CIA Part 3 study plan
CIA Part 3 · Give each week a clear focus.
8 weeks · About 8 hours per week
Business Acumen (organizational objectives, behavior, and performance; business processes; managerial and financial accounting concepts)
Diagram the chain from mission and vision through strategic objectives to operational goals and individual performance targets
Compare functional, divisional, matrix, and network structures and predict the coordination or authority problems each creates
Explain how organizational culture, group dynamics, and span of control affect individual and team performance
Match motivation and leadership theories to concrete workplace scenarios and justify the best fit
Compute and interpret basic productivity, turnover, and efficiency measures from supplied data
Your checkpoint
One-page concept map of organizational alignment plus 40 original practice questions answered at 80% or better, with every miss logged by topic
Business Acumen (organizational objectives, behavior, and performance; business processes; managerial and financial accounting concepts)
Trace procure-to-pay and order-to-cash cycles and identify control points and segregation-of-duties conflicts at each step
Differentiate job-order, process, and activity-based costing and compute unit cost under each method
Classify costs as fixed, variable, mixed, direct, indirect, product, or period in given fact patterns
Prepare a contribution-margin income statement and compute break-even point and margin of safety
Build a flexible budget and explain materials, labor, and overhead variances
Your checkpoint
Costing workbook containing three fully worked problems (ABC allocation, CVP analysis, variance analysis) plus 50 practice questions with an error log
Business Acumen (organizational objectives, behavior, and performance; business processes; managerial and financial accounting concepts) & Information Security (security frameworks, controls, and threats to information assets)
Explain how the income statement, balance sheet, and statement of cash flows articulate, and derive a cash flow statement from two balance sheets
Compute liquidity, solvency, and profitability ratios from sample statements and interpret the trend
Describe budgeting, forecasting, and transfer-pricing concepts and their behavioral effects
Define confidentiality, integrity, and availability and state which element each given control protects
Compare the structure of three recognized security frameworks and map their components to governance activities
Your checkpoint
Domain 1 comprehensive quiz scored at 80% or higher plus a one-page comparison table of three security frameworks
Information Security (security frameworks, controls, and threats to information assets)
Classify controls as preventive, detective, or corrective and place each in the logical, physical, or administrative layer
Design access-control logic covering authentication factors, least privilege, segregation of duties, and privileged access management
Distinguish symmetric and asymmetric encryption, hashing, PKI, and digital signatures, and select the right tool for a given scenario
Describe firewall, IDS/IPS, DMZ, VPN, and network segmentation roles in defending information assets
Outline incident-response phases and explain RTO, RPO, and backup types in continuity planning
Your checkpoint
Timed 60-question mock covering Domains 1 and 2, scored at 75% or higher, with a written explanation for each missed question
Information Security (security frameworks, controls, and threats to information assets) & Information Technology (IT infrastructure, IT operations, and IT service management)
Categorize major threats (malware, social engineering, insider abuse, denial of service, injection, interception) and pair each with a mitigating control
Evaluate physical security, data classification, and retention controls against a stated business requirement
Explain privacy and data-protection obligations and the internal auditor's role in security and privacy reviews
Describe hardware, virtualization, and cloud service and deployment models and the risks each introduces
Distinguish database structures, file organization, and data-warehouse concepts
Your checkpoint
Threat-to-control matrix covering 15 distinct threats plus a 40-question Domain 2 quiz scored at 80% or higher
Information Technology (IT infrastructure, IT operations, and IT service management)
Explain operating, network, and application operations including change, configuration, and patch management
Describe incident, problem, change, release, and service-level management processes and how they interlock
Outline systems development life-cycle phases and compare waterfall, agile, and DevOps approaches
Identify disaster-recovery site types, backup strategies, and capacity-planning methods and select one for a scenario
Assess conceptual risks of RPA, AI/ML, IoT, and blockchain in an audit context
Your checkpoint
One-page IT operations process flow plus a 50-question Domain 3 quiz scored at 80% or higher
Financial Management (financial accounting, finance, and financial analysis techniques)
Construct the four primary financial statements from a supplied trial balance and confirm they balance
Apply time value of money to compute present and future values of single sums and annuities
Compute WACC, net present value, internal rate of return, and payback, then recommend a capital project
Decompose return on equity and interpret working-capital, liquidity, and solvency ratios
Explain valuation basics, dividend policy, and long-term financing choices
Your checkpoint
End-to-end capital-budgeting case (WACC, NPV, IRR, payback, recommendation memo) plus a 50-question Domain 4 quiz scored at 80% or higher
Business Acumen (organizational objectives, behavior, and performance; business processes; managerial and financial accounting concepts) & Information Security (security frameworks, controls, and threats to information assets) & Information Technology (IT infrastructure, IT operations, and IT service management) & Financial Management (financial accounting, finance, and financial analysis techniques)
Re-work every item in the error log until each weak topic reaches 85% or higher accuracy
Complete two full-length timed practice exams under exam conditions and review all misses
Recite from memory the key formulas for costing, ratio analysis, time value of money, and capital budgeting
Condense the highest-risk control, framework, and IT operations facts into a single cram sheet
Your checkpoint
Two full-length timed mocks scored at 80% or higher overall with no domain below 70%, plus a final one-page cram sheet
Milestones
Week 3: Domain 1 self-assessment quiz completed at 80% or higher; organizational alignment concept map and costing workbook both finished
Week 4: Mixed Domain 1-2 mock scored at 75% or higher with every missed item explained in writing
Week 6: Domains 2 and 3 quizzes both at 80% or higher; threat-to-control matrix and IT operations flow completed
Week 8: Two full-length timed mocks at 80% or higher with no domain below 70%, and all error-log topics cleared at 85% or higher