The most reliable way to study for the CIA exam is to spend most of your time answering timed practice questions rather than reading, and to let what you get wrong decide what you read. Study one part at a time, for eight to twelve weeks per part at eight to ten hours a week. Read the Global Internal Audit Standards behind every domain your mistakes point to, review the exam’s vocabulary with short daily flashcard sessions, keep an error log, and sit only after two full-length mock exams on questions you have not seen before come in at 72 percent or better, ideally 75 or more. That is not a personal preference; it is what decades of learning research says works for exams that test retention and judgment under time pressure, and the CIA tests both, at 72 seconds a question.
This guide sets out that method step by step, the research behind it, how to adapt it to each part of the 2025 syllabus, a realistic weekly routine for someone working full time, how to use practice questions and mock exams properly, which materials to use and which to skip, and how to spend the final two weeks. Companion guides go further on single pieces: the CIA exam study schedule builds the calendar, how long to study for the CIA exam sizes the hours by background, and how hard the CIA exam is covers the pass rates and the reasons candidates fail. For the exam as a whole, start with the complete CIA exam guide.
In this guide
- [The method in ten steps](#ten-steps)
- [What the research says about studying for an exam like this](#evidence)
- [Choose your part order and your dates](#part-order)
- [How many hours, and how to spread them](#hours)
- [A week of study, hour by hour](#weekly-routine)
- [How to study each part](#by-part)
- [Practice questions: how many, which ones, and how to review them](#practice-questions)
- [Mock exams and the go or no-go gates](#mock-exams)
- [Materials: what to use and what to skip](#materials)
- [Studying while working full time](#working-full-time)
- [The final two weeks and exam day](#final-weeks)
- [Frequently asked questions](#faq)
- [Related guides](#related)
The method in ten steps
Every step below exists for a reason that is either in the exam’s design or in the learning research described in the next section. The order matters as much as the steps: the reading comes early and fast, the questions come early and never stop, and the decision to sit comes last, from evidence rather than from a date picked in week one.
| Step | What to do | Why it works |
|---|---|---|
| 1. Pick the part and the order | Start with Part 1 unless an active IAP still gives you the Part 1 waiver | Part 1 teaches the Standards’ vocabulary that Parts 2 and 3 assume |
| 2. Use current materials only | Check that every book, course and question bank says “2025 syllabus” | Part 3 was rebuilt in 2025; older materials teach content that is no longer tested |
| 3. Download the Standards | Get the Global Internal Audit Standards from The IIA | They are the exam’s rulebook, and the source of the wording that decides close questions |
| 4. Read each domain once, quickly | One pass through the part’s domains in the first two to three weeks | Orientation, not mastery; you need a map before questions make sense |
| 5. Start timed questions early | From week 2 or 3, answer questions every study day, timed | Retrieving an answer builds memory more than rereading it |
| 6. Keep an error log | Trace every miss to a Standard or concept, in one line | Your mistakes become your reading list, so reading time goes where marks are lost |
| 7. Review with spaced flashcards | 10 to 15 minutes most days, on a spacing schedule | Spaced review holds definitions and Standards in memory over weeks |
| 8. Mix the domains | Once every domain has been introduced, practice in mixed sets | The exam mixes topics; mixed practice trains you to tell similar concepts apart |
| 9. Gate with two mock exams | Two full-length timed mocks on fresh questions, at or above about 72 percent, ideally 75 | You sit on evidence; a booked date is moved, not obeyed |
| 10. Taper and pace | Light final week; a written pacing plan for exam day | Knowledge only scores if it survives the clock |
If you take nothing else from this guide, take steps 5 and 6. The natural pull is toward the opposite: weeks of reading and video, a burst of questions in the final fortnight, and no record of why the misses happened, because rereading feels like progress. The next section explains why that feeling misleads. What the method aims for instead is well over a thousand timed questions across the three parts, and an error log that can name the Standard behind most of your mistakes.
