TL;DR: Choose the CIA (Certified Internal Auditor, from The Institute of Internal Auditors, or IIA) if your career is internal audit in the broad sense: assessing governance, risk and controls across an organization, planning engagements and running an audit function. Choose the CISA (Certified Information Systems Auditor, from ISACA) if your work is auditing, assurance or testing of IT systems and controls. The CIA has three exam parts (125, 100, and 100 multiple-choice questions) with a passing score of 600 on a 250 to 750 scale. The CISA is one exam (150 multiple-choice questions in 4 hours) with a passing score of 450 on a 200 to 800 scale. The CIA asks for 1 to 5 years of internal audit experience depending on your education, and the CISA asks for 5 years of IS audit, control, or security experience, with some waivers available. Many audit teams hire for both, and holding both is common among IT-focused internal auditors.
Key Takeaways
- They certify different things. The CIA covers the internal audit profession and the Global Internal Audit Standards. The CISA covers auditing information systems, from governance of IT to operations, resilience and protection of information assets.
- The formats differ. CIA has three exams taken separately. CISA is one long exam.
- Cost is similar at the entry point, but not the same. CIA application plus all three parts is USD 990 for IIA members and USD 1,515 for non-members. CISA is USD 575 (member) or USD 760 (non-member) plus a USD 50 application fee after you pass.
- Experience rules differ. CIA: 1 year with a master’s degree, 2 years with a bachelor’s degree, 5 years without a degree. CISA: 5 years, with some waivers.
- You can sit both exams before you have the experience, but you cannot use either designation until the experience requirement is met.
- Neither is a prerequisite for the other. If your role mixes internal audit and IT audit, the two work well together.
- IT audit and the CIA: the 2025 CIA syllabus is organized around the audit function and engagement. If your goal is hands-on IT controls testing, the CISA matches the content more directly.
Quick Facts
| CIA | CISA | |
| Issuer | The Institute of Internal Auditors (IIA) | ISACA |
| Focus | Internal audit profession, governance, risk, engagements, audit function | IS audit, control, security and assurance |
| Exam structure | 3 parts | 1 exam |
| Questions | Part 1: 125. Part 2: 100. Part 3: 100 (multiple choice) | 150 (multiple choice) |
| Time | Part 1: 150 minutes. Parts 2 and 3: 120 minutes each | 4 hours |
| Passing score | 600 on a 250 to 750 scale, per part | 450 on a 200 to 800 scale |
| Experience | Master’s: 1 year. Bachelor’s: 2 years. No degree: 5 years | 5 years of IS audit, control or security work, within the 10 years before applying, with some waivers |
| Exam cost (member) | USD 990 (application plus three parts) | USD 575, plus USD 50 application fee |
| Exam cost (non-member) | USD 1,515 (application plus three parts) | USD 760, plus USD 50 application fee |
| Time to complete | 3 years from program acceptance | Exam, then apply for certification within 5 years of passing |
| Maintenance | Annual CPE attestation, including ethics | 20 CPE hours per year, 120 over 3 years, plus an annual maintenance fee |
Figures were checked on the issuers’ pages and in secondary summaries in November 2026. The IIA states that pricing changes starting January 4, 2027. Confirm every fee and rule with the IIA and ISACA before you register.
What Is the CIA?
The CIA is the IIA’s flagship certification for internal auditors, recognized globally. It tests whether you understand internal audit fundamentals, how to plan and perform an audit engagement, and how to run the internal audit function, aligned to the Global Internal Audit Standards that became effective in January 2025.
Key facts:
- Three parts: Part 1 is Internal Audit Fundamentals (125 questions, 150 minutes). Part 2 is Internal Audit Engagement (100 questions, 120 minutes). Part 3 is Internal Audit Function (100 questions, 120 minutes).
- Scoring: Scores convert to a scale of 250 to 750, and 600 is passing. There is no penalty for incorrect answers.
- Program window: You have three years from acceptance into the program to complete all requirements, including experience.
- Challenge route: Active CPAs can use a single-exam route. See our CIA Challenge exam guide for eligibility and format.
What Is the CISA?
The CISA is ISACA’s long-standing credential for professionals who audit, control, monitor and assess information technology and business systems. It is built around the day-to-day work of an IS auditor: planning and conducting audits, evaluating IT governance, reviewing system acquisition and development, testing operations and business resilience, and judging whether information assets are protected.
