Find your CIA topic. Understand the decision.
Choose Part 1 for audit fundamentals, ethics, controls, and fraud; Part 2 for planning and performing an engagement; or Part 3 for managing the function and following up results. Search 45 lessons with comparison tables, worked cases, and original practice questions.
Part 1
Internal Audit Fundamentals
- Foundations of Internal Auditing35%
- Ethics and Professionalism20%
- Governance, Risk Management, and Control30%
- Fraud Risks15%
Part 2
Internal Audit Engagement
- Engagement Planning50%
- Information Gathering, Analysis, and Evaluation40%
- Engagement Supervision and Communication10%
Part 3
Internal Audit Function
- Internal Audit Operations25%
- Internal Audit Plan15%
- Quality of the Internal Audit Function15%
- Engagement Results and Monitoring45%
Percentages show each domain’s share of its exam part. Individual lessons have no separately published weight.
Choose the lesson for the decision you need to make
Start with a domain overview when you need the larger process, a focused lesson when two concepts are easy to confuse, or a practice drill when you want to apply the method. Each lesson gives you a direct answer, a comparison table, four or five teaching sections, two worked cases, and explanations for every practice choice.
Part 1: roles, judgment, and controls
Work out who has authority, which professional duty applies, and what a control can prevent or detect. Begin with the foundations, then narrow the question to service type, objectivity, risk, or fraud.
Start with audit foundationsPart 2: one engagement, from plan to evidence
Connect the objective to scope, criteria, resources, and procedures. Follow the planning case, then study the evidence technique or reporting decision that your question requires.
Work through the planning casePart 3: the function and its assurance coverage
Consider decisions across engagements: which risks receive coverage, what capability the team needs, how quality is assessed, and whether management’s actions address findings.
Build a risk-based audit planFind the concept you need
45 of 45 lessons shown
Part 1 / Internal Audit Fundamentals
Free Part 1 PDFTopic overviews
- Foundations of internal auditing: purpose, authority, and servicesInternal audit helps an organization understand whether its governance, risk management, and controls support its objectives.Read the lesson
- CIA ethics and professionalism: five duties in practiceEthical audit work requires honesty, unbiased judgment, suitable competence, due care, and responsible handling of information.Read the lesson
- CIA risk and control case: distinguish design from operationA written approval policy establishes the expected control, not proof that it worked.Read the lesson
- Fraud risks: schemes, controls, and the auditor’s roleFraud risk concerns intentional deception, such as fictitious suppliers or manipulated results.Read the lesson
Focused lessons
- Assurance vs consulting: how to tell the engagements apartAssurance evaluates evidence to reach a conclusion.Read the lesson
- IIA Standards scenarios: separate access, bias, and evidenceStart with the actor and the decision, then locate the relevant Standard.Read the lesson
- Independence vs objectivity: threats and safeguardsIndependence concerns the internal audit function’s freedom from interference; objectivity concerns the auditor’s unbiased judgment.Read the lesson
- Governance roles and the Three Lines ModelThe governing body oversees the organization.Read the lesson
- Integrate enterprise risk management and internal controlsUse the business objective to connect enterprise risk management with internal controls.Read the lesson
- Fraud red flags: decide what to verify and escalateA fraud indicator is an anomaly that needs context and corroboration.Read the lesson
- CIA Code of Ethics cases under the current StandardsFor current CIA preparation, apply ethical cases through the Ethics and Professionalism domain of the Global Internal Audit Standards.Read the lesson
- Preventive vs detective controls, with practical examplesA preventive control acts before the unwanted event; a detective control identifies an event or exception that has occurred.Read the lesson
- Organizational independence: reporting lines that workOrganizational independence requires an audit function that can set appropriate scope, obtain information, and communicate results without improper interference.Read the lesson
- Risk appetite vs risk tolerance: read the decision correctlyRisk appetite expresses the types and amount of risk an organization is willing to pursue or retain.Read the lesson
Part 2 / Internal Audit Engagement
Free Part 2 PDFTopic overviews
- CIA engagement planning case: build a defensible work programFor a supplier-bank-change audit, start from changes that actually became active and trace each to independent approval before activation.Read the lesson
- Audit evidence: gather, analyze, and evaluateUseful audit evidence must address the objective, be dependable enough for its purpose, and support the conclusion with adequate coverage.Read the lesson
- Engagement supervision and communication throughout an auditSupervision starts before fieldwork and continues through conclusions.Read the lesson
Focused lessons
- Risk-based audit scoping: choose boundaries that answer the objectiveA risk-based scope selects the processes, systems, locations, and period needed to answer the audit objective.Read the lesson
- Audit objectives vs evaluation criteria: write both clearlyAn objective states what the engagement must determine.Read the lesson
- Audit sampling and evidence: what your sample can supportDefine the population and audit objective before selecting a sample.Read the lesson