What the research says about studying for an exam like this
Learning science is unusually clear on how to prepare for an exam that tests what you can recall and apply weeks after you learned it. The most cited review, Dunlosky and colleagues’ 2013 assessment of ten common study techniques in *Psychological Science in the Public Interest*, rated only two techniques as high utility: practice testing and distributed practice, meaning spreading study over time. It rated self-explanation, elaborative interrogation and interleaved practice as moderate, and rated five of the most popular habits low: rereading, highlighting, summarizing, keyword mnemonics and imagery for text. Most candidates spend most of their hours on the low-utility list, because those techniques feel productive.
The feeling is the trap. In a well-known experiment, Roediger and Karpicke (2006) had students either reread a passage or take recall tests on it. Rereading looked better on a test a few minutes later; testing won clearly when retention was measured days later. A large review of the spacing research by Cepeda and colleagues (2006) found the same pattern for timing: study spread across sessions beats the same hours massed together, and the longer you need to remember something, the longer the gaps should be. A CIA candidate needs to remember the Standards for weeks and retrieve them under time pressure, which is exactly the situation these findings describe.
| Technique | Rating in Dunlosky et al. (2013) | What it looks like for the CIA | Where to do it |
|---|---|---|---|
| Practice testing | High | Timed question sets every study day; full mock exams | A question bank in timed mode |
| Distributed practice | High | Short flashcard sessions most days; revisiting domains across weeks | A spaced-repetition flashcard deck and a study planner |
| Interleaved practice | Moderate | Mixed-domain question sets once all domains are introduced | Mixed or exam mode in a question bank |
| Self-explanation | Moderate | Explaining why each wrong option is wrong, not only why the key is right | Questions with a rationale for every option |
| Elaborative interrogation | Moderate | Asking why a Standard requires what it requires | Guides that explain the Standards, not just list them |
| Rereading | Low | Reading the review text a second and third time | Replace with targeted rereads chosen from the error log |
| Highlighting | Low | Highlighting the Standards in color | Replace with flashcards written from what you missed |
| Summarizing | Low | Writing chapter summaries | Replace with one-line error-log entries |
None of this means reading is useless. You have to read to have anything to practice. It means reading should be the smaller share of your hours, done first to build a map and then on demand, when a missed question shows you a gap. A useful rule for the middle weeks of each part is two-thirds of study time on timed questions and their explanations, one-third on reading what those questions exposed.
Choose your part order and your dates
Most candidates should take the parts in order. Part 1, Internal Audit Fundamentals, is the broadest and carries the most Standards content; it teaches the vocabulary and structure that Parts 2 and 3 assume. Part 2, Internal Audit Engagement, applies that vocabulary to a single engagement. Part 3, Internal Audit Function, asks you to think like a chief audit executive, which is easier once the first two parts have taught you the IIA’s model. The IIA allows any order, so the exceptions are about your background, not the rules.
| Route | Who it suits | Watch out for |
|---|---|---|
| Part 1, then 2, then 3 | Most candidates | Part 1’s breadth makes it the biggest first hurdle; plan the most hours for it |
| Part 1, then 3, then 2 | Managers who run plans, budgets and committee reporting every day | Part 2 still demands the Standards’ exact engagement sequence, which experience can obscure |
| IAP holder: Part 2, then 3 | Students and early-career candidates who passed the IAP exam, which is CIA Part 1 | The waiver lasts four years from the award for IAPs earned after 27 May 2025; older IAPs lost it on 1 June 2026 |
| The Challenge Exam instead of all three | CPA and CA holders from an accounting body on the IIA’s approved list, and active CISA holders | One exam of 150 questions in 180 minutes, offered only in February, June, September and November |
Space the parts roughly two to three months apart. Closer than that and you will not prepare each part properly; much further apart and you lose the exam technique you built for the last one, and the third part starts to feel like a first exam again. The site’s CIA exam dates guide explains the 180-day registration window and the other deadlines that should shape when you buy and book each part, and the Challenge Exam guide covers the one-exam route. If you hold the IAP, the IAP vs CIA guide explains how long the Part 1 waiver lasts.