Key facts:
- One exam: 150 multiple-choice questions in 4 hours.
- Scoring: Scores are reported on a scale of 200 to 800, and 450 or higher passes. Pretest items do not count toward your score, and there is no penalty for wrong answers.
- Experience: 5 years of professional information systems auditing, control or security work, gained within the 10 years before the application date. Some secondary sources say up to 3 years can be waived, so check ISACA’s current requirements before you assume any substitution applies to you.
- Sit first, certify later: You can take the exam before you have the experience. ISACA gives you 5 years from the passing date to apply, but you cannot use the designation until you are certified.
- Update status: ISACA’s updated CISA exam took effect on August 1, 2024. Download the current outline from ISACA before you plan your study.
Exam Content Side by Side
CIA parts and domains (2025 syllabus)
| Part | Domains and weights |
| Part 1: Internal Audit Fundamentals | Foundations of Internal Auditing 35%, Ethics and Professionalism 20%, Governance, Risk Management and Control 30%, Fraud Risks 15% |
| Part 2: Internal Audit Engagement | Engagement Planning 50%, Information Gathering, Analysis and Evaluation 40%, Engagement Supervision and Communication 10% |
| Part 3: Internal Audit Function | Internal Audit Operations 25%, Internal Audit Plan 15%, Quality of the Internal Audit Function 15%, Engagement Results and Monitoring 45% |
English-language changes took effect on May 28, 2025, and other languages follow a staggered schedule. Domain names in some languages may still follow the earlier syllabus, so confirm the version offered in your language on the IIA’s site.
CISA domains
| Domain | Weight |
| 1. Information Systems Auditing Process | 18% |
| 2. Governance and Management of IT | 18% |
| 3. Information Systems Acquisition, Development and Implementation | 12% |
| 4. Information Systems Operations and Business Resilience | 26% |
| 5. Protection of Information Assets | 26% |
What the content tells you
- The CIA is about the audit profession. Even in Part 3, the emphasis is on running the audit function: operations, the audit plan, quality and results monitoring. It is not an IT controls exam.
- The CISA is about systems and controls. Operations, business resilience and protection of information assets together make up 52% of the exam.
- The 2025 CIA syllabus has moved away from the earlier business-knowledge topics, including information technology and information security, according to a prep-provider summary of the changes. If you rely on the CIA for IT audit depth, read the current IIA syllabus first.
- Governance and risk appear in both, but through different lenses. The CIA looks at governance, risk and control as the internal auditor assesses them. The CISA looks at governance and management of IT.
Requirements: Education, Experience and Timelines
| CIA | CISA | |
| Education | Bachelor’s or master’s degree (or equivalent), or no degree with 5 years of experience | No formal degree requirement stated on the pages reviewed |
| Experience | Master’s: 1 year. Bachelor’s: 2 years. No degree: 5 years of internal audit experience | 5 years of professional IS audit, control or security work, within 10 years of applying |
| Waivers | Not applicable | Some secondary sources say up to 3 years can be waived. Confirm on ISACA’s site |
| Sit exams before experience | Yes, if you have a degree or an active IAP designation | Yes |
| Deadline | 3 years from program acceptance to finish all requirements | 5 years from the passing date to apply |
| Ethics | Agree to the IIA’s Standards of Ethics and Professionalism | Adhere to ISACA’s code of professional ethics |
Points to note:
- The CIA experience must be internal audit work. The CISA experience can be IS audit, control or security work, which is a wider net for people in IT, security or GRC roles.
- The CIA clock is shorter and tighter. Three years from acceptance covers three exam parts and the experience requirement.
- Document your CISA experience early. Verification by employers or supervisors takes time.
Cost: CIA vs CISA
CIA fees (member and non-member, in USD)
| Item | Member | Non-member |
| Application | 120 | 240 |
| Part 1 | 310 | 445 |
| Part 2 | 280 | 415 |
| Part 3 | 280 | 415 |
| Application plus all three parts | 990 | 1,515 |
CISA fees (member and non-member, in USD)
| Item | Member | Non-member |
| Exam | 575 | 760 |
| Application processing fee (after passing) | 50 | 50 |
| Exam plus application | 625 | 810 |
| One six-month eligibility extension | 75 | 75 |
| Annual maintenance fee | 45 | 85 |
What to take from the numbers:
- Sitting the CISA once costs less than the CIA’s three parts before study materials, but a retake costs the full fee again.
