask you to read a situation and name what is going on. “Determine”, “apply”, “assess”, “analyze”, “evaluate” and “demonstrate” topics put you in a scenario and ask what you would do, which is where the long stems and the two plausible options live.
| Topic verb | What the question usually asks | How to prepare |
|---|---|---|
| Describe, recognize, identify | Which statement is true of the concept; which situation is an example of it; which item belongs on a list the Standards define | Know the definitions and the lists exactly as the Standards and frameworks state them; practice spotting them in two-sentence scenarios |
| Interpret | What a situation means: which type of risk this is, whether this control is preventive or detective, whether this is assurance or advice | Classify real examples from your own work until the categories are automatic |
| Determine, apply | What the auditor should do next, or which option best meets a requirement in a specific engagement | Learn the sequence the Standards prescribe and the reason for each step, then practice scenario questions with the rationales |
| Assess, analyze, evaluate | Whether evidence is sufficient, whether a finding is significant, whether objectivity is impaired, whether a control is well designed | Practice judging, not recalling: work cases where two answers are defensible and learn why one is better |
| Demonstrate | The behavior the Standards expect in an ethical or professional situation, such as integrity or due professional care | Learn the compliant answer rather than the pragmatic one; the exam rewards what the Standards require, not what a busy function does |
The Chartered IIA went a step further and counted the topics whose opening verbs suggest recall rather than application. By its count, about three-quarters of Part 1’s topics (20 of 27) now read as recall-level, up from under half in 2019; Part 2 is roughly unchanged at about 40 percent; and every one of Part 3’s 18 topics opens with a recall-type verb. Treat that as a reading of the verbs, not an IIA statement, and do not mistake it for “Part 3 is easy”. A “describe the escalation process” topic still arrives as a scenario in which a department head has ignored an action plan for nine months and you must pick the step the chief audit executive takes next. The verb tells you the depth of knowledge; the question format still demands judgment.
Part 1: Internal Audit Fundamentals, topic by topic
Part 1 has 27 topics in four domains. It is the broadest part and the one with the lowest published pass rate, 44 percent at the IIA’s most recent figure, largely because it demands the Standards’ own vocabulary and structure. The IAP designation now uses exactly this exam, which is why an active Internal Audit Practitioner carries Part 1 forward into the CIA program. The table gives each topic in plain words, what the exam is really checking, and where on this site the concept is explained in practice.
| Topic | What the exam is really checking | Study it with |
|---|---|---|
| A1. The purpose of internal auditing under the Standards | That you know the purpose statement in Domain I and can reject an option that describes internal audit as a control function, a consultant to management only, or an arm of external audit | The Standards reference map |
| A2. The mandate: what the board and the chief audit executive are responsible for | Who authorizes internal audit, who approves what, and which responsibilities the Standards assign to the board rather than to management | Domain III: governing the function |
| A3. What the internal audit charter must contain | The required contents of the charter and who approves it; the difference between the mandate and the document that records it | Writing an internal audit charter |
| A4. Assurance versus advisory, limited versus reasonable assurance | Whether a described service is assurance or advice, and what level of assurance a given engagement can support | Internal audit’s key terms |
| A5. Types of assurance services | Financial, operational, compliance, information technology and other assurance engagements, and what distinguishes them | An overview of audit types |
| A6. Types of advisory services | Advice, facilitation, training and pre-implementation reviews, and the safeguards that keep them from impairing later assurance work | Domain III and Domain II |
| A7. Situations that impair the function’s independence | Reporting lines, scope limitations, resource restrictions and non-audit roles held by the chief audit executive, and what must happen when one arises | Internal audit’s authority |