How many hours, and how to spread them
Most candidates need somewhere between 200 and 450 hours of study across the three parts, and background moves the number more than anything else: an auditor with five or more years of experience may need 60 to 100 hours for a part, while someone new to internal audit may need 110 to 170, and Part 1 takes the longest for everyone. The site’s study hours guide gives the full matrix by experience level and part. Hours are only half the decision, though. The research on spacing says the same hours spread over more weeks produce more lasting memory, which argues against cramming even when your calendar would allow it.
| Weekly hours | Weeks per part | Best for | The risk to manage |
|---|---|---|---|
| 5 to 6 | 16 to 20 | Heavy jobs, young families, audit busy season | Long gaps between sessions; keep flashcards daily so the material stays warm |
| 8 to 10 | 10 to 12 | Most working candidates | The default; protect one long weekend block each week |
| 12 to 15 | 7 to 9 | A quiet season at work, or between jobs | Fatigue; keep one full rest day a week |
| 20 or more | 4 to 6 | Full-time study | Too little calendar time for spacing; add review sessions in later weeks |
A useful check: divide the hours you expect to need for a part by the hours you can really give each week, and add two weeks of buffer for the weeks that go wrong. If the answer runs past the 180-day window that starts when you buy the exam, either start studying before you buy or plan more hours per week. The free CIA study planner does this arithmetic for you and re-plans from today when you fall behind.
A week of study, hour by hour
The routine below fits about eight and a half hours into a working week. It assumes you are past the first reading pass, so every session includes questions, and it puts the longest block on the weekend when attention is freshest. Adjust the days to your life; keep the shape.
| Day | When | What you do | Minutes |
|---|---|---|---|
| Monday | Morning or lunch | Flashcards for 15 minutes, then 20 timed questions in one domain and their explanations | 60 |
| Tuesday | Evening | A 40-question timed set; every miss logged with its reason and Standard | 90 |
| Wednesday | Evening | Error-log review; read only the Standards and sections your misses point to | 60 |
| Thursday | Evening | A 40-question timed set; explain each wrong option in a sentence | 90 |
| Friday | Commute or a short break | Flashcards only | 20 |
| Saturday | Morning | A 60 to 80 question mixed timed block, or a full mock exam in gate weeks, then full review | 150 |
| Sunday | Short session | Flashcards, then plan next week’s reading from the error log | 40 |
Two habits make the routine work. First, review every question you answer, including the ones you got right by guessing, because a lucky guess hides a gap. Second, write the error log as you go rather than at the end of the week; a log written from memory on Sunday loses the detail that makes it useful. In the early weeks of a part, swap Tuesday’s and Thursday’s mixed sets for single-domain sets until each domain has been introduced.
How to study each part
The method is the same for every part, but the reading and the drilling are not. The 2025 syllabus reorganized the exam around three levels of the profession: its foundations, the engagement and the function. The table summarizes each part’s domains and weights, what to read, and what to drill; the sections after it explain the traps. The site’s 2025 syllabus guide goes through all 62 topics.
| Part | Domains and weights | Read | Drill |
|---|---|---|---|
| Part 1: Internal Audit Fundamentals (125 questions, 150 minutes) | Foundations of Internal Auditing 35%; Ethics and Professionalism 20%; Governance, Risk Management and Control 30%; Fraud Risks 15% | The Standards’ Domains I to III; COSO’s principles; the Three Lines Model; fraud indicators | Which Standard applies and what it requires; ethics scenarios; fraud responsibilities |
| Part 2: Internal Audit Engagement (100 questions, 120 minutes) | Engagement Planning 50%; Information Gathering, Analysis and Evaluation 40%; Engagement Supervision and Communication 10% | The Standards’ Domain V, principles 13 and 14; evidence, sampling and work programs | The sequence of an engagement; “most appropriate next step” questions |
| Part 3: Internal Audit Function (100 questions, 120 minutes) | Internal Audit Operations 25%; Internal Audit Plan 15%; Quality of the Internal Audit Function 15%; Engagement Results and Monitoring 45% | The Standards’ Domain IV, Standards 8.3 and 8.4 on quality, and Principle 15 on communicating results and monitoring action plans | The chief audit executive’s perspective; reporting, ratings and monitoring |
Part 1: learn the Standards as the exam’s rulebook
Part 1 has the lowest pass rate of the three, 44 percent on the most recent figures The IIA published, and the reason is volume and precision together. Foundations alone is more than a third of the paper and is almost entirely about the Standards: the purpose of internal auditing, the mandate and charter, independence and the relationship with the board. Read the Standards’ first three domains in full once, early, then return to them through your error log. Treat Ethics and Fraud as tested material rather than common sense; together they are 35 percent of Part 1, and candidates who skip them leave the largest avoidable block of marks in the whole exam. The site’s Global Internal Audit Standards guide, its clause-by-clause guides to Domain I, Domain II and Domain III, COSO’s 17 principles, the Three Lines Model and fraud red flags cover the core reading, and the free CIA flashcards include every one of the 52 standards.
