CIA Part 2 Pass Rate, Format & Study Guide

CIA Part 2, Internal Audit Engagement, is the second of the three exams that make up The Institute of Internal Auditors' (The IIA) Certified Internal Auditor program — the only globally recognized credential for internal auditors, administered by the professional body founded in 1941 that today represents roughly 245,000 members worldwide. Where Part 1 establishes the conceptual foundation (what internal audit is, governance/risk/control theory, ethics), Part 2 shifts to the practical mechanics of actually running an audit engagement from start to finish: planning it, gathering and evaluating evidence, and supervising and communicating the work as it happens. It's the most operationally hands-on of the three parts — the content a working internal auditor applies literally every engagement, not just periodically.

Because Part 2 tests the actual mechanics of engagement work, it's often considered the most directly job-relevant of the three CIA exams — hiring managers and audit directors reviewing a CIA candidate's background know this part specifically validates whether someone can plan and execute an engagement competently, not just recite governance theory. For staff auditors angling toward senior-auditor or engagement-lead roles, strong command of Part 2's content (particularly engagement planning and evidence evaluation) is often what separates someone trusted to run engagements independently from someone who still needs close supervision. It's also the part most audit managers reference informally when mentoring — the framework Part 2 teaches for scoping an engagement, building the evidence trail, and escalating issues mirrors how real internal audit shops actually operate.

Part 2 is relevant to the same broad population as Part 1 — internal auditors pursuing the full CIA, finance/accounting professionals moving into internal audit, external auditors transitioning to internal roles, and risk/compliance staff — but candidates who've already spent time actually executing audit engagements (rather than only reviewing or approving them) tend to find this part's scenario-heavy questions more intuitive, since much of it tests judgment calls that come from hands-on fieldwork experience.

The certifying body does not publicly publish an official pass rate for this exam. Be wary of third-party sites citing a specific number here — treat any pass-rate claim you see elsewhere for this exam as unverified.

Same program-wide IIA policy as Part 1: a 30-day wait after a failed attempt, a fresh registration and exam-fee payment for each retake, and a cap of 8 attempts per exam part within your 3-year program eligibility window.

Part 2 uses the same scale-score system as the rest of the CIA program: a passing score of 600, set through The IIA's standard-setting process, applied consistently even though the specific cut score (in raw questions) varies part to part based on question difficulty. A failed attempt gets you domain-level performance feedback; a pass shows no numeric score.

Part 2 is a computer-based, closed-book exam administered at Pearson VUE test centers (remote proctoring available in many regions), consisting of 100 multiple-choice questions with a 2-hour (120-minute) time limit — a faster pace than Part 1's per-question average, since Part 2 skews toward denser scenario-based items that require applying a framework rather than recalling a definition. As with the other parts, registration opens a 180-day window to schedule and sit for the exam, and eligibility is program-wide rather than assessed separately per part (see Eligibility below).

• Engagement Planning50%
• Information Gathering, Analysis, and Evaluation40%
• Engagement Supervision and Communication10%

Following The IIA's 2025 realignment to the Global Internal Audit Standards, Part 2 covers three domains, and the weighting is heavily front-loaded. Engagement Planning (50% of the exam — half the entire paper) tests how an engagement's objectives and scope are defined, how risk is assessed at the engagement level (distinct from the enterprise-level risk assessment covered in Part 1), and how the engagement work program itself gets built. Information Gathering, Analysis, and Evaluation (40%) covers the actual fieldwork mechanics: sampling methodology, analytical procedures, data analytics, and how gathered evidence is evaluated for sufficiency and reliability before conclusions are drawn from it. Engagement Supervision and Communication (10%, the smallest domain) tests how engagement work gets reviewed and quality-controlled internally, plus how findings are communicated — to engagement clients, to audit management, and ultimately to the audit committee. Because Engagement Planning and Information Gathering together account for 90% of the paper, and both are scenario-heavy rather than recall-heavy, candidates who've done real engagement fieldwork generally have a real advantage on this part over candidates studying purely from theory.

Eligibility is assessed once for the whole CIA program — there's no separate bar for Part 2 specifically. The same three pathways apply: a bachelor's degree plus 2 years of internal audit experience, a master's degree plus 1 year, or the Internal Audit Practitioner (IAP) route plus 5 years of experience for candidates without a qualifying degree. A signed character reference and identification are required as part of the initial program application, and once approved you have 3 years to complete all three parts. Because eligibility is program-wide, candidates can take Parts 1, 2, and 3 in any order — some prefer to take Part 2 first specifically because they find the applied, scenario-based content more intuitive than Part 1's more conceptual material, though The IIA's own materials are structured assuming Part 1 comes first.

The Part 2 exam fee is $280 for IIA members and $415 for non-members, charged each time you register — this is separate from the one-time CIA program application fee ($120 members / $240 non-members) you already paid (or will pay) once for the entire program, not per part. If you're taking all three parts as a non-member, budget roughly $1,275 total in exam fees alone ($445 + $415 + $415) plus the $240 application fee, versus roughly $870 in exam fees plus $120 application fee as a member — a meaningful gap that often justifies IIA membership dues for candidates completing the full program. All fees are non-refundable, and a failed attempt requires paying the full exam fee again for the retake.

CPE requirements apply to the CIA designation as a whole once earned, not to individual parts — so Part 2 alone doesn't trigger any separate maintenance obligation. Once you hold the full CIA (all three parts passed), practicing CIAs need 40 CPE hours annually (20 for non-practicing status), with at least 2 hours in ethics content each year, reported on a calendar-year cycle. See the CIA Part 1 guide for the full maintenance breakdown, since it applies identically regardless of which part you're reading this from.

Part 2 is 100 questions in 2 hours. Under The IIA's current syllabus (realigned to the Global Internal Audit Standards, live since May 2025), Engagement Planning carries half the exam at 50%, Information Gathering, Analysis, and Evaluation carries 40%, and Engagement Supervision and Communication carries the remaining 10%. Because Engagement Planning and Information Gathering together make up 90% of the paper and are both scenario-heavy (objectives/scope decisions, risk assessment, evidence evaluation, analytics), prioritize practice questions that simulate those judgment calls over rote recall, and treat Supervision and Communication as a lighter final review pass.

Part 2 saw one of the more substantial changes in The IIA's 2025 syllabus realignment: it dropped its prior framing as "Practice of Internal Auditing" and was rebuilt around the Global Internal Audit Standards (effective May 2025), with an entirely new three-domain structure and weighting replacing the older blueprint. If you encounter study material referencing a different domain structure or percentages than what's listed above, it's almost certainly describing the retired pre-2025 version — verify against The IIA's own current Part 2 Expanded Test Specifications before relying on it. No further structural changes have been announced as of August 2026.