IIA Certified Internal Auditor (CIA), Parts 1–3 flashcards
9 decks · 614 cards · built into Willys · free samples below
Written against: IIA CIA exam syllabus effective 2025, aligned with the Global Internal Audit Standards (2024). Updated 2026-10-10.
What's in it
Every deck follows the course outline, with tags you can study or suspend topic by topic. Open a deck to study its free sample right here.
Learn · 6 decks · 434 cards
Concepts, mechanisms and the questions a course or exam asks about them.
Foundations, Ethics and Governance
Purpose and mandate of internal auditing, the 2024 Standards framework, assurance vs advisory work, the charter, independence and objectivity, the five ethics Principles, the board's role and the Three Lines Model.
Governance, Risk, Control and Quality
COSO internal control components and principles, COSO ERM concepts and risk responses, control types, fraud schemes and red flags, fraud response, and the quality assurance and improvement program with conformance statements.
Engagement Planning and Performance
Risk-based audit planning, engagement risk assessment, objectives, scope and criteria, work programs, evidence quality, statistical and nonstatistical sampling, analytical procedures, audit software techniques, workpapers and supervision.
Communicating Results and Monitoring
Finding elements, communication quality, final and interim communications, overall conclusions, errors and risk acceptance escalation, follow-up, plus managing internal audit: strategy, plan changes, resources, coordination, board reporting and KPIs.
Business Acumen and Risk
Topics from the 2019 CIA Part 3 syllabus, mostly Business Acumen, that the 2025 syllabus tests mainly in Part 2: objectives and performance measures, motivation and culture, structures, procurement, sales, HR and supply chain risks, contract types, analytics, change, outsourcing and continuity.
Information Security, IT and Financial Management
Information security, IT general and application controls, SDLC and change control, cloud and IT governance frameworks, and financial and managerial accounting from the 2019 CIA Part 3 syllabus; the 2025 syllabus tests the security, IT control and financial accounting topics mainly in Part 2.
Practice · 3 decks · 180 questions
Multiple-choice practice questions, one best answer each, with the reasoning.
Practice Questions, Part 1
Multiple-choice practice questions, one best answer each, on the mandate and charter, independence, ethics, governance and the Three Lines Model, COSO control and ERM, fraud and quality assessment.
Practice Questions, Part 2
Multiple-choice practice questions, one best answer each, on risk-based audit planning, engagement objectives and scope, evidence, sampling, analytics, workpapers, findings, reporting and follow-up.
Practice Questions, Part 3
Multiple-choice practice questions, one best answer each, on business acumen, organizational behaviour, third parties, information security, IT controls and financial and managerial accounting from the 2019 CIA Part 3 syllabus; the 2025 syllabus tests most of these topics in Part 2.
Study guide
Topics covered
The decks follow the order of the course outline. Numbers are cards per topic.
- Foundations of Internal Auditing 54
- Purpose and Mandate 10
- Standards Framework 13
- Assurance and Advisory Services 10
- Internal Audit Charter 7
- Independence and Positioning 14
- Ethics and Professionalism 40
- Integrity 9
- Objectivity 12
- Competency 6
- Due Professional Care 7
- Confidentiality 6
- Governance Risk Management and Control 63
- Governance and the Board 7
- Three Lines Model 11
- COSO Internal Control 18
- Enterprise Risk Management 14
- Control Types 13
- Fraud Risks 32
- Fraud Concepts and Schemes 15
- Red Flags 8
- Fraud Response 9
- Quality and Conformance 19
- Internal Assessments 6
- External Assessments 7
- Conformance and Disclosure 6
- Managing the Internal Audit Function 42
- Risk-Based Internal Audit Plan 14
- Strategy and Methodologies 4
- Resources 8
- Coordination and Reliance 8
- Reporting to the Board 4
- Performance Measurement 4
- Engagement Planning 31
- Engagement Risk Assessment 10
- Objectives and Scope 9
- Evaluation Criteria 6
- Work Program and Resources 6
- Performing the Engagement 58
- Evidence 12
- Sampling 20
- Analytical Procedures and Data Analytics 12
- Documentation and Supervision 14
- Communicating Engagement Results 51
- Findings 16
- Communication Quality 11
- Final Communications 12
- Overall Conclusions 5
- Errors and Risk Acceptance 7
- Monitoring Progress 11
- Follow-Up 11
- Business Acumen 101
- Organizational Objectives 11
- Organizational Behaviour 13
- Organizational Structure 8
- Business Processes 18
- Contract Types 11
- Data Analytics 15
- Change Management 7
- Outsourcing and Third Parties 11
- Business Continuity 7
- Information Security 35
- Security Principles 8
- Access Controls 10
- Encryption 9
- Cyber Threats 8
- Information Technology 37
- IT General Controls 9
- Application Controls 10
- SDLC and Change Control 11
- Cloud and IT Governance 7
- Financial Management 40
- Financial Accounting 10
- Ratio Analysis 8
- Managerial Accounting 12
- Budgeting and Transfer Pricing 10
A study plan
- 22 new cards a day covers everything in a month, leaving the last weeks for review.