| A8. Internal audit’s role in risk management and the Three Lines Model | Where internal audit sits among the lines, what it may and may not do in risk management, and the safeguards when it takes on second-line work | Internal audit’s role in ERM |
| B1. Integrity | Honesty and professional courage, the organization’s ethical expectations, and legal and ethical behavior, applied to a scenario | Domain II: ethics and professionalism |
| B2. Impairments to an individual auditor’s objectivity | Whether a described relationship, prior role or incentive impairs objectivity | Domain II |
| B3. Policies that protect objectivity, and mitigations | Rotation, cooling-off periods, supervision and disclosure; which safeguard fits which impairment | Domain II |
| B4. Knowledge, skills and competencies, developed or procured | What the function does when it lacks a skill: train, hire, co-source, or decline the work | Co-sourcing, explained |
| B5. Due professional care and professional skepticism | What care the Standards expect, and how skepticism shows up in evidence and interviews | Audit evidence |
| B6. Confidentiality and the use of information | What an auditor may and may not do with information obtained in an engagement | Domain II |
| C1. Organizational governance | Roles of the board, management and assurance providers; what good governance looks like | Internal audit and corporate governance |
| C2. Culture and its effect on the control environment | How tone, incentives and behavior change engagement risk and control reliability | How to audit culture |
| C3. Ethical and compliance-related issues | Recognizing ethics and compliance problems in a scenario and the auditor’s response | Compliance risk |
| C4. Risk types: inherent and residual | The difference between risk before and after controls, and how each is used in planning | Audit risk explained |
| C5. The risk management process: appetite, tolerance, responses | Appetite versus tolerance, and choosing between accepting, avoiding, reducing and sharing a risk | Risk appetite statements |
| C6. Risk management inside processes and functions | How risk management works in operations, not only at enterprise level | Risk and control self-assessment |
| C7. Control concepts and control types | COSO’s components and principles; preventive, detective and corrective controls; manual and automated | COSO’s 17 principles and the controls taxonomy |
| C8. Control design, effectiveness and efficiency | Whether a control is designed to address the risk, operates as designed, and is worth its cost | Design versus operating effectiveness |
| D1. Fraud risk concepts and types of fraud | The fraud triangle and the main scheme families: asset misappropriation, corruption and financial statement fraud | The ACFE fraud tree |
| D2. When fraud risk needs special consideration in an engagement | Which circumstances require the auditor to plan specifically for fraud | Fraud risk assessment |
| D3. The potential for fraud and how the organization manages it | Red flags, and whether the organization’s detection and management of fraud risk are adequate | Fraud red flags |
| D4. Controls that prevent and detect fraud | Which control addresses which scheme | Fraud risk management |
| D5. Investigation techniques and internal audit’s role | What internal audit does, and does not do, when fraud is suspected; evidence, counsel and escalation | The first 48 hours |
Ethics and Professionalism is the domain that most rewards reading the Standards directly. Its six topics map one to one onto the five principles of Domain II, which set out thirteen standards: honesty and professional courage, the organization’s ethical expectations, and legal and ethical behavior under integrity; individual objectivity, safeguarding objectivity and disclosing impairments under objectivity; competency and continuing professional development; conformance with the Standards, due professional care and professional skepticism; and the use and protection of information. Candidates who write a one-line rule for each of those thirteen standards, in their own words, rarely lose marks in the domain. The Part 1 guide has a study plan built around exactly that exercise.
Part 2: Internal Audit Engagement, topic by topic
Part 2 has 17 topics, and its weight sits overwhelmingly on planning and on evidence. It follows the order in which a real engagement unfolds, which makes it the part that working auditors find most familiar, and the part where their own function’s habits can mislead them if those habits differ from the sequence in the Standards.