- CISA retakes are limited. You have four attempts within a rolling 12-month period, with a 30-day wait after the first attempt and a 90-day wait after each later attempt.
- IIA prices change on January 4, 2027, so confirm current CIA fees if you plan to register around that date.
- Membership changes the math. Both issuers charge members less. Check the current membership price before you decide whether to join.
- Study materials are extra for both credentials.
Keeping the Certification
- CIA: CIAs self-attest each year that they meet renewal requirements, including CPE hours and 2 hours of ethics training, by December 31. Prep-provider summaries list 40 CPE hours a year for CIAs practicing in internal audit, but confirm the hour count and the renewal fee on the IIA’s CPE requirements page.
- CISA: 20 CPE hours per year and 120 hours over a 3-year reporting period, reported through MyISACA, plus the annual maintenance fee (USD 45 for members, USD 85 for non-members).
How Hard Is Each Exam?
Neither issuer publishes pass rates on the pages we reviewed, so treat any rate you see online as unofficial.
- CIA difficulty comes from judgment and standards. Many questions ask what an internal auditor should do under a given standard or scenario, and you must pass three separate exams within the program window.
- CISA difficulty comes from breadth and the “what would the auditor do first” style of question. One 150-question exam covers audit method, IT governance, system development, operations, resilience and security.
- Background matters. IT and security professionals often find the CISA content closer to their work. Accounting, finance and operations professionals often find the CIA closer.
Which Fits Which Role?
| Role or goal | Better fit | Why |
| Internal auditor at a corporation, bank or public body | CIA | Built around the internal audit profession and standards |
| Internal audit manager or chief audit executive track | CIA | Part 3 covers running the internal audit function |
| IT auditor or IS auditor | CISA | Content centers on IT controls and assurance |
| Technology risk or IT compliance analyst | CISA, sometimes with CRISC | Controls and assurance focus. See our CISA vs CRISC guide |
| Security professional moving into audit | CISA | Counts security experience toward the requirement |
| Accounting graduate starting in internal audit | CIA | Education and experience tiers fit early-career auditors |
| Internal auditor who audits technology areas | Both over time | CIA for the profession, CISA for IT depth |
| Active CPA who wants an internal audit credential | CIA Challenge route | See our CPA vs CIA guide |
Decision Framework
Choose the CIA if:
- You work in or want to work in internal audit across business, financial and operational areas.
- You aim for audit management or a chief audit executive path.
- You have a bachelor’s degree and 2 years of internal audit experience (or will soon).
- Employers in your market list CIA in internal audit job postings.
Choose the CISA if:
- Your daily work is IT audit, IS audit or IT controls testing.
- You have 5 years of audit, control or security experience, or will soon, or you qualify for a waiver.
- You come from security, IT operations or GRC and want an audit credential.
- Job postings for IT audit in your market list CISA.
Consider both if:
- You are an internal auditor who regularly audits technology, cloud or cybersecurity controls.
- You lead an audit team with both business and IT audit coverage.
Start with neither if:
- You are still deciding between audit and a security career. Our best cybersecurity certifications guide can help you narrow it down.
Can You Hold Both?
Yes. The two credentials do not overlap enough to replace each other, and neither is a prerequisite. A common path is to earn the credential that matches your current role first, then add the other as your responsibilities expand. If you are earlier in your career and unsure, check which credential appears in the postings you want to apply to.
If you want to look at other audit and risk credentials alongside these two, see our guides to CISA vs CISM, CGEIT vs CRISC and the most rewarding IT auditing certifications. For the wider audit and compliance landscape, see our audit and compliance certification exams guide.
Salary and Career Value
Neither issuer publishes a salary figure, and no single number isolates CIA or CISA holders. Pay varies by employer, region, industry and level. Review current job postings in your market and note which credential appears most often for the role you want, which is the most reliable signal.
Study Plan Ideas
These are suggestions, not IIA or ISACA requirements. Adjust for your experience.
CIA (three parts)
- Pick your starting part. Many candidates begin with Part 1 and build up, but you can take the parts in any order.
- Plan one part at a time. Space your exam dates so you finish inside the 3-year window.