- 11 new cards a day covers everything in two months, leaving the last weeks for review.
- 8 new cards a day covers everything in three months, leaving the last weeks for review.
Willys schedules reviews for you (FSRS spaced repetition), so the daily number above is only for new cards; reviews of what you have learned come back on their own. Study a topic's cards right after you meet it in class, suspend topics you have not reached yet, and use the app's quiz mode in the final two weeks.
How to get these decks
- Install Willys on your iPhone, iPad or Mac — App Store. 14-day free trial, then $14.99 a year.
- In Willys, tap Exam Library at the top of your Decks (or Browse Exam Library… under the + button), find the exam on its shelf or by search, tick it and tap Add.
- Study. The exam comes in as its own collapsible folder, every card scheduled by FSRS spaced repetition. Nothing you already have is changed.
Every deck is built into Willys
All 9 IIA Certified Internal Auditor (CIA), Parts 1–3 decks (614 cards), with FSRS spaced repetition, quizzes and mock tests, on iPhone, iPad and Mac. 14-day free trial, then $14.99 a year.
In Willys, tap Exam Library at the top of your Decks (or Browse Exam Library… under the + button), find the exam on its shelf or by search, tick it and tap Add.
About these cards
Review status: Second-reader reviewed, with corrections applied.
Checked against:
- IIA CIA exam syllabus (2025) and Global Internal Audit Standards (2024) — topic outline only; no text copied
- IIA Topical Requirements overview and FAQs (theiia.org, checked 2026-10-13)
- IIA CIA Exam Expanded Test Specifications, 2025 syllabus (V2.09.2024): Part 1, Internal Audit Fundamentals, Sections C and D; the quality and conformance cards cover Part 3, Section C, Quality of the Internal Audit Function — topic outline only; no text copied
- IIA Global Internal Audit Standards (issued 9 January 2024, effective 9 January 2025), including the Glossary, theiia.org, checked 2026-10-13 — no text copied
- ACFE, Occupational Fraud 2026: A Report to the Nations (acfe.com), checked 2026-10-13 — findings summarized in original words; no text copied
- IIA CIA Exam Expanded Test Specifications, 2025 syllabus (V2.09.2024): Part 1, Internal Audit Fundamentals, Sections A-D; the quality, conformance and Topical Requirements cards cover Part 3, Section C, Quality of the Internal Audit Function — topic outline only; no text copied
- IIA Global Internal Audit Standards (issued 9 January 2024, effective 9 January 2025) and IIA Topical Requirements page (theiia.org), checked 2026-10-13 — no text copied
- IIA CIA Exam Expanded Test Specifications, 2025 syllabus (V2.09.2024): most topics fall under Part 3 Internal Audit Function, Sections A (Internal Audit Operations), B.2-B.3 (audit plan, coordination and reliance), C.3 (performance indicators) and D (Engagement Results and Monitoring); finding elements and engagement communication follow Part 2 Sections B.6, B.8 and C.2. IIA Global Internal Audit Standards (issued January 2024, effective 9 January 2025), Domains III-V — topic outline only; no text copied
- IIA CIA Exam Expanded Test Specifications, 2025 syllabus (V2.09.2024): engagement planning, evidence, sampling, analytics, workpapers, findings and supervision follow Part 2, Internal Audit Engagement, Sections A-C; the audit plan, resources, coordination and reliance, board reporting and performance cards follow Part 3, Sections A-C, and the final communication, error, risk acceptance and follow-up cards follow Part 3, Section D, Engagement Results and Monitoring. IIA Global Internal Audit Standards (issued January 2024, effective 9 January 2025) — topic outline only; no text copied