| Topic | What the exam is really checking | Study it with |
|---|---|---|
| A1. Engagement objectives and scope | Setting objectives from the risk assessment and drawing scope boundaries, including what is explicitly excluded | The planning memo template |
| A2. Evaluation criteria | Choosing criteria that let a condition be judged: policies, laws, frameworks, benchmarks, management’s own targets | Domain V: performing engagements |
| A3. Planning for key risks and controls: cybersecurity, IT general controls, privacy, continuity | Which technology and resilience risks belong in the engagement plan, and when a Topical Requirement applies | IT general controls for non-IT auditors and Topical Requirements |
| A4. Choosing the approach: traditional, agile, integrated, remote | Which approach suits the engagement and what each changes about planning and supervision | Remote and hybrid auditing |
| A5. A detailed risk assessment of the activity under review | Identifying and prioritizing the risks of the specific process before designing tests | The risk and control matrix |
| A6. Engagement procedures and the work program | Designing procedures that address the risks, and what a work program must contain and who approves it | The audit work program |
| A7. Resources and skills for the engagement | Matching people, time and skills to the engagement, and what to do when they fall short | The role of an audit lead |
| B1. Sources of information | Interviews, observation, documents, system data and walkthroughs, and when each is appropriate | The walkthrough guide |
| B2. Relevance, sufficiency and reliability of evidence | Ranking evidence by reliability and judging when there is enough | Audit evidence and testing IPE |
| B3. Technology options: AI, machine learning, RPA, continuous monitoring | What each technology can support in an engagement and what it cannot | Continuous auditing versus monitoring |
| B4. Analytical approaches and process mapping | Choosing data analytics methods and mapping a process to find where controls should be | The AP analytics catalog |
| B5. Analytical review techniques | Ratio, trend and reasonableness analysis, and what an unexpected result requires | Journal entry analytics |
| B6. Criteria versus condition, and the significance of findings | Recognizing a finding and rating its significance | The five C’s of a finding and severity ratings |
| B7. Workpapers that support conclusions | What a workpaper must show for a reviewer to reach the same conclusion | A model workpaper |
| B8. Summarizing and developing engagement conclusions | Moving from individual findings to an overall conclusion on the engagement objectives | Anatomy of a report |
| C1. Supervision throughout the engagement | What supervisors review, when, and how the review is evidenced | Workpaper review practices |
| C2. Communication with stakeholders throughout the engagement | Communicating objectives, scope and emerging findings during the work, not only at the end | The auditee communication pack |
Two things in Part 2 catch experienced auditors. The first is that technology and resilience now sit inside planning: cybersecurity, IT general controls, data privacy and business continuity appear under engagement planning rather than in a separate IT domain, which means a Part 2 question about a purchasing audit can turn on whether the auditor considered the system’s access controls. The second is sequence. The Standards expect the engagement risk assessment before the objectives, the criteria before the work program, and communication with stakeholders throughout, and a question that describes a function doing these in a different order is usually testing whether you notice.
Part 3: Internal Audit Function, topic by topic
Part 3 has 18 topics and is the part that changed most. It no longer tests business acumen, information technology, security or financial management as subjects; it tests how a chief audit executive runs the function and, in nearly half of the paper, how engagement results are communicated and followed up.
| Topic | What the exam is really checking | Study it with |
|---|---|---|
| A1. Methodologies for planning, organizing, directing and monitoring the function | What a methodology must cover and how the chief audit executive keeps it current | Domain IV: managing the function |
| A2. Managing financial, human and technology resources | Budgeting, staffing, skills and tools for the function | Inside the internal audit department |
| A3. Aligning the internal audit strategy with stakeholder expectations | What a strategy contains and how it responds to the board’s and management’s expectations | Domain IV |
| A4. The chief audit executive’s relationships with senior management and the board | What must be communicated to whom, how often, and the private sessions with the board | The audit committee deck |
| B1. Sources of potential engagements: the audit universe | Building and maintaining the universe the plan draws from | Building an audit universe |
| B2. Building a risk-based internal audit plan | Risk assessment, prioritization, approval and change of the plan | The annual risk assessment and plan template |
| B3. Coordinating with and relying on other assurance providers | When and how internal audit relies on the work of others, and what it must evaluate first | Reviewing a SOC 1 report |
| C1. Required elements of the quality assurance and improvement program | Ongoing monitoring, periodic self-assessment and external assessment | The QAIP playbook |
| C2. Disclosing nonconformance with the Standards | When nonconformance must be disclosed, to whom, and what may be said about conformance | Preparing for an external assessment |
| C3. Performance measures and scorecards for the function | Which measures show value and quality, and how they are reported | The QAIP documentation kit |
| D1. Attributes of effective engagement communication | Accurate, objective, clear, concise, constructive, complete and timely, and how to recognize each | Reports people actually read |
| D2. Communicating engagement results | What the final communication must contain and who receives it | Model report examples |
| D3. Recommendations, action plans or agreed actions | When to recommend, when to ask management for an action plan, and when to agree actions together | Writing recommendations and evaluating management responses |
| D4. The closing communication and reporting process | Closing meetings, drafts, responses and the final report | The life of a finding |
| D5. The chief audit executive’s assessment of residual risk for the engagement | What the chief audit executive weighs when forming the overall view of risk remaining after an engagement | Finding severity ratings |
| D6. Communicating risk acceptance | What happens when management accepts a risk the chief audit executive believes exceeds the organization’s appetite | Risk acceptance by management |
| D7. Monitoring and confirming implementation of action plans | Follow-up and validation: what counts as evidence that an action plan worked | Issue validation |
| D8. Escalation when action plans are not implemented | The escalation path when management has not acted, and when it reaches the board | Negotiating findings and escalation ladders |
The eight topics of Engagement Results and Monitoring are the heart of the part, and they reward candidates who have sat through a closing meeting, drafted a management response or chased an overdue action plan. The questions are rarely about wording; they are about who decides, what must be communicated to whom, and what happens next. A chief audit executive who disagrees with management’s acceptance of a risk does not negotiate indefinitely and does not escalate straight to the regulator; the Standards set out a sequence, and the exam tests whether you know it.