- Analytical procedures: investigate a trend before concludingAn analytical procedure compares an observed result with a defensible expectation, then investigates meaningful differences.Read the lesson
- Audit interviews and walkthroughs: turn descriptions into evidenceAn interview explains how people say a process works.Read the lesson
- Audit workpaper quality: make the conclusion reproducibleA good workpaper lets a competent reviewer understand what was tested, from which population, against what criterion, with which result, and why the conclusion follows.Read the lesson
- Draft an audit finding: criterion, condition, cause, and actionA useful draft finding explains the expected condition, the observed deviation, why it matters, and a response that addresses the cause.Read the lesson
- Document an audit scope limitation without overstating assuranceA scope limitation prevents the work needed for the engagement objective.Read the lesson
- Budget resources for an audit engagementBudget an engagement from the work and expertise its objectives require.Read the lesson
- Choose evaluation criteria for culture and soft controlsFor soft controls such as ethical culture, define observable behaviors and a defensible benchmark before evaluating results.Read the lesson
Practice drills
- Audit review notes drill: repair the evidence, not just the wordingResolve a review note by identifying the gap and changing the work, evidence, or conclusion that created it.Try the cases
- CIA Part 2 planning practice: five timed cases with explanationsPractise five CIA Part 2 decisions about scope, criteria, and resources.Try the cases
Part 3 / Internal Audit Function
Free Part 3 PDFTopic overviews
- CIA audit operations case: expose a hidden coverage gapA 100% completion dashboard can still hide a significant assurance gap.Read the lesson
- Build and update a risk-based internal audit planA risk-based internal audit plan selects engagements from the organization’s objectives, risk assessment, assurance needs, and available resources.Read the lesson
- Internal audit quality: assessments, improvement, and performanceQuality asks whether internal audit conforms to applicable requirements and delivers effective work.Read the lesson
- Audit results and monitoring: from final report to verified actionAn audit is not finished merely because the report is issued.Read the lesson
Focused lessons
- Internal audit strategy: inputs that shape long-term directionInternal audit strategy sets the function’s direction and capabilities in relation to the organization’s strategy, risk environment, and stakeholder expectations.Read the lesson
- QAIP design: internal checks, external assessment, and reportingA quality assurance and improvement program combines ongoing monitoring, periodic internal assessment, external assessment, and improvement action.Read the lesson
- Design an audit action tracker that supports real follow-upAn audit monitoring system should connect each finding to a responsible owner, agreed action, due date, evidence, and verified status.Read the lesson
- What belongs in an internal audit board reporting pack?A board pack should help the governing body understand assurance coverage, significant results, unresolved exposure, and decisions needing its attention.Read the lesson
- Manage internal audit resources across the functionManage resources by comparing the function’s commitments with its available capacity, skill mix, funding, and technology.Read the lesson
- Coordinate assurance and decide when to rely on other workCoordination reduces gaps and unnecessary duplication, but reliance requires an assessment of the provider and the actual work.Read the lesson
- Internal audit performance metrics: balance activity and qualityUseful audit metrics connect activity with coverage, quality, and outcomes.Read the lesson
- Audit issue aging and risk escalationUse issue aging together with severity, current exposure, and management’s response.Read the lesson
- Update internal audit methodology when the work changesUpdate audit policies and procedures when professional requirements, organizational risks, technology, or quality findings make the old method unsuitable.Read the lesson
- Maintain an assurance map: reveal gaps and avoid false coverageAn assurance map connects significant risks with who examines them, what was covered, when, and with what limitations.Read the lesson
Turn a correct answer into a method you can reuse
Read the answer and table first, then use the teaching sections to understand why the distinctions matter. In each worked case, identify the objective, decision owner, and evidence before reading the analysis. Try the questions and explain why the alternatives fail. Standard lessons contain three questions; the four practice drills contain five each.
Use the linked lessons to repair a specific gap. For example, confusing a benchmark with a procedure points to objectives and criteria; mistaking a revised deadline for completed remediation points to results monitoring. The free PDFs offer mixed practice for each part, so they complement the topic lessons rather than duplicate a single article. You can request them by email above or below.
Sources and syllabus scope
The IIA syllabus establishes the exam topics. Each lesson’s source disclosure contains its syllabus and Standards references. Explanations, diagrams, numerical illustrations, and questions are independent teaching material and are not official exam questions or a complete replacement for the curriculum.
Official domain allocations from the current IIA syllabus links, checked 2026-10-10.