Plan on 40 to 60 study hours per CIA exam part, take the parts in order, and put the most effort into Part 1. It covers the Standards, independence and ethics that Parts 2 and 3 assume, so gaps there follow you through the other two. You pass each part with a scaled 600 on a 250 to 750 scale, there's no penalty for wrong answers, and all three are multiple-choice exams you take on demand at Pearson VUE. Also make sure your prep material was written for the current syllabus, because a lot of what's online wasn't.
What each part tests
Part 1 (Internal Audit Fundamentals, 125 questions, 2.5 hours) is weighted 35% Foundations, 20% Ethics and Professionalism, 30% Governance, Risk Management, and Control, and 15% Fraud Risks. Most of it is about the Global Internal Audit Standards: the purpose of internal auditing, the charter, independence of the function versus objectivity of the individual auditor, and the Three Lines Model. Ethics questions give you a scenario and ask for a judgment call rather than a definition.
Part 2 (Internal Audit Engagement, 100 questions, 2 hours) is weighted 50% Engagement Planning, 40% Information Gathering, Analysis, and Evaluation, and 10% Supervision and Communication. It's the hands-on part: setting objectives, assessing engagement risk, choosing procedures, judging whether evidence is relevant, sufficient and reliable, and building workpapers a reviewer can follow.
Part 3 (Internal Audit Function, 100 questions, 2 hours) is weighted 25% Operations, 15% Audit Plan, 15% Quality, and 45% Engagement Results and Monitoring. It tests how the function is run: the risk-based plan, the quality assurance and improvement program, communicating results, follow-up, and the escalation steps when management doesn't act. Most of its questions are about protocol and sequence, meaning who does what and in what order.
The vocabulary changed in 2024
The current exam follows the syllabus aligned with the Global Internal Audit Standards published in January 2024, and it uses the new language everywhere: Three Lines Model, not Three Lines of Defense; internal audit function and chief audit executive; and Topical Requirements, a new mandatory layer covering specific risk areas such as cybersecurity. The old Attribute and Performance Standards numbering is gone.
A lot of free study material online was written before 2025 and still teaches the retired terms. If your notes say Three Lines of Defense, they're out of date, which costs you on an exam built around the Standards. FreeFellow's CIA glossary uses only the current Standards vocabulary.
Studying, retakes and fees
Most CIA questions are a direct conceptual question or a two- to three-sentence scenario with a single best answer. The wrong choices usually aren't false statements but reasonable-sounding actions that belong to someone else, like management's job offered as the auditor's, or the board's call offered as the chief audit executive's. So on every practice question, ask who owns the responsibility. A lot of candidates fail Part 1 because they memorized the definitions but never learned who owns what.
Practice with questions that explain every choice. Each of FreeFellow's free CIA practice questions has a worked solution for the right answer plus a note on each of the three wrong ones, across 498 questions for Part 1, 433 for Part 2 and 443 for Part 3.
Budget your hours unevenly. A working internal auditor might need 40 hours for Part 2, since it mirrors the day job, and 60 or more for Part 1. Candidates from external audit or accounting usually find Part 3 the least familiar, because running an audit function, its quality program and its follow-up process has no external-audit equivalent.
Once your application is accepted, you have three years to finish. Each exam payment gives you 180 days to sit, you can retake a failed part after 30 days, and there's a limit on retakes within the eligibility window. Fees for members total about $990 across the application ($120) and the three parts ($310, then $280 each). The experience requirement (24 months with a bachelor's, 12 with a master's) is verified at certification, so you can sit all three parts first.
If you're still deciding, start with what the CIA is and whether it's worth it, then put in the hours on free practice questions.