What changed from the 2019 syllabus
The 2019 syllabus was written to the International Professional Practices Framework. The 2025 syllabus is written to the Global Internal Audit Standards, which took effect in January 2025, and it reorganizes all three parts around what an internal auditor does at three levels: the profession, the engagement and the function.
| Part | 2019 syllabus: name and domains | 2025 syllabus: name and domains | What moved |
|---|---|---|---|
| Part 1 | Essentials of Internal Auditing: Foundations 15%, Independence and Objectivity 15%, Proficiency and Due Professional Care 18%, Quality Assurance and Improvement Program 7%, Governance, Risk Management, and Control 35%, Fraud Risks 10% | Internal Audit Fundamentals: Foundations 35%, Ethics and Professionalism 20%, Governance, Risk Management, and Control 30%, Fraud Risks 15% | Foundations more than doubled and now carries the mandate and charter; independence, objectivity, proficiency and due care were folded into Ethics and Professionalism; the quality program moved to Part 3 |
| Part 2 | Practice of Internal Auditing: Managing the Internal Audit Activity 20%, Planning the Engagement 20%, Performing the Engagement 40%, Communicating Engagement Results and Monitoring Progress 20% | Internal Audit Engagement: Engagement Planning 50%, Information Gathering, Analysis, and Evaluation 40%, Engagement Supervision and Communication 10% | Managing the function and communicating results moved to Part 3; planning grew from a fifth to half of the part, and cybersecurity, continuity and culture now sit inside planning |
| Part 3 | Business Knowledge for Internal Auditing: Business Acumen 35%, Information Security 25%, Information Technology 20%, Financial Management 20% | Internal Audit Function: Internal Audit Operations 25%, Internal Audit Plan 15%, Quality of the Internal Audit Function 15%, Engagement Results and Monitoring 45% | Completely replaced; managerial accounting, costing, network administration, IT infrastructure and systems development were dropped as subjects |
The practical consequence for candidates is that the exam now tests internal auditing rather than the business subjects around it. The old Part 3 was the one candidates feared, because it asked accountants about networks and IT auditors about cost accounting; the new Part 3 asks everyone about the chief audit executive’s job. Knowledge of IT general controls, cybersecurity and business continuity did not disappear: it moved into Part 2, framed as risks an engagement must plan for rather than as technical subjects to master. And the Standards themselves carry more weight everywhere, because the new syllabus was written to them and uses their vocabulary.
How the syllabus lines up with the Standards
The IIA does not publish a topic-by-topic mapping from the syllabus to the Standards, and the syllabus names the Standards only in a handful of topics. But the structure lines up closely enough to organize a study plan around it, and the correspondence below is how we suggest reading them together. It is our reading, not the IIA’s.