Part 2: learn the IIA’s engagement model, not your function’s
Part 2 is an engagement from planning to communication, and half the paper is planning. Its questions usually offer two defensible answers, and the Standards’ sequence decides which one is “most appropriate”: the engagement risk assessment before the work program, the sample sized to the control’s frequency, preliminary results discussed before the final report. Experienced auditors lose marks here by answering as their own function would act. Drill “what should the auditor do next” questions until the sequence is automatic, and read the site’s Domain V guide and its guides to audit evidence, sample sizes and the audit work program as descriptions of the model the exam tests.
Part 3: think like a chief audit executive
Part 3 was rebuilt in 2025 around running the function, and nearly half of it is about engagement results and monitoring: final communications, ratings and opinions, action plans, follow-up and reporting to the board. Staff and senior auditors who have never built an audit plan, defended a budget or written a committee report need to learn a perspective, not just content. Read the Standards’ Domain IV and Principle 15, the part of Domain V on communicating results and confirming that action plans are carried out, then study real examples of the documents the chief audit executive produces. The site’s GIAS Domain IV guide, internal audit plan template, finding severity ratings and issue validation guides cover the largest topics in the paper as practitioners do them.
Practice questions: how many, which ones, and how to review them
Volume matters, but not as much as how you use each question. A reasonable target is several hundred questions per part, which over three parts usually means well over a thousand. Three rules make that volume count. Use questions written to the 2025 syllabus, because older banks test content that has left the exam. Prefer banks that explain every option, not just the right one, so that each question teaches you something about the wrong answers too. And do most of them timed, because the real exam gives you 72 seconds a question and recognition at leisure is a different skill from retrieval under pressure.
The error log is what turns questions into progress. Keep it simple enough to fill in for every miss, in the moment, in under a minute.
| Date | Source | Domain | What the question tested | Why I missed it | Standard or concept | One-line fix |
|---|---|---|---|---|---|---|
| 14 Jan | Bank, Part 1 set 6 | Foundations | Who approves the internal audit charter | Answered from my function’s practice | Charter approval by the board | The board approves the charter; management does not |
| 14 Jan | Bank, Part 1 set 6 | Fraud Risks | Auditor’s responsibility after a red flag | Chose “investigate” | Fraud responsibilities | Assess and escalate; investigation is not the default auditor role |
| 16 Jan | Mock exam 1 | Ethics and Professionalism | A prior role creating an objectivity impairment | Misread “least” as “most” | Objectivity and impairment | Read the qualifier in the last line first |
Every few days, sort the log by the “why I missed it” column. If most misses are knowledge, read more. If most are misreading or traps, change how you read questions. If most are time, practice pacing. That diagnosis is worth more than another hundred questions answered the same way. The site’s free CIA practice question bank explains every answer, showing the rationale after each question in study mode and reviewing every miss at the end of a timed exam, and the 50 practice questions with answers make a good first diagnostic set for any part.
