Skip to main content
CIA · Guide

CIA Part 1: Internal Audit Fundamentals

CIA Part 1 tests the foundations of internal auditing: its purpose, ethics, governance, risk, controls and fraud. It has 125 multiple-choice questions in 150 minutes. The main skill is choosing a defensible action while keeping board, management and auditor responsibilities separate.

By MiloPrep editorial team

Part 1 domain weights*
Foundations of Internal Auditing35%
Ethics and Professionalism20%
Governance, Risk Management, and Control30%
Fraud Risks15%

The decisions you need to make

Read each case for its purpose, actor and evidence. The grid below translates the syllabus into decisions to practise; it is an editorial study aid rather than an official question forecast.

From syllabus to judgment

  • Independence

    Ask yourself
    Can audit report and work without interference?
    Useful output
    Board access and an appropriate reporting structure

  • Objectivity

    Ask yourself
    Is this individual’s judgment impaired?
    Useful output
    Disclose conflicts and evaluate safeguards

  • Risk and controls

    Ask yourself
    Who owns the risk, and what does the control do?
    Useful output
    Management owns operations; audit evaluates

  • Fraud

    Ask yourself
    What does the indicator justify?
    Useful output
    Investigate and escalate supported concerns; do not assume guilt

Foundations asks whether the role is appropriate

Part 1 begins with why internal audit exists and how it can perform its responsibilities credibly. Distinguish the function’s authority and organizational position from an individual auditor’s judgment. Direct board access helps the function, but it does not automatically remove an individual’s conflict of interest.

Consider a team with an appropriate reporting line whose assigned auditor recently managed the process under review. The organization-level arrangement may be sound while the assignment still needs an objectivity assessment. A strong answer identifies the specific concern rather than using “independence” as an undifferentiated label.

Ethics is applied through choices under pressure

A scenario may ask what to do when a manager wants a finding softened, a colleague asks for sensitive information, or familiarity creates bias. The task is to connect professional conduct to the facts and the required response. Reciting a principle without addressing the situation leaves the decision unresolved.

Separate a claim from its support. A senior manager’s confident assurance is information to evaluate, not automatic proof. At the same time, skepticism does not mean assuming wrongdoing. Seek a supported conclusion while respecting the relevant responsibilities and confidentiality.

What to practise for Part 1

Use the syllabus as your inventory and the following exercises as ways to test application. No single sample question establishes mastery of a whole domain.

Targeted practice tasks

  • Foundations

    Exercise
    Contrast assurance and advisory requests; identify the mandate and reporting lines.
    Evidence of understanding
    Explain why audit should not own the process.

  • Ethics

    Exercise
    Change a gift, prior role or reporting pressure in a case.
    Evidence of understanding
    Identify the impairment before choosing the safeguard.

  • Governance and control

    Exercise
    Classify risk before and after controls; distinguish design from operation.
    Evidence of understanding
    Choose a control that addresses the named risk.

  • Fraud

    Exercise
    Separate a red flag, corroborating evidence and a conclusion.
    Evidence of understanding
    Choose an appropriate response without overstating certainty.

Risk and control questions test a chain of reasoning

Start with the objective and the event that threatens it. Identify the control’s mechanism, then consider whether it is appropriately designed and whether it operates. A policy that requires approval and records showing that approval actually occurred answer different questions.

If the risk is payment to fictitious suppliers, checking the spelling of supplier names may not address it. Ask what the control prevents or detects and what exposure remains. This reasoning is more useful than classifying every control from its label alone.

Fraud indicators require proportionate conclusions

An employee who can create suppliers and release payments has an opportunity to misuse the process. That concern justifies attention to incompatible duties and supporting evidence; it does not prove that every payment is fraudulent. Avoid options that jump from risk to certainty without an evidential step.

Use contrasting examples: an unusual transaction with a documented legitimate purpose, and a similar transaction with unresolved support. Explain what each establishes and what remains uncertain. This keeps risk recognition distinct from an allegation about a particular person.

Use materials for your appointment’s syllabus

This guide uses the 2025 English syllabus. The IIA lists Arabic on the 2019 syllabus through December 27, 2026, and Simplified Chinese transitioning during the December 2026 test window. Confirm the language and location of your appointment before using these weights.

What this overview should help you decide

Use the domain chart to understand the part’s scope and the explanations here to recognize its recurring decisions. If these distinctions are new, begin with instruction and untimed applications. If they are familiar, test them with changed facts before assuming that work experience covers every outcome.

The preparation guide supplies a sequence of drills and readiness checks; the practice page supplies questions you can answer immediately. Keep those activities connected to the official outline. Neither this overview nor a ten-question sample is the complete curriculum.

A self-check before moving on

Explain the difference between management implementing a supplier approval control and audit evaluating it. Then explain why independent reporting does not eliminate a particular auditor’s self-review concern. Finally, describe a fraud indicator without claiming it proves fraud.

If an answer depends on memorized wording, change the process from purchasing to payroll. The same principles should remain usable while the facts and evidence change. That transfer is the bridge from knowing Part 1 vocabulary to making defensible Part 1 decisions.

Original worked case

An auditor reviews a process they designed

An auditor designed a purchasing approval process six months ago. The audit manager assigns that auditor to provide assurance on the same process because they know it best.

Reveal the decision and reasoning

Identify and disclose the self-review threat, then arrange appropriate independent assurance staffing or oversight rather than relying on familiarity as a safeguard.

Knowing the process may improve technical understanding, but it does not remove the risk of evaluating one’s own work. The actor and prior responsibility matter.

An editorial teaching example, not an official IIA question or a prediction of exam content.

Common questions

How long is CIA Part 1?
The exam has 125 multiple-choice questions in 150 minutes, averaging 72 seconds per question.
What should I use this Part 1 guide for?
Use it to understand the scope and the decisions being tested. Continue to the preparation plan for a study sequence or the practice page to answer questions.

Sources and editorial notes

Official exam facts and provider package descriptions are supported by the references below. Study schedules, scenarios and fit judgments are our editorial work. They do not establish a required study duration, a pass probability or comparative learning outcomes.

MiloPrep is independent and is not affiliated with or endorsed by The IIA or the providers discussed. Product comparisons describe our own offering alongside provider information. Names and marks belong to their owners.

Notes

  • * Part 1 domain weights: Each bar uses the same 0-100% scale. The domains within one part total 100%; these are not guaranteed question counts. ↩ Return to content