CGIA

It is delivered as multiple-choice questions covering the eight published domains, weighted from fundamentals and governance through to quality assurance. The certifying body publishes the current question count, time limit and delivery method on its official site, so confirm there before scheduling rather than relying on second-hand figures.

Difficulty comes from judgement, not trivia. Straight definition items exist, but most challenging questions give a short scenario and ask for the most appropriate action, the strongest evidence, or the best conclusion. Candidates who memorise Standards numbers without understanding why they exist tend to struggle on those items.

Most candidates need several weeks of consistent study rather than a few crammed sessions, because the domains build on each other. A practical plan is one domain per study block, with practice questions after each block and two full timed practice runs in the final week. Adjust for your existing audit or controls experience.

Begin with fundamentals, the IIA Standards and the IPPF, since the rest of the exam uses that vocabulary. Then take governance, risk and control frameworks, followed by planning and scope, evidence and analysis, and reporting and follow-up. Ethics, fraud and IT risk sit well near the end, once you can apply them to scenarios.

Retake rules, waiting periods and any additional fees are set by the certifying body and can change. Check the official site for the current policy before you book. If you do retake, use your score report to identify weak domains and rebuild those areas rather than repeating the same general review.

Three recur. First, answering what the auditor could do rather than what the Standards require next. Second, confusing consulting and assurance roles when independence is at stake. Third, choosing the strongest-sounding evidence instead of the evidence that is sufficient and relevant to the stated objective.

No formal prerequisite is implied here, but experience helps because scenario questions assume familiarity with how engagements actually run. If you come from compliance or risk, spend extra time on engagement planning, evidence sufficiency and reporting mechanics, where practical context matters most.

Treat them as diagnostics, not a scoreboard. For every miss, write down the principle you overlooked, whether that was scope, independence, evidence sufficiency or reporting protocol. Group your notes by domain so patterns appear. Rushing through hundreds of questions without review produces far less improvement than reviewing a smaller set thoroughly.

Only the certifying body's official website carries authoritative, current information on registration, fees, scheduling, scoring and any continuing education requirements. Third-party summaries go stale quickly. Verify there before you pay for anything, and keep a copy of the current candidate handbook for reference.