CIA Part 1 Pass Rate, Format & Study Guide

The Certified Internal Auditor (CIA) is the only globally recognized certification for internal auditors, administered by The Institute of Internal Auditors (The IIA) — the profession's international standard-setting body, founded in New York in 1941 and now representing roughly 245,000 members across more than 170 countries. The IIA introduced the CIA designation in 1974, when the very first exam was sat by just 654 candidates at 41 US locations; today it's earned by tens of thousands of internal auditors every year across every industry and continent. Part 1, Essentials of Internal Auditing, is the entry point into the three-part CIA program: it establishes the foundational body of knowledge the other two parts build on — what internal auditing actually is, the governance/risk/control framework it operates inside, the ethical obligations that separate a credible auditor from a compliance rubber stamp, and how fraud risk gets identified and addressed. Passing all three parts (this one, plus Part 2 on engagement execution and Part 3 on running the internal audit function) earns the full CIA designation, but Part 1 is where nearly every candidate starts.

Internal audit is one of the few corporate functions that reports, at least in principle, directly to a board audit committee rather than up through operational management — which means the CIA credential carries real weight with the exact people who hire, promote, and set compensation for audit leadership. Job postings for internal audit manager and director roles routinely list CIA as required or strongly preferred, and many organizations (particularly in banking, insurance, and publicly traded companies subject to Sarbanes-Oxley) treat it as the practical floor for anyone leading an audit engagement. Beyond hiring managers, the credential signals something to the rest of the organization too: a CIA has demonstrated, through a standardized global exam rather than just years on the job, that they understand governance and control well enough to be trusted evaluating someone else's. For early-career auditors, it's frequently the difference between staying a staff auditor indefinitely and being considered for engagement-lead or senior roles.

Part 1 is the right starting point for staff and senior internal auditors building toward the full CIA, accounting or finance graduates entering internal audit as a career track, external (public accounting) auditors moving into internal audit or advisory roles, and risk/compliance professionals whose work overlaps heavily with internal audit's governance-and-control focus. It's also common among IT auditors and audit committee support staff who need the foundational internal-audit vocabulary even if their day-to-day work is more specialized. Because eligibility is assessed once for the whole three-part program rather than per part, anyone meeting The IIA's education/experience bar (see below) can register for Part 1 regardless of which other parts they've completed.

The certifying body does not publicly publish an official pass rate for this exam. Be wary of third-party sites citing a specific number here — treat any pass-rate claim you see elsewhere for this exam as unverified.

The IIA requires a 30-day wait after a failed attempt before you can sit for that exam part again — you can re-register as soon as you receive your score, but the earliest available appointment through Pearson VUE will be 30 days out. Each retake requires a new registration and payment of the exam fee; there's no free retake. Candidates get a maximum of 8 attempts per exam part within their 3-year CIA program eligibility window.

The IIA reports a scale score rather than a raw percentage, with a passing score of 600 required — the same 600 threshold applies consistently across all three CIA parts even though the questions and difficulty differ. The passing cut score for each part is set through a formal standard-setting process (a panel of internal audit professionals using an industry-accepted method), and the number of raw questions you need right to pass isn't fixed or disclosed. If you fail, your score report breaks down performance by domain; if you pass, no numeric score is given.

Part 1 is delivered as a computer-based test at Pearson VUE testing centers worldwide (a remote-proctored online option is also available in many regions), consisting of 125 multiple-choice questions with a 2.5-hour (150-minute) time limit — roughly 72 seconds per question on average, though some are short recall items and others are denser scenario-based questions that take longer. Registration opens a 180-day eligibility window in which to schedule and sit for that specific part; you don't have to take all three parts back-to-back, and most candidates space them out over months. The exam is proctored and closed-book, with no reference materials, calculators, or notes permitted at the workstation — everything is drawn from the assigned syllabus and The IIA's own Global Internal Audit Standards.