- IIA 2019 CIA exam syllabus, Part 3 Business Knowledge for Internal Auditing, Domain I Business Acumen (I.1-I.3) and III.3 Disaster Recovery (theiia.org, checked 2026-10-13); in the 2025 syllabus, IIA CIA Exam Expanded Test Specifications (V2.09.2024), these topics fall mainly under Part 2, Internal Audit Engagement, Sections A.3 (objectives and performance measures, business continuity, business processes and third parties), A.5 (change, organizational structure, culture) and B.3-B.5 (technology, data analytics, analytical review), with culture also in Part 1, Section C.2; contract types and motivation theories have no named 2025 item. IIA Global Internal Audit Standards (issued 9 January 2024, effective 9 January 2025) — topic outline only; no text copied
- Federal Acquisition Regulation 16.102(c), acquisition.gov (FAC 2026-01, effective 13 March 2026), checked 2026-10-13 — no text copied
- IIA 2019 CIA exam syllabus, Part 3 Business Knowledge for Internal Auditing, Domains II Information Security, III Information Technology (III.1-III.2) and IV Financial Management (theiia.org, checked 2026-10-13); in the 2025 syllabus, IIA CIA Exam Expanded Test Specifications (V2.09.2024), these topics fall mainly under Part 2, Internal Audit Engagement, Sections A.3 (cybersecurity and information security risks, IT general controls and IT control frameworks, data privacy, finance and accounting concepts, ERP systems and inventory) and B.5 (ratio and trend analysis), with IT security audits and system development work also in Part 1, Sections A.5-A.6; cost behaviour, costing systems, budgeting and transfer pricing have no named 2025 item. IIA Global Internal Audit Standards (issued 9 January 2024, effective 9 January 2025) — topic outline only; no text copied
- IIA 2019 CIA exam syllabus, Part 3 Business Knowledge for Internal Auditing, Domains I Business Acumen, II Information Security, III Information Technology and IV Financial Management (theiia.org, checked 2026-10-13); in the 2025 syllabus, IIA CIA Exam Expanded Test Specifications (V2.09.2024), these topics fall mainly under Part 2, Internal Audit Engagement, Sections A.3 (objectives and performance measures, cybersecurity and information security risks, IT general controls, business continuity, finance and accounting concepts, business processes and third parties), A.5 (change, organizational structure, culture), B.4 (data analytics) and B.5 (ratio and trend analysis), with fraud schemes and segregation of duties also in Part 1, Section D; contract types, motivation theories, cost-volume-profit and costing systems, and transfer pricing have no named 2025 item. IIA Global Internal Audit Standards (issued 9 January 2024, effective 9 January 2025) — topic outline only; no text copied
- NIST SP 800-63B-4, Digital Identity Guidelines: Authentication and Authenticator Management (August 2025), Sec. 3.1.1.2, password verifiers (pages.nist.gov), checked 2026-10-13 — no text copied
These are independent study notes written for Willys. They are not official exam material, may contain mistakes, and are no substitute for your course, your teacher or the exam owner's own publications. Found an error? Tell us — corrections ship as a new version of the deck.
Not financial, tax or legal advice. These cards prepare you for an exam; rules and figures change, so check current standards before relying on any of it.
CIA® and Certified Internal Auditor® are registered trademarks of The Institute of Internal Auditors, Inc. (The IIA), which is not affiliated with and does not endorse this product.
Use of these pages is covered by our Terms of Use.