By Jan Olivier, Chartered IIA Head of Education and Development
For anyone preparing for the CIA exams, the syllabus is one of the most important documents to keep close at hand. Yet it is often overlooked in favour of the learning materials.
In this guidance, I will explain why the syllabus is so important, how it can help you, and what information you are able to get from the syllabus itself that will help you prepare for the exam.
But first, a quick recap of the three Parts and the essential study elements for each.
In this guidance I reference the 2025 syllabus only.
When studying Part 1, you should read the Standards and the underlying principles. You do not need to be able to quote them or remember the numbers of the Standards. You do need to know what the Standards state and how to demonstrate conformance with each of the Standards. Crucially, you must be able to apply the Standards to a work environment.
Do not make the mistake of treating Part 1 as the easy "theory" exam. Expect nuanced, scenario-based questions that require you to select the best answer from several plausible options.
Pay particular attention to the big themes: independence and objectivity requirements and their practical implications, the conceptual frameworks underlying risk-based auditing, and fraud risk.
And do not forget the biggest of them all – ethics.
If you have been working in internal audit for a number of years, then you can rely on your experience, but before you do, make sure that your policies and methodology align with the expectations of the Standards. If you are less experienced, or if you are preparing for the CIA Part 1 exam as part of the Internal Audit Practitioner, then you should spend some extra time on the IPPF to understand the Standards, and then undertake some further reading to know what the Standards look like when applied to the workplace. This will improve your chances of being successful in the exam.
Of the three papers, this is probably the one where candidates with more experience will benefit the most. Again, experienced candidates need to ensure that the approaches followed at work are completely aligned with the IIA requirements and the Standards. Candidates with little or no experience will need more time to prepare for this exam, as they will need to work through practical scenarios rather than try to learn by reading about procedures.
But CIA Part 2 requires significant preparation and, of the three Parts, is the one with the lowest pass rate.
When studying for Part 2, pay attention to engagement planning procedures (particularly risk and control assessment), fieldwork techniques (sampling methods, types of audit evidence, analytical procedures), documentation standards, and communication requirements.
In the exam, you are not assessed against the learning materials – you are assessed against the syllabus. The syllabus tells you what you need to demonstrate in the exam in order to meet the requirements.
So if you haven’t done so already, download a copy of the syllabus and keep it close as you study.
How many questions you will receive from each section. The first thing you will notice is that the syllabus includes the weighting of each section in the exam. You can use these percentages to calculate approximately how many questions you will receive from each section.
|
Part 1 (125 questions) |
Part 2 (100 questions) |
Part 3 (100 questions) |
|
| Section A | 44 | 50 | 25 |
| Section B |
25 |
40 |
15 |
| Section C | 37 | 10 | 15 |
| Section D | 19 | 45 |
The second thing to focus on is the verb at the start of each of the learning outcomes. These are not random but relate to one of the cornerstone theories in education, and each one is carefully mapped against a cognitive level. While the verb is a strong indicator, you should also consider the context of the question.
Examples of verbs include describe, identify, demonstrate, apply and evaluate. It is these verbs that tell you what you need to be able to do in the exam: if you are asked to ‘describe’ something, then make sure you are able to use your own words, illustrated by your own examples, in order to relay the important areas and other core facts to somebody else.
If a learning outcome asks you to recommend a course of action, you need to weigh up the relevant facts, consider the context and select the most appropriate response. As a study exercise, practise explaining why your chosen response is better than the alternatives.
So, different verbs represent different levels of complexity. These are called cognitive levels, and they range from simple memorisation to the ability to produce new knowledge sets based on independent research.
Read the following table from the bottom up: each row represents a cognitive level. Bloom’s revised taxonomy has six levels; the table illustrates four that can help you interpret the syllabus.
| Cognitive levels | Description | Verbs |
| Evaluate | Make a judgement based on analysis | Recommend, assess, critique |
|
Analyse |
Exploring relationships, causes and connections | Compare, distinguish, contrast |
| Apply | Use existing knowledge in a new context | Practise, illustrate, implement |
| Understand | Grasp the meaning of something, and relay it in your own words | Explain, describe, summarise |
If you look at the use of cognitive levels in the CIA syllabus, you will find the following:
| Part 1 | Part 2 | Part 3 | |
| Evaluate | 2 | 3 | 2 |
|
Analyse |
1 | 0 | 0 |
| Apply | 5 | 13 | 1 |
| Understand | 19 | 1 | 17 |
You should be able to see immediately that Parts 1 and 3 have more learning outcomes at the ‘understand’ level than Part 2. This should be an indication that Part 2 is likely to be more challenging than Parts 1 and 3, as it would include more application questions and scenarios which may be more challenging to answer.
You can also use the syllabus to help you prioritise your learning when you are planning your studies.
Note that I didn’t say question spotting – you should never spot questions, especially not with a multiple-choice exam.
However, you can use it to calculate how many questions there are likely to be from each section. More subsections mean more different ideas and more reading. On the other hand, fewer subsections mean less reading and fewer ideas.
You can then consider the number of questions you can expect in the exam under each section (Table 1), and then divide that by the number of subsections in the syllabus. The higher the number you end up with, the more questions you can expect from that section and the higher that area should be on your priority list.
|
Part 1 (122 questions) |
Part 2 (100 questions) |
Part 3 (100 questions) |
|
| Section A | 5.25 | 7 | 6.25 |
| Section B | 4 | 5 | 5 |
| Section C | 4.5 | 5 | 5 |
| Section D | 3.6 | 5.6 |
But be careful: it just provides an estimate – there is no telling how the questions will be distributed across the subsections.
Finally you can also use the learning outcomes to form questions. You can use this to assess your own understanding of a section and so help you with your revision by identifying areas that you feel comfortable with, and other areas where you may want to spend a bit more time.
There are a few other documents that you should also keep close at hand.
These five publications should be considered essential reading. Try not to memorise these, but again think of the real-world application and what these look like in practice.
The table below shows the publications and the parts they relate to. These are all available from The IIA website.
| Publication | Part 1 | Part 2 | Part 3 |
| The IIA’s Global Internal Audit Standards | X | X | X |
|
IIA Global Practice Guide: Developing a Risk-Based Internal Audit Plan, 2nd edition |
X | ||
| IIA Global Practice Guide: Engagement Planning: Assessing Fraud Risks | X | X | |
| IIA Global Practice Guide: Integrated Approaches to Internal Auditing | X | X | |
| IIA GTAG: IT Essentials for Internal Auditors | X | X | X |