Mock exams and the go or no-go gates
A mock exam is a full-length practice exam taken under exam conditions: the right number of questions, the real time limit, no notes, no phone, one sitting. It measures something no other study activity does, which is whether your knowledge holds up for the full duration at exam pace. Take two per part, from different sources if you can, and only on questions you have not seen. Then use them as gates: the scores decide whether you keep your date.
| Gate | When, in a twelve-week plan | Target on fresh, timed questions | If you fall short |
|---|---|---|---|
| First mock | Week 8 | About 72 percent or better | Below about 68 percent, move the exam date by about four weeks and repeat the mixed-practice weeks |
| Second mock | Week 11 | About 75 to 80 percent | Below about 72 percent, reschedule; Pearson VUE allows changes up to 48 hours before, for $75 |
| Final check | Week 12 | No new mocks | Light review only; trust the evidence from the two gates |
The percentages are practical readiness targets based on practice-bank experience, not IIA figures, because the exam is scored on a scale where 600 passes and no fixed percentage maps to it; the site’s guide to the CIA passing score explains why. Simulate the real conditions as closely as you can: take the mock at the same time of day as your booked exam, use a single sheet of scrap paper as a stand-in for the erasable noteboard the test center provides, and keep the clock running if you take a break, because the real exam has no scheduled breaks and the timer does not stop.
Materials: what to use and what to skip
You need three things: the Standards, a large bank of current-syllabus questions with explanations, and something that structures the content for you, whether a review course or a disciplined self-study plan. Everything else is optional. The table sorts the common resources by what they are good for.
| Resource | Cost | Use it for | Watch out for |
|---|---|---|---|
| The Global Internal Audit Standards | Free from The IIA | The rulebook behind Part 1 and much of Parts 2 and 3 | Long; read by domain, then on demand from your error log |
| The IIA’s syllabus document for each part | Free | Checking coverage and weights | Topics are no longer labeled basic or proficient; use the weights to plan time |
| A commercial review course (Becker, Gleim, HOCK and others) | Hundreds of dollars to well over $1,000 | Structured content, large question banks and mock exams | Confirm it is built for the 2025 syllabus; compare question volume, not video hours |
| Free trials and demos from review providers | Free | Testing a course’s questions and explanations before you pay | Short by design; judge the explanations, not the interface |
| This site’s free tools | Free | A 156-question bank, 199 flashcards and a study planner | A supplement, not a full course |
| Pre-2025 books and question sets | Often cheap or free | Nothing for Part 3; little for Parts 1 and 2 | They teach content that left the exam in 2025 |
| Recalled or “dump” exam questions | Varies | Never | The IIA tells candidates not to use recalled exam content, and doing so puts the certification at risk |
Since March 2025 The IIA’s official review course has been developed and delivered by Becker, under a partnership announced that January; it is sold as the Becker–The IIA CIA Exam Review and was listed at $899 for its Essentials package and $1,299 for Premium in September 2026, while Gleim, HOCK and others compete on price, question volume and access period. The site’s comparison of CIA review courses sets out a framework for choosing, and the CIA exam cost guide puts course prices next to the exam fees. A course is not required; plenty of candidates pass with the Standards, a good question bank and the discipline of the method above. What no candidate should use is recalled exam content: The IIA’s exam security rules treat studying from recalled questions as misconduct, with penalties that run from invalidated results to a ban from every IIA certification program and the revocation of a certification already earned.
Studying while working full time
Most CIA candidates study around a full-time audit job, and the job’s calendar matters more than any study technique. Plan each part around your busy season, whether that is year-end, a SOX quarter or a large engagement, so that the heavy weeks of study do not collide with the heavy weeks of work. Protect one long block each week, usually a weekend morning, for the mixed sets and mock exams that need sustained attention, and use the small pockets of the day for flashcards, which is exactly the kind of short, spaced review that suits a commute or a lunch break.
Talk to your employer early. Many audit functions pay exam fees or IIA membership, and some give study leave before an exam; it is easier to ask before you register than after. Membership itself changes the arithmetic: in North America it costs $290 a year, while the member prices for the application and the three parts total $990 against $1,515 for non-members, a difference of $525 that more than covers a year’s dues. Finally, find one other person preparing for the same part, through an IIA chapter study group or a colleague; reviewing each other’s error logs is one of the cheapest ways to see the patterns in your own mistakes.
