1.3 Scoring, Results Timing, and the 2025 Syllabus Map
Key Takeaways
- CIA scores are scaled from 250 to 750; 600 is the passing standard. There is no penalty for wrong answers, and you should not try to reverse-engineer a raw-correct target.
- Effective 1 April 2026, 3-part CIA candidates receive one official result within three weeks of the exam date and do not receive an unofficial score at the Pearson VUE center.
- The 2025 Part 2 map is Section A Engagement Planning 50%, Section B Information Gathering, Analysis, and Evaluation 40%, and Section C Engagement Supervision and Communication 10%.
- GIAS Domain V still frames the work: Principle 13 (plan), Principle 14 (conduct), Principle 15 (communicate results and monitor action plans)—but final reporting, recommendations, residual-risk acceptance, and action-plan monitoring are primarily CIA Part 3 2025 Section D (45%).
- Do not quote a live official IIA Part 2 pass-rate dashboard. Study to the 600 standard. Review providers citing the IIA have reported around 48% for Part 2 as context, not as your score report.
How Part 2 is scored — and when you find out
Quick Answer: Scaled scores run 250–750. 600 passes. Wrong answers are not penalized. Since 1 April 2026, 3-part CIA candidates get one official result within three weeks; Pearson VUE does not print an unofficial score. The 2025 Part 2 blueprint is 50% planning, 40% information gathering/analysis/evaluation, and 10% supervision and in-engagement communication.
The IIA uses scaled scoring. Raw correct counts are converted onto a 250–750 scale so that a 600 on a harder form means the same standard as a 600 on an easier form. You will not be given a formula that says "74 of 100 = 600." Any study group that converts 600 into a guaranteed raw number is inventing a figure the IIA does not publish for candidates. Your job is to answer as many items correctly as you can, including guesses on items you cannot finish, because blanks and wrongs are treated the same: they do not add points, and wrongs do not subtract extra points.
Treat pretest items as live. If a handful of items are unscored trials, you cannot see which ones. Leaving a "weird" item blank because it "must be pretest" is how people donate points.
Delayed scoring, effective dates, and the center printout that no longer exists
Delayed scoring means you do not receive a score immediately after the test. You receive the official score after quality-assurance and security checks. The IIA describes this as assessment-industry best practice: time to investigate irregularities before a result is released, which protects the credential you are paying for.
Effective dates matter because Challenge and 3-part CIA did not move together:
- IAP, 3-part CIA, and CRMA: effective 1 April 2026, official result within three weeks of the exam date.
- CIA Challenge Exam: effective 1 September 2026, official result within three weeks (with a longer window for the first administration of an updated Challenge form when the IIA announces one).
If you sit 3-part CIA Part 2 in August 2026, you are already on delayed scoring. You leave the Pearson VUE center with no unofficial number. When the official result is ready, CCMS sends a system-generated email to the primary address on your profile. Watch that inbox, including junk folders, for three weeks—not three hours.
The IIA's scoring FAQ is explicit that delayed scoring does not collide with the 30-day retake wait: official results arrive within three weeks, so you know the outcome before you are allowed to sit again. Plan emotionally for a quiet walk out of the test center. Plan operationally for a retake calendar that starts when the email arrives, not when you "have a feeling."
Do not quote a live official IIA Part 2 pass-rate dashboard in your notes or on a team wiki. Dashboards move, and this guide will not freeze a number the IIA may change. The standard you study to is 600. For difficulty context only, some review providers citing the IIA have reported around 48% for Part 2. Use that, if you use it at all, as a reminder that a professional engagement exam is not a participation badge—not as a prediction of your form.
The 2025 Part 2 syllabus map
Download the official English PDF and treat it as the contract: CIA Part 2 syllabus. In compressed form:
| 2025 section | Weight | What it is actually testing | Rough items on a 100-question form |
|---|---|---|---|
| A. Engagement Planning | 50% | Objectives and scope (including Topical Requirements); evaluation criteria; planning context (strategy, risk, IT/privacy, continuity, finance, process and system risks); approach and project management; engagement risk assessment; control procedures; work program and resources | About 50 |
| B. Information Gathering, Analysis, and Evaluation | 40% | Sources (interviews, observations, walk-throughs, data, documents); evidence relevance, sufficiency, reliability; technology options; process mapping and analytics; analytical review; findings; workpapers and conclusions | About 40 |
| C. Engagement Supervision and Communication | 10% | Supervision throughout planning and fieldwork; assignments and workpaper review; evaluating auditors' performance; communication methods; escalation; stakeholder selection during the engagement | About 10 |
"About 50 / 40 / 10" is a study allocation, not a promise that your form is sliced with a knife. Pretest items and form construction can shift a few items. It is still the right way to divide hours: half your Part 2 study belongs in planning. Candidates who love fieldwork techniques and starve planning are studying the exam they wish existed.