| Syllabus | Where it lives in the Standards | What to read |
|---|---|---|
| Part 1, Foundations | Domain I (purpose); Domain III, principles 6 to 8: authorized by the board, positioned independently, overseen by the board | Domain III and the reference map |
| Part 1, Ethics and Professionalism | Domain II, principles 1 to 5: integrity, objectivity, competency, due professional care, confidentiality | Domain II |
| Part 1, Governance, Risk Management, and Control; Fraud Risks | Standard 9.1 and the glossary’s definitions; COSO’s frameworks by reference; the fraud considerations in engagement planning | COSO’s 17 principles |
| Part 2 | Domain V, principles 13 and 14: plan engagements effectively, conduct engagement work | Domain V |
| Part 3, Operations, Plan and Quality | Domain IV, principles 9 to 12: plan strategically, manage resources, communicate effectively, enhance quality; plus Standards 8.3 and 8.4 on quality oversight | Domain IV |
| Part 3, Engagement Results and Monitoring | Principle 15: communicate engagement results and monitor action plans; Standards 11.3 to 11.5 on communicating results, errors and the acceptance of risk | Domain V and risk acceptance |
The Topical Requirements, the IIA’s mandatory requirements for auditing specific subjects such as cybersecurity and third-party risk, appear by name in a few Part 2 and Part 3 topics: when planning an engagement, when building the plan, and in the quality program. You do not need to memorize their contents for the exam, but you need to know what they are, when they apply and how conformance with them is assessed; the Topical Requirements guide covers exactly that. Candidates who learned the old framework should also keep the IPPF to GIAS mapping open for the first few weeks, because the numbering and the vocabulary changed together.
If you started under the old syllabus
In English, the 2025 syllabus has applied to every exam since 28 May 2025; exams before that date were on the 2019 syllabus. Other languages moved on their own dates through 2025 and early 2026, and a few moved later still. The same date, 28 May 2025, also ended online proctoring permanently: every CIA exam is now taken at a Pearson VUE test center.
| Exam language | First exams on the 2025 syllabus |
|---|---|
| English | 28 May 2025 |
| Japanese | 28 July 2025 |
| Thai, Korean | 28 August 2025 |
| Portuguese | 28 September 2025 |
| Spanish, French | 28 October 2025 |
| Polish, German | 28 November 2025 |
| Turkish, Russian | 28 December 2025 |
| Traditional Chinese | 28 January 2026 |
| Arabic, Simplified Chinese | Later in 2026; the IIA’s pages give different dates, so check the IIA’s CIA page for your language before you book |
Parts you passed under the 2019 syllabus are kept. IIA institutes and the major review providers all state that a passed part is retained after the transition and counts toward certification; the IIA has not published a formal old-part-to-new-part mapping, but it has not needed one, because each passed part simply counts as that part. What you cannot carry across is your preparation. A candidate who passed the old Part 1 and is now studying for the new Part 2 will find that managing the internal audit activity and communicating results are no longer in Part 2 at all, and a candidate with the old Part 3 still to take is facing an entirely different exam. Your three-year program window, which runs from the date your application was approved, did not reset with the syllabus.
Older study material is worth keeping for concepts that did not change: sampling, evidence, control types, fraud schemes, risk concepts and report writing. It is dangerous for anything touching the Standards, because the numbering, the structure and several requirements changed, and it is useless for the old Part 3. If you bought a review course before March 2025, check whether your provider gave you access to its 2025 edition; the review materials section of the CIA guide lists what to confirm before you rely on any product.
Turning the weights into a study plan
The weights are the IIA telling you where the marks are, and the simplest good plan spends study time in proportion to them, adjusted for your own strengths. The table shows what that looks like for a candidate with two to five years in internal audit, using the planning ranges in the study-hours matrix: about 115 hours for Part 1, 90 for Part 2 and 100 for Part 3. The hours include practice questions, which should take at least half of the time in every domain.