- Study the Global Internal Audit Standards. Questions test judgment under the standards, not memorized definitions.
- Practice scenario questions. Ask what an internal auditor should do in the situation described.
- Track experience as you go, since you need it documented for certification.
CISA (one exam)
- Download the current outline from ISACA and rate yourself on each domain.
- Weight your time by domain. Domains 4 and 5 are 26% each.
- Practice “what would the auditor do first” questions in timed sets. 150 questions in 4 hours is about 96 seconds per question.
- Know the controls vocabulary for governance, development lifecycle, operations and security.
- Document your experience early for the application.
Common Mistakes to Avoid
- Choosing by name recognition. Pick by your role. A CIA does not replace a CISA for IT controls work, and a CISA does not replace a CIA for internal audit leadership.
- Assuming the CIA covers IT audit in depth. Check the current syllabus against your goals.
- Missing the CIA program window. Three years go quickly across three exams.
- Assuming passing the CISA makes you certified. You must apply, show experience and pay the application fee within 5 years of passing.
- Ignoring retake rules. CISA allows four attempts in 12 months with 30 and 90 day waits, and you pay the full fee each time.
- Using outdated materials. The CIA syllabus changed in 2025 and the CISA exam updated in 2024. Confirm that your materials match the current version.
- Skipping CPE planning. Both credentials require ongoing reporting.
FAQS
Which is better, CIA or CISA?
Neither is better overall. The CIA fits internal audit careers across business and operations. The CISA fits IT and information systems audit. Pick the one that matches the role you have or want.
Can I get both the CIA and the CISA?
Yes. Neither is a prerequisite for the other, and many internal auditors who audit technology hold both.
Is the CIA or CISA harder?
They are hard in different ways. The CIA has three exams built around the Global Internal Audit Standards and applied judgment. The CISA is one 150-question, 4-hour exam covering a broad set of IT audit topics. Neither issuer publishes pass rates on the pages we reviewed.
How many questions are on the CIA and CISA exams?
The CIA has three parts with 125, 100 and 100 multiple-choice questions. The CISA has 150 multiple-choice questions in 4 hours.
What is the passing score for the CIA and CISA?
CIA: 600 on a scale of 250 to 750 for each part. CISA: 450 on a scale of 200 to 800.
How much does the CIA cost?
For IIA members, USD 990 covers the application and all three parts. Non-members pay USD 1,515. The IIA states that pricing changes starting January 4, 2027, so confirm current fees.
How much does the CISA cost?
The exam is USD 575 for ISACA members and USD 760 for non-members. After you pass, a USD 50 application processing fee applies. Add the annual maintenance fee to keep the certification.
How much experience do I need for the CIA?
One year of internal audit experience with a master’s degree (or equivalent), 2 years with a bachelor’s degree (or equivalent) and 5 years without a degree.
How much experience do I need for the CISA?
5 years of professional information systems auditing, control or security work, gained within the 10 years before you apply. Some secondary sources say up to 3 years can be waived, so confirm the current rules with ISACA.
Can I take the CIA or CISA exam before I have the experience?
Yes for both, with conditions. For the CIA, candidates with a degree or an active IAP designation can sit first, then must meet the experience requirement within the 3-year program window. For the CISA, you have 5 years from the passing date to apply, and you cannot use the designation until you are certified.
Does the CIA cover IT audit?
The 2025 CIA syllabus focuses on internal audit fundamentals, engagement and the audit function. If your goal is IT controls testing, the CISA matches the content more directly. Read the IIA’s current syllabus to see how technology topics are covered.
How do I keep the CIA or CISA active?
CIAs self-attest annually to meeting CPE requirements, including 2 hours of ethics, by December 31. CISA holders earn 20 CPE hours a year and 120 over 3 years, and pay an annual maintenance fee.
Should I take the CIA or the CISA first?
Take the one that matches your current role and experience. If you are in internal audit, start with the CIA. If you are in IT audit, security or technology risk, start with the CISA.
Final Thoughts
The decision comes down to what you audit. If your work is the internal audit profession across the organization, the CIA is the match. If your work is IT systems and controls, the CISA is. Check your experience against each requirement before you register, plan your exam dates around the CIA program window or the CISA retake rules, and confirm current fees and syllabi on the IIA’s official CIA certification page and on ISACA’s site before you start studying, since prices, outlines and policies can change.
