CIA Part 3: Internal Audit Function
CIA Part 3 tests how the internal audit function operates, plans, maintains quality and follows up results. It has 100 multiple-choice questions in 120 minutes. Engagement results and monitoring account for 45%, the largest domain. This is the current Internal Audit Function syllabus, not the old Business Knowledge title.
The decisions you need to make
Read each case for its purpose, actor and evidence. The grid below translates the syllabus into decisions to practise; it is an editorial study aid rather than an official question forecast.
| Area | Ask yourself | Useful output |
|---|---|---|
| Operations | How should the function deploy people and methods? | Resources and methodologies suited to its mandate |
| Audit plan | Which engagements address the organization’s risks? | A risk-based portfolio that adapts to change |
| Quality | How do we know the function works well? | Internal assessment and independent external assessment |
| Results and monitoring | Has management implemented an effective action? | Evidence of correction and escalation when needed |
Operations
- Ask yourself
- How should the function deploy people and methods?
- Useful output
- Resources and methodologies suited to its mandate
Audit plan
- Ask yourself
- Which engagements address the organization’s risks?
- Useful output
- A risk-based portfolio that adapts to change
Quality
- Ask yourself
- How do we know the function works well?
- Useful output
- Internal assessment and independent external assessment
Results and monitoring
- Ask yourself
- Has management implemented an effective action?
- Useful output
- Evidence of correction and escalation when needed
Operations concerns the function’s ability to deliver
Part 3 includes the methods, strategy, resources and communication that make the audit function workable. A plan can contain the right engagements yet be infeasible because the team lacks time, technology or expertise. The response should make the gap and its implications visible.
For example, adding a complex systems audit without suitable skills is not solved by copying a longer checklist. Consider qualified support, changes to scope or priorities, and communication with the appropriate oversight parties. The decision concerns capability as well as capacity.
The audit plan connects coverage to organizational risk
A portfolio plan chooses where audit attention should go. It considers the organization’s objectives, changing risks and other assurance work. An engagement work program then defines the procedures for a selected assignment. Confusing these documents leads to answers that operate at the wrong level.
A major acquisition can justify reassessing the portfolio even when the original plan was approved. Reassessment does not mean automatically canceling all existing work. It means considering the changed risk picture and following the appropriate process for the resulting priorities.
What to practise for Part 3
Use the syllabus as your inventory and the following exercises as ways to test application. No single sample question establishes mastery of a whole domain.
| Area | Exercise | Evidence of understanding |
|---|---|---|
| Function resources | Match skills and capacity to the audit plan; identify constraints. | Explain the consequence of an unfilled skill gap. |
| Audit plan | Respond to a new acquisition, system or strategic risk. | Revise priorities rather than preserve a stale calendar. |
| Quality | Distinguish engagement supervision, internal assessment and external assessment. | Choose the level of review the problem requires. |
| Results and follow-up | Compare promises, completion records and operating evidence. | Close actions only on support appropriate to the risk. |
Function resources
- Exercise
- Match skills and capacity to the audit plan; identify constraints.
- Evidence of understanding
- Explain the consequence of an unfilled skill gap.
Audit plan
- Exercise
- Respond to a new acquisition, system or strategic risk.
- Evidence of understanding
- Revise priorities rather than preserve a stale calendar.
Quality
- Exercise
- Distinguish engagement supervision, internal assessment and external assessment.
- Evidence of understanding
- Choose the level of review the problem requires.
Results and follow-up
- Exercise
- Compare promises, completion records and operating evidence.
- Evidence of understanding
- Close actions only on support appropriate to the risk.
Quality concerns more than meeting deadlines
A function that issues reports on time may still produce weakly supported conclusions or overlook important risks. Consider the quality program, supervision, assessment and improvement alongside output measures. A single efficiency metric cannot describe the function’s effectiveness.
If factual corrections recur after reports are issued, inspect the validation and review process rather than merely shortening the reports. The useful response targets the mechanism of the failure and checks whether the improvement works.
Results and monitoring extend beyond publishing the report
A finding should communicate the issue and its significance clearly enough to support an appropriate response. Management owns the operational action. Internal audit follows up and evaluates the available evidence, communicating unresolved concerns through the relevant process.
A revised policy shows that instructions changed. It does not automatically establish that the new control operates. Keep planned, implemented and verified states distinct. Likewise, closing a long-outstanding action because its due date passed does not resolve the risk.
Use materials for your appointment’s syllabus
This guide uses the 2025 English syllabus. The IIA lists Arabic on the 2019 syllabus through December 27, 2026, and Simplified Chinese transitioning during the December 2026 test window. Confirm the language and location of your appointment before using these weights.
Why an older Part 3 book needs reconciliation
The current function-centered outline should drive coverage. Background in business, technology and accounting remains useful when it informs audit decisions, but a collection of technical definitions does not establish preparation for portfolio planning, quality or monitoring.
Match each current outcome to instruction and application in the materials you own. Use the syllabus-changes guide to reconcile old notes rather than assuming a matching part number means a matching curriculum.
Explain the whole function-level decision
Try this orientation exercise: an acquired business creates a new risk, the team lacks expertise, and a related finding remains unresolved. Explain how the portfolio, resources and monitoring response may need to change. Keep management’s corrective responsibility distinct from audit’s assessment.
The preparation guide turns these decisions into a study sequence. The function concept page connects the operating records in a longer case. Use the overview as a map of what belongs in Part 3, not as a substitute for those applications.
Original worked case
A policy update is not proof of an effective fix
Management reports that an access-control finding is closed because it published a new quarterly-review policy. No review has yet taken place.
Reveal the decision and reasoning
Record the policy change, then seek evidence that the review has been implemented and operates as intended before concluding that the risk is addressed.
Design, implementation and operating effectiveness are different claims. Follow-up should match the finding and the evidence available.
An editorial teaching example, not an official IIA question or a prediction of exam content.
Common questions
- How long is CIA Part 3?
- The exam has 100 multiple-choice questions in 120 minutes, averaging 72 seconds per question.
- What should I use this Part 3 guide for?
- Use it to understand the scope and the decisions being tested. Continue to the preparation plan for a study sequence or the practice page to answer questions.
Sources and editorial notes
Official exam facts and provider package descriptions are supported by the references below. Study schedules, scenarios and fit judgments are our editorial work. They do not establish a required study duration, a pass probability or comparative learning outcomes.
- The IIA: Part 3 expanded syllabus
- Expanded test specifications, sections A onward.
- Current part-specific expanded test specifications.
- The IIA: CIA eligibility and language transitions
- Language-transition notes.
MiloPrep is independent and is not affiliated with or endorsed by The IIA or the providers discussed. Product comparisons describe our own offering alongside provider information. Names and marks belong to their owners.
Notes
- * Part 3 domain weights: Each bar uses the same 0-100% scale. The domains within one part total 100%; these are not guaranteed question counts. ↩ Return to content