CIA Exam Study Guide 2026: Parts, Hours, Sequencing, and the Syllabus Trap

Plan roughly 40 to 60 study hours per CIA exam part, take the parts in order, and weight your effort toward Part 1, which fails the most candidates: its published pass rate is about 44%, against 48% for Part 2 and 56% for Part 3. Each part is passed with a scaled 600 on a 250 to 750 scale, there is no penalty for wrong answers, and all three are multiple-choice exams taken on demand at Pearson VUE.

This guide covers what each part actually tests, how to sequence and budget the work, and the one trap specific to 2026: stale prep material written for the pre-2024 syllabus.

Know what each part really tests

Part 1 (Internal Audit Fundamentals, 125 questions, 2.5 hours) is weighted 35% Foundations, 20% Ethics and Professionalism, 30% Governance, Risk Management, and Control, and 15% Fraud Risks. The center of gravity is the Global Internal Audit Standards: the purpose of internal auditing, the charter, independence of the function versus objectivity of the individual auditor, and the Three Lines Model. Ethics questions are scenario judgments, not definition recall.

Part 2 (Internal Audit Engagement, 100 questions, 2 hours) is weighted 50% Engagement Planning, 40% Information Gathering, Analysis, and Evaluation, and 10% Supervision and Communication. This is the doing part: setting objectives, assessing engagement risk, choosing procedures, judging whether evidence is relevant, sufficient, and reliable, and building workpapers a reviewer can retrace.

Part 3 (Internal Audit Function, 100 questions, 2 hours) is weighted 25% Operations, 15% Audit Plan, 15% Quality, and 45% Engagement Results and Monitoring. It tests how the function is run: the risk-based plan, the quality assurance and improvement program, results communication, follow-up, and the escalation sequences when management does not act. Protocol and sequence questions dominate.

The 2026 syllabus trap: retired vocabulary

The current exam sits on the syllabus aligned with the Global Internal Audit Standards published in January 2024. That refresh changed the language of the profession, and the exam uses the new language everywhere. It says Three Lines Model, not Three Lines of Defense. It says internal audit function and chief audit executive. It references Topical Requirements, a new mandatory layer covering specified risk areas such as cybersecurity. The old Attribute and Performance Standards numbering is gone.

Plenty of free study material online was written before 2025 and still teaches the retired terms. If your notes say Three Lines of Defense, they are dated, and on a standards-anchored exam, dated vocabulary is a real handicap. FreeFellow's CIA glossary is written entirely in the current Standards vocabulary for exactly this reason.

How to study each part

Most CIA questions are short: a direct conceptual question or a two-to-three sentence scenario, framed as the single best answer. The wrong choices are usually defensible-sounding actions that belong to someone else (management's job offered as the auditor's, the board's call offered as the chief audit executive's) rather than false statements. That means the highest-value study habit is asking, on every practice question, who owns this responsibility. Memorizing definitions without the role map behind them is how candidates end up in the 44% Part 1 pass rate.

Practice accordingly: work questions that explain every choice, not just the correct one. Each of FreeFellow's free CIA practice questions carries a worked solution plus a note on all four choices, which trains the role-assignment reflex the exam actually tests.

Budget the hours asymmetrically. A working internal auditor might need 40 hours for Part 2 (it mirrors the day job) and 60 or more for Part 1. A candidate coming from external audit or accounting usually finds Part 3 the most foreign, because managing an audit function, its quality program, and its follow-up processes has no external-audit equivalent.

Registration mechanics worth knowing

The application window runs three years once approved, each exam payment gives you 180 days to sit, failed parts can be retaken after 30 days, and there is a retake limit within the eligibility window. Fees for members total about $990 across the application ($120) and the three parts ($310, then $280 each). Experience (24 months with a bachelor's, 12 with a master's) is verified at certification, so you can sit all three parts first.

Start with what the CIA is and whether it is worth it, then put in the hours against free practice questions.

"CIA" and "Certified Internal Auditor" are registered trademarks of The Institute of Internal Auditors, Inc. FreeFellow is an independent study resource and is not affiliated with, sponsored by, or endorsed by The IIA.