CGIA study plan
CGIA · Give each week a clear focus.
8 weeks · About 7 hours per week
Internal Audit Fundamentals, IIA Standards, and the IPPF
Map the IPPF architecture (mission, core principles, definition of internal auditing, Code of Ethics, Standards, and guidance) into a one-page diagram from memory
Distinguish attribute Standards from performance Standards and state which series numbers govern engagement planning, communication, and monitoring
Explain the difference between assurance and consulting services and identify which Standards apply to each
Define the chief audit executive's role in charter approval, reporting lines, and resource management
Your checkpoint
A one-page IPPF map plus a 20-item self-quiz on Standard numbering and terminology, scored at 80% or better
Internal Audit Fundamentals, IIA Standards, and the IPPF & Governance, Risk Management, and Control Frameworks
Compare the three lines model with traditional risk-and-control ownership and articulate internal audit's position within it
Summarize COSO Internal Control - Integrated Framework: five components, 17 principles, and the meaning of reasonable assurance
Describe COSO ERM components and how risk appetite, tolerance, and portfolio view interact
Trace how governance structures (board, audit committee, management) shape the audit universe and mandate
Your checkpoint
A comparison table of COSO IC, COSO ERM, and the three lines model with at least 12 accurate cross-references
Governance, Risk Management, and Control Frameworks & Audit Planning, Engagement Objectives, and Scope
Apply a risk-based approach to build an audit universe and rank entities using likelihood, impact, and control maturity
Draft engagement objectives that are specific, auditable, and linked to risk, then derive scope inclusions and exclusions
Write engagement-level risk and control matrices for two contrasting processes
Construct audit programs with procedures mapped to each identified risk and evidence type
Your checkpoint
A complete engagement planning package for one simulated process: risk assessment, objectives, scope statement, and audit program
Audit Planning, Engagement Objectives, and Scope & Information Gathering, Analysis, and Audit Evidence
Select sampling approaches (statistical and non-statistical) and justify sample sizes against engagement objectives
Classify evidence by sufficiency, reliability, relevance, and usefulness, ranking source types from most to least reliable
Design interview and walkthrough techniques that reduce bias and capture process reality
Identify when to escalate scope changes or suspected irregularities during fieldwork
Your checkpoint
A fieldwork evidence log with at least 15 items, each tagged by evidence type, reliability ranking, and the objective it supports
Information Gathering, Analysis, and Audit Evidence & Audit Reporting, Communication, and Follow-up
Convert findings into condition, criteria, cause, effect, and recommendation statements without overreaching the evidence
Rate findings by severity and align ratings with a documented risk scale
Draft executive summaries and detailed reports for technical and non-technical audiences
Design a follow-up process with owners, due dates, and escalation triggers for overdue actions
Your checkpoint
A full audit report draft with five findings, severity ratings, and a follow-up tracker, plus a 150-word executive summary
Professional Ethics, Independence, and Objectivity & Audit Reporting, Communication, and Follow-up
Apply the Code of Ethics principles (integrity, objectivity, confidentiality, competency) to at least six realistic dilemma scenarios
Distinguish independence from objectivity and identify threats such as self-review, social pressure, and conflicting roles
Evaluate impairment situations and decide when disclosure or reassignment is required
Practice communicating sensitive results upward while preserving confidentiality and factual accuracy
Your checkpoint
A written ethics case analysis of four scenarios with a defensible decision and the specific Standard or principle cited for each
Fraud, IT, and Emerging Risk Considerations & Professional Ethics, Independence, and Objectivity
Recognize fraud red flags across financial reporting, asset misappropriation, and corruption schemes
Outline the internal auditor's role in fraud risk assessment versus a fraud investigation and the boundaries of that role
Assess IT general controls and application controls relevant to an audit, including access management and change control
Identify emerging risks such as cybersecurity, third-party and cloud dependency, data privacy, and AI-generated data integrity
Your checkpoint
A fraud and IT risk register with 12 entries, each with red flags, relevant control, and the audit procedure that would test it
Quality Assurance, Continuous Improvement, and Audit Management & Internal Audit Fundamentals, IIA Standards, and the IPPF
Explain internal and external quality assessment requirements, including supervision, review, and periodic assessment intervals
Design engagement-level supervision and working-paper review checkpoints
Build a continuous improvement loop using performance metrics, root-cause analysis, and lessons learned
Consolidate weak areas from prior weeks into a targeted final review and timed practice set
Your checkpoint
A quality assurance and improvement program outline plus a timed 60-question mixed practice set with a written review of every missed item
Milestones
Week 2: Score 80% or higher on a 25-question quiz covering IPPF structure, the three lines model, and COSO frameworks without notes
Week 4: Produce a complete planning package and evidence log that a reviewer accepts as internally consistent: every procedure traces to a risk and every evidence item traces to an objective
Week 6: Resolve four ethics scenarios in writing with correct principle citations and no independence misjudgments
Week 8: Achieve 75% or higher on the timed 60-question mixed set and show a written remediation note for each missed item