The final two weeks and exam day
The last two weeks are for consolidation, not new material. A new resource in the final week mostly produces anxiety, because it exposes gaps you no longer have time to close. Use the time to make what you know reliable under exam conditions.
| When | Focus |
|---|---|
| 14 to 8 days out | The second mock exam; targeted work on the two weakest domains it shows; flashcards daily |
| 7 to 3 days out | Mixed timed sets of 40; reread the whole error log; no new resources |
| 2 to 1 days out | Flashcards and the error log only; confirm the appointment, the route and your ID; sleep |
| Exam day | Arrive at least 30 minutes early; follow your pacing checkpoints; flag and move on after about 90 seconds |
| Afterward | The official result arrives within three weeks; book the next part assuming a pass |
Write your pacing plan before you leave home. For Part 1, aim to reach question 45 by minute 50 and question 90 by minute 100; for Parts 2 and 3, question 55 by minute 60. Answer every question, because a wrong answer costs nothing more than a blank one. Read the last line of each question first, where the qualifier that decides the answer usually sits: “most likely,” “best,” “primary,” “least,” “except.” Make sure the name on your ID matches your registration exactly, and expect a note board with a dry-erase marker at the center and an on-screen calculator in the exam itself. The site’s guide to CIA exam day at a Pearson VUE test center walks through the check-in, and if the result is not what you wanted, the retake plan for a failed part picks up from there.
Frequently asked questions
How long should I study for the CIA exam?
Most candidates need 200 to 450 hours across the three parts, or roughly 60 to 170 hours per part depending on background, with Part 1 the longest. At eight to ten hours a week, that is about ten to twelve weeks for a typical part.
Which CIA part should I take first?
Part 1 for most candidates, because it teaches the Standards’ vocabulary and structure that Parts 2 and 3 assume. Holders of an active IAP whose Part 1 waiver is still valid start with Part 2; for IAPs awarded after 27 May 2025, the waiver lasts four years from the award. The IIA allows any order.
Can I pass the CIA exam with self-study?
Yes. What you need is the Standards, a large bank of current-syllabus questions with explanations, and a plan you keep. A review course adds structure and more questions, but it is not required.
How many practice questions should I do?
Several hundred per part, which over the three parts usually means well over a thousand. Readiness should be judged only on questions you have not seen before, ideally through two full-length timed mock exams.
Should I read the Global Internal Audit Standards in full?
For Part 1, read them in full once, early, then return to specific sections through your error log. For Parts 2 and 3, read what those parts draw on most: Domain V’s principles 13 and 14 for Part 2, and Domain IV plus Principle 15 for Part 3.
How many hours a day should I study for the CIA?
About 60 to 90 minutes on weekdays plus one longer block of two to three hours at the weekend works for most working candidates. Short daily flashcard sessions matter more than occasional long ones.
Is it better to study one CIA part at a time?
Yes. Each part has its own domains, weights and question style, and focusing on one keeps your practice targeted. Book the parts roughly two to three months apart so that exam technique carries over.
What is the biggest mistake candidates make?
Reading too much and practicing too little. The research and the pass rates point the same way: timed questions, an error log and spaced review beat rereading and highlighting.
Related guides
- The CIA exam, explained: requirements, the three parts, every fee and a directory of every CIA guide on this site
- CIA exam study schedule: how to build a schedule you will keep, with templates
- How long to study for the CIA exam: hours by part and experience
- How hard is the CIA exam?: pass rates and the twelve-week first-attempt plan
- CIA exam passing score: how the 250-to-750 scale works
- CIA exam dates: every deadline from registration to results
- The 2025 CIA exam syllabus: every domain, weight and topic
- The 10 hardest CIA exam topics: where marks are most often lost
- Common CIA exam mistakes: 20 errors that cost candidates a pass
- CIA review courses compared: a framework for choosing
- Free CIA practice question bank: 156 questions with a rationale for every option
- CIA flashcards: 199 spaced-repetition cards, including all 52 standards
- The CIA study planner: a free day-by-day plan with every IIA deadline dated
- Internal audit books: a reading list by theme and career stage
Leave a Reply