1.1 Current CIA Part 2 Exam Facts

What CIA Part 2 is in 2026

Quick Answer: CIA Part 2 is officially Certified Internal Auditor (CIA) Part 2: Internal Audit Engagement. It is a 100-question, 120-minute multiple-choice exam from The Institute of Internal Auditors (IIA), sat only at a Pearson VUE authorized test center. The English 2025 syllabus has been testable since 28 May 2025. Home/OnVUE testing ended 27 May 2025.

The CIA is the IIA's globally recognized internal audit credential. You earn it by completing a program, not a single sitting: an approved application in the Certification Candidate Management System (CCMS), three exam parts (unless a documented waiver or Challenge pathway applies), and verified internal-audit-related experience. Part 2 is the middle exam in that three-part design, and its job is specific. It tests whether you can run an engagement—a defined internal audit assignment with objectives, scope, criteria, fieldwork, evidence, supervision, and in-flight communication.

That job is not the same as running the internal audit activity. Annual planning, resourcing the function, CAE reporting to the board, and the machinery of the final report, recommendations, residual-risk acceptance, and follow-up monitoring live elsewhere in the 2025 CIA (primarily Part 3). If you study Part 2 as "how to manage an audit department," you are studying the 2019 outline, not the exam you will sit.

The title change you must memorize

Through the 2019 English syllabus, Part 2 was branded Practice of Internal Auditing and used a four-domain outline that mixed engagement work with managing the internal audit activity. That title and that domain map are retired for English 2025 testing. The live name is Internal Audit Engagement. Three sections, not four:

1. Section A — Engagement Planning (50%)
2. Section B — Information Gathering, Analysis, and Evaluation (40%)
3. Section C — Engagement Supervision and Communication (10%)

A flashcard deck, employer slide, or old blog that still says "Practice of Internal Auditing" is not automatically useless for engagement technique, but it is unsafe as a blueprint. Domain weights, topic placement, and the Part 2 / Part 3 boundary all moved. Section 1.3 maps the 2025 blueprint; this section is about not walking into the wrong exam.

Who writes it, who delivers it

The IIA writes the syllabus, sets the scaled passing standard of 600, and awards the CIA after program requirements are complete. Pearson VUE delivers the computer-based exam. You register and pay in CCMS, then schedule a seat through the Pearson VUE link inside CCMS. You do not create a free-standing Pearson account and hope the IIA authorization follows you.

Delivery is test-center only. The Certification Candidate Handbook states that online testing was discontinued on 27 May 2025 to protect exam integrity. Pearson VUE's IIA program page matches that rule: IIA certification exams are administered exclusively in Pearson test centers. A 2024 screenshot of OnVUE, a recruiter who "took CIA at home," or a third-party page that still lists remote proctoring is stale. If you cannot reach an authorized center on your authorization dates, you have a logistics problem, not a remote-testing option.

Format next to Parts 1 and 3

The IIA does not prescribe part order. Sitting Part 1 first is common because it is the foundation and because an active Internal Audit Practitioner (IAP) designation waives Part 1, but it is a study choice, not a rule. Once your CIA application is approved, you may register for Part 2 first.

All three parts are multiple-choice only. There is no essay, no uploaded workpaper, and no oral component. Pretest items may be embedded so the IIA can trial future questions. You will not be told which items are pretest. A "this one felt like a research item" instinct is not a scoring strategy. Answer every question.

Wrong answers are not penalized. A blank cannot help you. If two distractors are clearly wrong, guess between the remaining pair rather than leaving the item empty.

Pacing: 72 seconds is a budget, not a stopwatch

One hundred items in 120 minutes is 72 seconds each if you spend the clock evenly. That is enough when the stem is a clean engagement decision and dangerous when the stem is a long planning scenario with four plausible next steps. A workable split on test day:

1. First pass (~90 minutes). Answer anything you can decide in under a minute. Flag long stems, calculation-adjacent analytics items, and any question where two options both "sound like GIAS."
2. Second pass (~20 minutes). Return to flags. Strike the two weakest options before you guess. Part 2 distractors often mix a correct Part 3 action (issue the final report, accept residual risk, open a follow-up tracker) into a Part 2 stem.
3. Close (~10 minutes). Confirm every item has a selection. Because you will not receive an unofficial score at the center (Section 1.3), do not burn the last minute trying to "feel" 600. Use it to kill blanks.

If you average 90 seconds on the first 40 items, you have already spent 60 minutes and still have 60 items left. That is the failure pattern for this exam: over-investing in planning-worded stems because Section A is 50% of the blueprint. Section A is heavy, but it is still one minute-class multiple choice, not a take-home case.

Language and syllabus-version traps

English 2025 has been live since 28 May 2025. Other languages do not flip on that same date. As of August 2026:

• Vietnamese: registration to sit in Vietnamese is effective 28 August 2026.
• Arabic: 2019 syllabus through 27 December 2026; 2025 syllabus from 28 December 2026.
• Simplified Chinese: offered in mainland China; 2019 syllabus until the December 2026 test window, then 2025.

If you study in English, you are on Internal Audit Engagement with the 50/40/10 map. If you sit a language still on 2019, use that language's published syllabus. Do not mix a 2025 English study plan with a 2019-language appointment.

What "engagement" means in Part 2 language

An engagement is one assignment inside the larger internal audit activity. Examples: assurance over payroll disbursements, a consulting review of a new ERP access design, a targeted look at third-party data processors, a review of business-continuity arrangements for a plant. Part 2 asks you to:

• Set objectives and scope, including how Topical Requirements affect that decision.
• Choose evaluation criteria and pull planning context (strategy, risk, IT and privacy, continuity, finance, process and system risks).
• Pick an approach (agile, traditional, integrated, remote) and apply project-management discipline.
• Complete an engagement-level risk assessment, including structure and culture.
• Build an adequate work program and select testing methods.
• Gather information, judge evidence, analyze it, and document conclusions in workpapers.
• Supervise the team and communicate during planning, fieldwork, and reporting.

"During reporting" on Part 2 means choosing a method, picking stakeholders, and escalating when the situation requires it. It does not mean drafting the final report's required attributes, negotiating the management action plan as a 45% domain, communicating residual-risk acceptance, or monitoring whether actions were implemented. Those belong primarily to CIA Part 3 2025 Section D. Chapter 19 returns to that boundary; you need the distinction from day one so you do not memorize the wrong close-out steps.

Scenario: the 2019 study plan

A senior auditor downloads a 2019 Part 2 outline because a colleague passed on that version in 2024. Half of the study hours go to "internal audit operations," administrative budgeting of the activity, and the CAE's residual-risk communication. On the 2025 English exam, those hours are largely spent on content that moved. The items that actually appear ask for engagement objectives, evaluation criteria, evidence quality, and in-engagement supervision. The colleague's outline was accurate for the exam they sat. It is not accurate for yours.

Stale-fact table (ignore these even if a local file still shows them)

Official sources to bookmark

• IIA CIA home — titles, item counts, fees, eligibility paths
• CIA Part 2 2025 syllabus PDF — the live English outline
• Certification Candidate Handbook — delivery, windows, retakes, reschedules
• Pearson VUE IIA testing — test-center delivery