A good internal auditor doesn’t just spot problems, they explain them clearly and help fix them. That’s one reason the Certified Internal Auditor (CIA) is so well respected. It’s a global qualification from The Institute of Internal Auditors (IIA), and employers often see it as proof you understand risk, controls, governance, and how a business really works.
When people search for “CIA qualification entry requirement”, they usually mean three things: what you need to be accepted into the CIA programme, what you must complete to be awarded the certificate, and how long you’ve got to finish once you’re accepted (you typically have a 3-year programme window).
This guide breaks it all down in plain English, with a simple checklist you can follow, even if you’re still studying or building experience.
The core CIA entry requirements, what you must have before you can qualify
Think of the CIA as a three-part test of readiness: education, relevant work, and passing the exam. You can start the journey before you’ve ticked every box, but you can’t receive the CIA designation until you’ve met the full set of certification requirements.
Here are the non-negotiables most candidates plan around:
- An eligible education route (degree route or an experience-based route).
- Relevant work experience (the number of years depends on your education level).
- Pass all three CIA exam parts within the allowed time window.
If you want a broader explanation of what the qualification covers and why it matters, the guide on CIA qualification entry requirements is a helpful starting point before you commit to the programme.
Education routes you can use (including options if you do not have a degree)
The IIA accepts more than one education pathway. That’s good news if your route into audit hasn’t been “university then graduate job”.
The commonly used routes are:
- Bachelor’s degree or higher (any subject): Your degree doesn’t need to be in accounting, finance, or business. What matters is that it’s a recognised qualification that meets the IIA’s criteria.
- Associate degree or less plus 5 years of internal audit experience: This is the main “no degree” route. The experience must be verified and relevant (more on what counts below).
- Two years of post-secondary education plus 5 years of internal audit experience: This route suits people who completed college or similar study, even if they didn’t finish a full degree.
A practical detail many people miss: you may be able to apply in your final year of study (where the IIA permits this), but you won’t be awarded the CIA credential until your degree is completed and verified.
There are also special eligibility paths for some holders of professional designations. Public guidance often mentions options such as the Internal Audit Practitioner (IAP) designation, and in some cases pathways connected to other accountancy qualifications. Some credentials may also qualify you for a separate challenge exam route instead of the full three-part CIA, but the rules can be specific, so check what applies to your designation before you plan around it.
Work experience, how many years you need and what roles count
Work experience is where the CIA becomes more than an exam pass. The IIA wants to see that you’ve applied audit thinking in the real world, not just revised it.
The required experience usually depends on your highest level of education:
| Education level | Experience required |
|---|---|
| Master’s degree or higher | 1 year |
| Bachelor’s degree | 2 years |
| Associate degree or less | 5 years |
What counts as “qualifying” experience is wider than many people think. The IIA commonly recognises work in areas such as internal auditing, external auditing, risk management, compliance, internal control, and quality assurance. In other words, if your job involves testing controls, checking processes, reviewing risks, or supporting assurance work, it may count.
One timing rule to be aware of if you’re using the 5-year route: public guidance states that at least two of those years must be within the three years before you complete the certification. This stops very old experience being used on its own.
Two quick examples to help you self-check:
- If you’re an audit associate supporting planning, walkthroughs, testing, and reporting, that’s usually clearly relevant.
- If you’re a risk and controls analyst who documents controls, tests them, and tracks remediation, that may also fit, even if your title doesn’t include “auditor”.
How the CIA application and exam process works, step by step
The CIA process feels easier when you stop thinking of it as one big hurdle. It’s a set of small admin steps, then three exams, then verification.
In most cases, your journey looks like this:
- Create your account in the IIA’s CCMS (their candidate management system).
- Submit your CIA programme application and pay the required fees.
- Upload proof for your eligibility route (education and identity, and later, experience).
- Wait for approval, then register for an exam part.
- Schedule your exam at an approved test centre (or via the available exam delivery options in your region).
- Pass Parts 1, 2, and 3, then submit your experience verification.
- Receive your certification confirmation once the IIA verifies everything.
The key time limit to remember is the 3-year completion window. Public candidate guidance commonly frames this as three years from programme acceptance in the CIA programme. Your CCMS account is the safest source for your own dates, so treat what you see there as your personal deadline and plan backwards from it.
What documents you may need to upload and why they get rejected
Most delays happen for boring reasons. The good news is that you can avoid them by preparing your documents like you would prepare audit evidence: clear, complete, and consistent.