Section A is not "write a memo about planning." The expanded test specifications go into Topical Requirements, regulatory and strategy inputs, cyber and privacy, BCP/DR, finance and accounting concepts for the activity under review, supply chain and third parties, CRM/ERP/GRC, agile versus traditional versus integrated versus remote, project management, pervasive and emerging risks, culture and structure, control design versus operating effectiveness versus efficiency, work-program adequacy, and resource limits. That is why later chapters in this guide spend so many sections on A: the blueprint spends half the exam there.
Section B is the evidence engine: can you gather information, judge whether it is relevant, sufficient, and reliable, apply technology and analytics without turning every engagement into a data-science vanity project, compare conditions to criteria, and document a conclusion a competent person could rely on.
Section C is small in weight and expensive in mistakes. A 10% section still produces items that punish people who import Part 3 close-out procedures. Supervision is throughout the engagement, including planning—not a Friday review of a finished file. Communication is formal or informal, written or oral, during planning, fieldwork, and reporting—but the reporting slice is method and stakeholder choice, not the final-report attribute list.
GIAS Domain V — and the Part 3 boundary you must not blur
The 2025 CIA was rebuilt around the Global Internal Audit Standards (GIAS). Part 2 maps to Domain V: Performing Internal Audit Services:
| GIAS Domain V principle | Primary Part 2 home | What stays in Part 2 | What is primarily Part 3 2025 |
|---|---|---|---|
| Principle 13 — Plan Engagements Effectively | Section A (50%) | Objectives, scope, criteria, context, approach, engagement risk assessment, work program, resources | Annual activity-level planning and managing the function |
| Principle 14 — Conduct Engagement Work | Section B (40%) | Information gathering, analysis, evaluation, evidence, workpapers, engagement conclusions | Function-level methodology ownership as a management topic |
| Principle 15 — Communicate Engagement Results and Monitor Action Plans | Section C (10%) for in-engagement communication and supervision | Methods, escalation, stakeholder selection, supervising communication quality during the job | Final report attributes, recommendations, residual-risk acceptance, action-plan monitoring — Section D, 45% of Part 3 |
Principle 15 is the trap. The Standard's full name includes results communication and monitoring action plans. The CIA split that principle across exams. Part 2 still tests whether you communicate appropriately while the engagement is underway and whether supervision catches weak conclusions before they harden. Part 3 is where the exam spends a large domain on the final communication package, management's action plan, residual risk the organization is willing to accept, and follow-up. If a practice question asks who signs the final report, how residual risk is communicated when management accepts too much risk, or how the CAE monitors disposition of results, you are looking at Part 3 content even if a 2019 Part 2 deck filed it under "communicating results."
2019 leftovers that fail 2025 items
Stop studying these as if they were current Part 2 domains:
- Managing the internal audit activity as a Part 2 pillar (operations, activity-level budgeting, recruiting the function).
- Establishing the risk-based internal audit plan for the year (audit universe, cycle requirements as an activity plan).
- Final report development as a major Part 2 percentage (draft, review, approve, distribute, exit conference as the center of gravity).
- CAE residual-risk communication and monitoring progress of action plans as Part 2 proficient-level domains.
Those topics still exist in the CIA. They moved. Studying them here crowds out engagement planning detail that is now half the exam.
Scenario: two equally "correct" answers
Stem: fieldwork is complete. Management agrees with a significant access-control finding. What is the Part 2 auditor's next emphasis?
A 2019-trained candidate reaches for "draft the final report and set up follow-up monitoring." A 2025-trained candidate asks whether the question is still inside the engagement: is the issue about documenting the conclusion in workpapers, communicating the condition to the right stakeholder now, and having a supervisor review the conclusion—or is it about the later protocol for residual-risk acceptance and action-plan tracking? If the stem is a Part 2 item, the second cluster is the trap. The first cluster (workpapers, in-engagement communication, supervision) is the syllabus. Save the final-report machinery for Part 3.
How to use the map in the rest of this guide
Chapters 2–10 are Section A. Chapters 11–16 are Section B. Chapters 17–18 are Section C. Chapter 19 returns to 2019-versus-2025 traps, the Part 2 / Part 3 boundary, pacing, test-center rules, and official results. If your hours are limited, cut from Section C last among the small topics and from trivia first—but do not cut Section A to make room for report-writing drills. Report-writing drills are the wrong exam.
Official scoring and syllabus links:
What scaled score is required to pass CIA Part 2?
On the 2025 CIA, where are final engagement reporting, residual-risk acceptance communication, and action-plan monitoring primarily tested?
Which 2025 CIA Part 2 section carries the largest weight?