CIA Part 3 Pass Rate, Format & Study Guide

CIA Part 3, Internal Audit Function, is the third and final exam in The Institute of Internal Auditors' (The IIA) three-part Certified Internal Auditor program — the credential's capstone, focused on running and overseeing the internal audit function itself rather than executing a single engagement. Where Part 2 tests how to plan and work an individual audit, Part 3 zooms out to the function level: how the annual audit plan gets built, how results across many engagements get monitored and escalated, and how the function's own quality is assessed and improved over time. It's the part most relevant to audit managers and directors, and the one most candidates find hardest to study for from job experience alone, since fewer internal auditors get direct exposure to function-level planning and quality-assurance work early in their careers.

Passing Part 3 completes the full CIA designation, and the content it tests — audit plan development, quality assurance, and how engagement results roll up into function-wide reporting to the audit committee — maps directly onto what audit managers and directors are actually judged on by senior leadership. A CIA who's demonstrably competent at Part 3's content has shown they understand not just how to execute audits well, but how to run an internal audit shop that a board can rely on. This is frequently the part of the CIA syllabus that shows up in interview questions for audit-leadership roles, since it's the closest the exam gets to testing management-level judgment rather than technical execution.

Part 3 is the natural third step for candidates who've already passed (or are concurrently studying) Parts 1 and 2, and is particularly relevant to senior auditors moving into audit-management track roles, current audit managers who haven't yet completed their CIA, and internal quality assurance/quality improvement staff whose work directly overlaps with this part's content. Candidates coming from pure staff-auditor roles with no exposure to audit-plan-level decisions sometimes find this the most conceptually unfamiliar of the three parts, and benefit from spending extra time on real IIA guidance materials rather than relying solely on job experience.

The certifying body does not publicly publish an official pass rate for this exam. Be wary of third-party sites citing a specific number here — treat any pass-rate claim you see elsewhere for this exam as unverified.

Same program-wide IIA policy as Parts 1 and 2: a 30-day wait after a failed attempt, a new registration and exam-fee payment per retake, and a maximum of 8 attempts per exam part within the 3-year program eligibility window.

Part 3 follows the same scale-score model as the rest of the CIA program — a passing score of 600 set via The IIA's standard-setting process, applied consistently across parts despite each part's specific pass threshold (in raw questions) being calibrated separately to that part's difficulty. Failing candidates get domain-level feedback; passing candidates get pass/fail only, no numeric score.

Part 3 is a computer-based, closed-book exam delivered at Pearson VUE test centers (remote proctoring available in many regions), consisting of 100 multiple-choice questions over a 2-hour (120-minute) time limit — the same format and pacing as Part 2. Registration opens a 180-day window to schedule the exam once you're ready, and eligibility (see below) is assessed once for the whole program, so Part 3 can technically be taken before Parts 1 or 2 if a candidate chooses, though most sit for it last given its function-level content builds naturally on the engagement-level material in Parts 1 and 2.

• Engagement Results and Monitoring45%
• Internal Audit Operations25%
• Internal Audit Plan15%
• Quality of the Internal Audit Function15%

Following The IIA's 2025 realignment to the Global Internal Audit Standards — which also renamed this part from "Business Knowledge for Internal Auditing" to "Internal Audit Function," replacing its entire prior domain structure — Part 3 now covers four domains. Engagement Results and Monitoring (45% of the exam, nearly half) tests how findings from individual engagements get reported, how residual risk is tracked, how issues get escalated when management doesn't remediate on schedule, and how follow-up on prior findings is managed at the function level. Internal Audit Operations (25%) covers the operational running of the audit function itself: staffing, resource allocation, technology use, and how the function manages its own day-to-day work. Internal Audit Plan (15%) tests how the annual (or multi-year) audit plan is built from a risk assessment, prioritized, and adjusted as the organization's risk profile changes. Quality of the Internal Audit Function (15%) covers the Quality Assurance and Improvement Program (QAIP) — the internal and external reviews an audit function is required to undergo to demonstrate it's actually operating to professional standards. Given Engagement Results and Monitoring's near-50% weighting, most candidates concentrate their heaviest review there before treating Operations, Plan, and Quality as three roughly-equal lighter-weight domains.

As with Parts 1 and 2, eligibility for the CIA program is assessed once, not per exam part. Candidates qualify via a bachelor's degree plus 2 years of internal audit experience, a master's degree plus 1 year, or — without a qualifying degree — the Internal Audit Practitioner (IAP) pathway plus 5 years of experience. A signed character reference (from a supervisor, professor, or IIA-certified professional) and identification are required at initial application, and once approved candidates have 3 years to complete all three parts. There's no additional experience or seniority requirement specific to Part 3 despite its function-level content — a first-year internal auditor meeting the standard program eligibility bar can sit for it, even though the material tends to reward candidates with some exposure to audit-plan or quality-assurance work.

The Part 3 exam fee matches Part 2's pricing: $280 for IIA members, $415 for non-members, charged when you register to sit — separate from the one-time program application fee ($120 members / $240 non-members) already covered when you first applied to the CIA program. Completing all three parts as a non-member runs roughly $1,275 in combined exam fees ($445 + $415 + $415) plus the $240 application fee; as a member, roughly $870 in exam fees plus $120. All fees are non-refundable and non-transferable, and a failed Part 3 attempt requires paying the exam fee again in full to retake.

Once the full CIA is earned (all three parts passed), the designation carries an ongoing CPE requirement — it isn't awarded permanently without upkeep. Practicing CIAs need 40 CPE hours per calendar year (20 for non-practicing status), including at least 2 hours of ethics content annually, self-reported by the December 31 deadline each year. Up to 20 excess hours can carry forward to the next reporting year. See the CIA Part 1 guide for the complete breakdown — it applies identically to holders regardless of which part of the exam got them there.

Part 3 is 100 questions in 2 hours. Under The IIA's current syllabus (realigned to the Global Internal Audit Standards, live since May 2025 and renamed from Business Knowledge for Internal Auditing to Internal Audit Function), Engagement Results and Monitoring alone is 45% of the exam — nearly half the paper — with Internal Audit Operations at 25% and Internal Audit Plan and Quality of the Internal Audit Function at 15% each. Spend proportionally more prep time on Engagement Results and Monitoring (reporting, residual risk, escalation, follow-up) before treating Operations, Plan, and Quality as the lighter review pass.

Part 3 underwent the most visible rebrand of the three parts in The IIA's 2025 syllabus realignment: its name changed from "Business Knowledge for Internal Auditing" to "Internal Audit Function," and its domain structure was rebuilt entirely around the new Global Internal Audit Standards (effective May 2025) — the old blueprint (which weighted Business Acumen, IT, Information Security, and Financial Management as separate domains) is now retired and should not be used for study. If a prep resource references those older domain names, it's describing the pre-2025 version. No further structural changes to Part 3 have been announced as of August 2026.