Under The IIA's current syllabus — realigned to the Global Internal Audit Standards, live since May 2025 — Part 1 covers four domains. Foundations of Internal Auditing (35% of the exam, the single largest domain) tests the core purpose and definition of internal audit, the Three Lines Model, and how internal audit's mandate is established and communicated within an organization. Governance, Risk Management, and Control (30%) covers how organizations structure oversight, how risk gets identified and managed at the enterprise level, and the control frameworks (like COSO) internal auditors use to evaluate whether an organization's safeguards are actually working. Ethics and Professionalism (20%) tests The IIA's own Code of Ethics along with broader professional-conduct principles — independence, objectivity, confidentiality, and competency — that every certified internal auditor is bound by. Fraud Risks (15%), the smallest domain, covers how fraud schemes are typically structured, common red flags, and internal audit's role in fraud risk assessment (distinct from fraud investigation, which is a separate specialty). Together, Foundations and GRC make up nearly two-thirds of the exam, so most successful candidates weight their preparation heavily toward those two before treating Ethics and Fraud as a lighter final review pass.

The IIA evaluates eligibility once for the entire CIA program, not separately per exam part — so whatever you submit here also covers your ability to sit for Parts 2 and 3. There are three qualifying pathways: a bachelor's degree plus 2 years of internal audit experience (the most common route), a master's degree plus 1 year of experience, or — for candidates without a qualifying degree — 5 years of internal audit experience combined with holding the Internal Audit Practitioner (IAP) credential first. "Internal audit experience" is interpreted fairly broadly by The IIA and can include external audit, risk management, or compliance work with sufficiently overlapping responsibilities, though pure accounting or bookkeeping roles generally don't qualify on their own. Every candidate must also submit a signed character reference — from a supervisor, a professor, or an already-certified IIA professional — attesting to their professional conduct, plus government-issued identification, and must formally agree to abide by The IIA's Code of Ethics as a condition of certification. Once your program application is approved, you have three years to complete and pass all three exam parts before your eligibility lapses and you'd need to reapply.

Budget for two separate charges. First, a one-time CIA program application fee — $120 for IIA members, $240 for non-members — paid once when you first apply, which covers your entire three-part program eligibility, not just Part 1. Second, the Part 1 exam fee itself, charged separately each time you register to sit: $310 for IIA members, $445 for non-members. IIA membership (which unlocks the member pricing on both the application and each exam part) has its own annual dues on top of that, so run the math on whether membership pays for itself given you'll pay it three times over across all three parts — for most candidates paying non-member pricing on all three exams, it does. All fees are non-refundable and non-transferable once paid, and a failed attempt requires paying the exam fee again in full for the retake — there's no discounted retake pricing in the CIA program the way some other certifying bodies offer.

The CIA is not a one-and-done credential — it requires ongoing Continuing Professional Education (CPE) to remain active. Practicing CIAs (those working in an internal-audit-related role) must complete 40 CPE hours annually on a calendar-year reporting cycle (January 1 to December 31), while non-practicing CIAs need 20 hours. Everyone, regardless of practicing status, must complete at least 2 of those hours specifically in ethics content each year. The IIA allows up to 20 excess CPE hours to carry forward into the following year if you exceed the requirement. In North America there's no separate certification renewal fee on top of IIA membership dues — renewal costs are bundled into membership — though CPE reporting fees can still apply depending on your specific membership tier and location. Reporting is self-certified: you're responsible for tracking and being able to substantiate your own CPE hours if audited, and missing the December 31 deadline without completing the requirement can lapse your certification.

Part 1 is 125 questions in 2.5 hours. Under The IIA's current syllabus (realigned to the Global Internal Audit Standards, live since May 2025), Foundations of Internal Auditing carries 35% of the exam and Governance, Risk Management, and Control carries 30% — together nearly two-thirds of the paper — with Ethics and Professionalism at 20% and Fraud Risks at 15%. Build your review around Foundations and GRC first, then run timed practice sets — at roughly 72 seconds per question you need Ethics and Fraud Risks answered close to on reflex to leave time for the denser Foundations/GRC scenario questions.

The most significant recent change to the CIA program is already reflected in this guide: The IIA realigned the entire three-part syllabus to its new Global Internal Audit Standards, effective May 2025, which replaced the prior domain structure and weightings across all three parts (Part 1's domains shifted, and Parts 2 and 3 were restructured even more substantially — Part 2 dropped its old "Practice of Internal Auditing" framing and Part 3 was renamed from "Business Knowledge for Internal Auditing" entirely). If you're studying from material published before mid-2025, verify it reflects the current Global Internal Audit Standards syllabus rather than the retired pre-2025 blueprint. As of August 2026, no further structural changes to Part 1 have been announced beyond that realignment.