You may be asked to upload items such as:
- Proof of education: a degree certificate, official transcript, or a letter from your university confirming your award and level.
- Government-issued photo ID: to confirm your identity matches your application record.
- Name change evidence (where needed): for example, if the name on your degree differs from your current legal name.
If your qualification documents are not in English, you may need an official translation. Some candidates also use official evaluation letters where their education was completed in another country, depending on the IIA’s requirements in that situation.
Common reasons applications get held up are usually simple mistakes:
- Blurry scans or photos: if it can’t be read, it can’t be approved.
- Mismatched names: “Sam Jones” on your CCMS profile and “Samuel Jones” on your transcript can trigger questions.
- Incomplete transcripts: missing pages, missing award details, or no institution name.
- Wrong document type: uploading a student portal screenshot instead of an official transcript.
A good habit is to check every upload on your phone and laptop before submitting. If it’s hard to read on either screen, replace it.
The CIA exam format and the 3-year completion window
The CIA exam is computer-based and split into three parts. Each part is multiple-choice and time-limited:
| Exam part | Focus | Questions | Time |
|---|---|---|---|
| Part 1 | Internal Audit Fundamentals | 125 | 2.5 hours (150 minutes) |
| Part 2 | Internal Audit Engagement | 100 | 2 hours (120 minutes) |
| Part 3 | Internal Audit Function | 100 | 2 hours (120 minutes) |
You’ll need to pass each part to complete the exam requirement. Public guidance also references a scaled scoring model, with 600 commonly shown as the passing mark.
The planning challenge is not the exam format, it’s the clock. You typically have a 3-year window to pass all three parts and meet the other requirements. Treat that deadline like a fixed audit committee meeting. It’s not something you want to squeeze in at the last minute.
A simple planning approach that works for busy professionals is to aim for one part every 4 to 6 months. That gives you breathing room for a resit if needed, without turning the whole programme into a long-term stress.
Special cases that often confuse candidates (and how to handle them)
Many people delay the CIA because they assume they won’t qualify. In practice, most “I probably can’t” situations fall into a handful of common edge cases.
The trick is to separate what you need to enter the programme from what you need to be awarded the designation. You can often start exams while you build experience, but you can’t get certified until both exam and experience requirements are complete.
If anything about your situation is unusual (mixed education, international documents, a career break), don’t guess. Use the IIA’s current rules inside CCMS and confirm what they’ll accept before you commit time and money.
Do age, residency, or degree subject matter for CIA eligibility?
Publicly available guidance typically does not list age or residency as barriers to CIA eligibility. The CIA is designed as a global qualification, so the focus is usually on your education route, your experience, and passing the exams.
Degree subject is another common worry. The CIA does not require an accounting degree. A bachelor’s degree in any discipline can be acceptable. In internal audit teams, it’s normal to meet CIAs with backgrounds in IT, engineering, law, and operations.
What does matter is whether the qualification is recognised under the IIA’s criteria, and whether you can provide acceptable proof. If you studied outside the UK or your documents are not in English, plan extra time for verification and any translation needs.
Can you start the CIA before you have the required experience?
Yes, many candidates take CIA exam parts while they’re still building the work experience they need for certification. The key point is simple: you can pass exams first, but you won’t receive the CIA credential until your experience requirement is met and verified.
This is also why the final-year student option appeals to some candidates. You can start earlier, keep momentum, and move into your first audit role with exam progress already made.
If this is you, do this next:
- Pick your route: bachelor’s route (usually 2 years’ experience) or the 5-year route.
- Plan your job moves: aim for roles that clearly involve audit, controls, risk, or compliance work.
- Keep evidence: job descriptions, role objectives, and a record of what you actually do.
- Line up a verifier: you’ll usually need someone suitable to confirm your experience when the time comes.
Handled well, this approach turns the CIA into a steady project, not a last-minute scramble.
Conclusion
The CIA is achievable when you treat it like an organised plan, not a vague ambition. Choose the education route that fits your background, then confirm the experience target tied to that route. Learn the exam structure (three parts, fixed timings), and respect the 3-year completion window shown in your CCMS account. Gather your documents early, apply through CCMS, and keep track of experience so it’s easy to verify later.
Once you’re certified, remember it doesn’t stop there. You’ll need ongoing CPD, with public guidance commonly stating 40 hours each year, including ethics learning.
Set your route today, map a realistic timeline, and make the CIA a qualification you finish, not one you keep “meaning to start”.