| Part and domain | Weight | Hours at the planning figure | Where the hours go first |
|---|---|---|---|
| Part 1: Foundations | 35% | About 40 | Reading Domains I and III of the Standards themselves, then the charter and independence scenarios |
| Part 1: Ethics and Professionalism | 20% | About 23 | A one-line rule for each of the thirteen Domain II standards; every ethics scenario you can find |
| Part 1: Governance, Risk Management, and Control | 30% | About 35 | COSO’s components and principles, risk appetite and responses, control types |
| Part 1: Fraud Risks | 15% | About 17 | The fraud tree and red flags; internal audit’s role when fraud is suspected |
| Part 2: Engagement Planning | 50% | About 45 | The sequence in Standards 13.1 to 13.6, then planning for IT, privacy and continuity risks |
| Part 2: Information Gathering, Analysis, and Evaluation | 40% | About 36 | Evidence quality, sampling, analytics, and the elements of a finding |
| Part 2: Engagement Supervision and Communication | 10% | About 9 | Supervisory review and communication during fieldwork |
| Part 3: Internal Audit Operations | 25% | About 25 | Strategy, methodologies, resources, and the board relationship |
| Part 3: Internal Audit Plan | 15% | About 15 | The audit universe, risk-based planning and reliance on others |
| Part 3: Quality of the Internal Audit Function | 15% | About 15 | The quality program’s elements, nonconformance disclosure and performance measures |
| Part 3: Engagement Results and Monitoring | 45% | About 45 | Recommendations and action plans, risk acceptance, follow-up and escalation |
Two adjustments turn that table into your plan. Shift time from domains you work in every day to domains you do not: an engagement lead can take hours from Part 2 planning and give them to Part 3 quality, while a compliance specialist moving into audit will need more time on evidence and findings. And put practice at the center, not the end. Retrieval practice, answering questions and then studying the rationales, is the single most effective way to learn material for an exam like this, and the syllabus’s verbs are a guide to which topics need scenario practice rather than reading. The CIA Study Planner does this arithmetic for you: it takes your background, the hours you have each week and your confidence in each domain, weights the domains accordingly, and lays out a day-by-day plan with the right practice sets linked. The twelve-week plans in the CIA guide show the same structure week by week.
Questions candidates ask about the syllabus
When did the 2025 syllabus start?
For exams in English, on 28 May 2025. Other languages followed on a published schedule from July 2025 to January 2026, with Arabic and Simplified Chinese moving later in 2026. If you test in a language other than English, check the IIA’s CIA page for that language’s date before you rely on any study material.
Do the parts I passed under the old syllabus still count?
Yes. A part passed under the 2019 syllabus is retained and counts toward certification within your program window. What changes is what you still have to study for the parts you have not passed.
Are there still basic and proficient topics?
No. The 2025 syllabus does not label topics with a cognitive level. Use the verb at the start of each topic as your guide to depth, and practice scenario questions for every domain regardless.
Is there still IT, security or financial management on Part 3?
Not as subjects. Part 3 is now about the internal audit function. Cybersecurity, IT general controls, data privacy and business continuity appear in Part 2 as risks to plan for in an engagement, and technology tools such as analytics, AI and robotic process automation appear in Part 2’s information-gathering domain.
Did the number of questions or the time change?
No. Part 1 remains 125 questions in 150 minutes and Parts 2 and 3 remain 100 questions in 120 minutes. Some questions on every form are unscored pretest items that you cannot identify, so treat every question as live.
Where is the official syllabus?
On the IIA’s CIA exam syllabus page, which links a document for each part. Read them once in full; they are short, and the sub-items under each topic are the closest thing the IIA publishes to a list of what can be asked.
How should I practice against the new syllabus?
With questions written to it. The free question bank on this site has 156 original questions weighted to the 2025 domains, each with a rationale for every option and a link to the guide that explains the concept, and it can drill a single domain or run a timed set. A current review course adds the volume you need beyond that. Older banks written to the 2019 syllabus will test some concepts that are no longer examined and miss some that now are.
Related guides
- The CIA exam, explained — eligibility, the three parts, every fee, scoring, study plans and every CIA article on this site.
- Free CIA practice questions — 156 questions written to the 2025 syllabus, with study and timed exam modes.
- The CIA Study Planner — a day-by-day plan weighted to these domains and your own strengths.
- CIA Part 1 study guide — Internal Audit Fundamentals in depth.
- CIA Part 2 study guide — Internal Audit Engagement in depth.
- CIA Part 3 study guide — Internal Audit Function under the 2025 syllabus.
- How hard is the CIA exam? — pass rates and why each part fails people.
- The Global Internal Audit Standards, mapped — the framework the syllabus is written to.
- IPPF to GIAS mapping — for candidates who learned the old framework.
- CIA exam requirements — eligibility and the documents you need.
- How to study for the CIA exam — the practice-first method, the research behind it and a weekly routine.
- CIA exam passing score — how the 250-to-750 scale and the 600 cut score work.
Leave a Reply