CIA Part 2: Internal Audit Engagement
CIA Part 2 tests how to plan and perform an internal audit engagement. It has 100 multiple-choice questions in 120 minutes. Engagement planning is 50% of the syllabus; evidence gathering, analysis and evaluation is 40%; supervision and communication is 10%.
The decisions you need to make
Read each case for its purpose, actor and evidence. The grid below translates the syllabus into decisions to practise; it is an editorial study aid rather than an official question forecast.
| Area | Ask yourself | Useful output |
|---|---|---|
| Planning | What risk and objective should drive the work? | An objective, scope and suitable criteria |
| Evidence | What evidence answers that objective? | Relevant, reliable and sufficient support |
| Analysis | What does the exception actually show? | A supported finding rather than a premature conclusion |
| Supervision | Can the work and reasoning be reviewed? | Documented procedures, results and review |
Planning
- Ask yourself
- What risk and objective should drive the work?
- Useful output
- An objective, scope and suitable criteria
Evidence
- Ask yourself
- What evidence answers that objective?
- Useful output
- Relevant, reliable and sufficient support
Analysis
- Ask yourself
- What does the exception actually show?
- Useful output
- A supported finding rather than a premature conclusion
Supervision
- Ask yourself
- Can the work and reasoning be reviewed?
- Useful output
- Documented procedures, results and review
Planning turns a business concern into an audit task
The planning domain asks you to connect risk, objective, scope, criteria and procedures. A business concern such as unauthorized payments must become a clear assurance question before the team selects tests. Otherwise, a large volume of completed work can leave the actual concern unanswered.
For a payroll engagement, distinguish testing whether recorded employees are valid from looking for missing payroll liabilities. Those objectives imply different populations and evidence. The process name alone does not tell you which direction to test or which result would support a conclusion.
Evidence must fit the objective and the conclusion
Relevant evidence answers the question being asked. Reliability concerns how much confidence to place in it, given its source and circumstances. Sufficiency concerns whether the support is enough for the conclusion. These considerations work together; quantity cannot repair information that answers the wrong question.
A system extract may be convenient, but its completeness and meaning still need evaluation. A matching invoice number is an analytical exception, not automatic proof of duplicate payment. A zero-exception sample provides evidence without eliminating sampling risk. Watch for conclusions stronger than the work supports.
What to practise for Part 2
Use the syllabus as your inventory and the following exercises as ways to test application. No single sample question establishes mastery of a whole domain.
| Area | Exercise | Evidence of understanding |
|---|---|---|
| Risk to objective | Convert a business risk into an assurance objective before choosing procedures. | Each procedure answers an objective. |
| Criteria and scope | Identify the population, period, locations and benchmark. | Avoid a conclusion about untested areas. |
| Evidence | Contrast direct confirmation, source records and unsupported explanations. | Explain reliability and limitations. |
| Findings | Separate condition, criteria, cause and effect. | Support the consequence rather than inventing it. |
Risk to objective
- Exercise
- Convert a business risk into an assurance objective before choosing procedures.
- Evidence of understanding
- Each procedure answers an objective.
Criteria and scope
- Exercise
- Identify the population, period, locations and benchmark.
- Evidence of understanding
- Avoid a conclusion about untested areas.
Evidence
- Exercise
- Contrast direct confirmation, source records and unsupported explanations.
- Evidence of understanding
- Explain reliability and limitations.
Findings
- Exercise
- Separate condition, criteria, cause and effect.
- Evidence of understanding
- Support the consequence rather than inventing it.
Analysis connects an exception to its significance
When a record differs from a criterion, determine what the difference means. Consider the condition, applicable expectation, cause and consequence rather than jumping directly to a recommendation. If the cause is a system bypass, a reminder email may not address the mechanism that allows the problem.
A useful workpaper lets another informed reviewer follow the objective, population, procedure, evidence and conclusion. Writing more pages does not necessarily improve that trail. Include the facts that support the reasoning and make limitations visible.
Supervision and communication are part of the work
An engagement does not run independently until a report is ready. The team needs appropriate direction, review and communication as it plans and performs procedures. A denied record request or unexpected change in scope can require attention while fieldwork is underway.
In a scenario, identify what the supervisor or stakeholder needs to know now. Do not defer a material limitation simply because the final report has not been drafted. Conversely, an issue in one workpaper does not automatically require bypassing normal engagement supervision.
Use materials for your appointment’s syllabus
This guide uses the 2025 English syllabus. The IIA lists Arabic on the 2019 syllabus through December 27, 2026, and Simplified Chinese transitioning during the December 2026 test window. Confirm the language and location of your appointment before using these weights.
Recognize the Part 2 boundary
The central unit here is one engagement: its objective, evidence, analysis and delivery. Selecting the organization-wide portfolio and managing the audit function as a whole belong to a different level of decision. Similar terms such as “plan” or “communication” must be read in context.
Ask whether the question wants a procedure for an already selected audit or a decision about which audits the function should undertake. That distinction helps prevent a technically sound answer at the wrong level.
Use a complete chain as your orientation check
Choose an inventory risk and write an objective, a suitable criterion, a relevant population, a test and a possible limitation. Explain how the proposed evidence would change your conclusion. If one link is missing, identify the corresponding outcome before beginning random mixed practice.
This overview establishes the scope. Use the Part 2 preparation guide to build and test these chains over time, and the practice page for immediate applications. A short set cannot establish coverage of every planning or evidence outcome.
Original worked case
Turn a procurement risk into a test
The risk is that fictitious suppliers receive payments. The proposed procedure is to check whether purchase-order forms use the correct logo.
Reveal the decision and reasoning
Set an objective around valid supplier setup and authorized payment. Evaluate supplier creation controls and test approval evidence against suitable criteria.
The logo check does not address the stated risk. A visually tidy workpaper cannot compensate for a procedure disconnected from the objective.
An editorial teaching example, not an official IIA question or a prediction of exam content.
Common questions
- How long is CIA Part 2?
- The exam has 100 multiple-choice questions in 120 minutes, averaging 72 seconds per question.
- What should I use this Part 2 guide for?
- Use it to understand the scope and the decisions being tested. Continue to the preparation plan for a study sequence or the practice page to answer questions.
Sources and editorial notes
Official exam facts and provider package descriptions are supported by the references below. Study schedules, scenarios and fit judgments are our editorial work. They do not establish a required study duration, a pass probability or comparative learning outcomes.
- The IIA: Part 2 expanded syllabus
- Expanded test specifications, sections A onward.
- Current part-specific expanded test specifications.
- The IIA: CIA eligibility and language transitions
- Language-transition notes.
MiloPrep is independent and is not affiliated with or endorsed by The IIA or the providers discussed. Product comparisons describe our own offering alongside provider information. Names and marks belong to their owners.
Notes
- * Part 2 domain weights: Each bar uses the same 0-100% scale. The domains within one part total 100%; these are not guaranteed question counts. ↩ Return to content