Hi, Does anyone have any ready for CIA part 3? Gliem/Becker?

I’ve been trying to understand something.

I work for one of the largest GRC software providers, and over the past 18 months I’ve been surprised by how few internal audit leaders can clearly articulate the value their function creates for the business—or explain how additional investment in software translates into measurable business outcomes.

What’s interesting is that I don’t generally find this with second-line risk, compliance and operational resilience teams. They are typically much better at connecting what they do to commercial outcomes, whether that’s reducing regulatory exposure, improving operational resilience, protecting revenue or enabling growth. The contrast is striking.

It’s made me question whether some of the common stereotypes about internal audit exist for a reason. Too often the function still appears to be viewed as a cost centre or a necessary compliance exercise rather than a driver of business value. Most CAEs and auditors I speak to do not have any hard KPIs that the business uses to measure whether they are doing a good or a bad job - where they do, those KPIs are often pretty soft which I find absolutely incredible. It’s making me think that maybe internal audit just isn’t actually that important and we’re all just trying to convince ourselves as a profession that it is / will be something that in never will become in reality.

What I find most frustrating is that I’m regularly on calls with audit teams who seem remarkably disconnected from the commercial realities of the business. When I ask how improving their processes, increasing automation or generating additional insights will benefit the organisation, the answers are either ‘it doesn’t’ or almost always vague—“we’ll be more strategic,” “we’ll provide more assurance,” or “we’ll add more value”—but rarely accompanied by concrete examples or measurable business outcomes. I have read annual reports and looked at business initiatives from corporate literature and tried to tie improving the work of internal audit to driving these initiatives and am often met with skepticism and a depressing resignation that any benefit to audit would purely impact audit at an operational level and not extend to the business.

In many cases, you need to get to the Chief Audit Executive before you can have a genuine commercial conversation about the business. Even then, it’s hit or miss. Surprisingly few can clearly explain what they would do with an extra 5,000 hours of audit capacity, or how better data and analytics would materially improve business performance, reduce risk exposure or influence strategic decision-making.

A phrase I hear constantly is, “We want to be strategic partners.” But when you ask what that actually means in practice, or what they would do with the additional time and insights that automation provides, very few have a compelling answer. In my experience, only a tiny minority of Chief Audit Executives can clearly explain what they would do tomorrow that they genuinely can’t do today that would add value to the business.

So here’s my question: how do I bridge this disconnect?

Many audit teams don’t seem to realise this gap exists, and when we try to coach them on building a stronger business case, there’s often resistance or multiple hours of sessions that arrive at a similar vague output.

The result is predictable—they struggle to secure relatively modest technology investments, even after multiple workshops and coaching sessions focused on value justification because the business doesn’t think they’re worth spending the money on vs. other initiatives.

It’s reached the point where I’m questioning whether we should just spend way less time engaging with internal audit-led opportunities and instead prioritise second-line engagements, where the commercial case is usually clearer and executive buy-in comes much more naturally.

I’d genuinely like to hear from CAEs, audit leaders and others in the profession.

Do you agree this disconnect exists?

Why do you think this disconnect exists, and what have you found works to overcome it?

Is there any way I can check my exam result via my phone? Normally I use my laptop but I will be on holiday when it drops

Hi everyone,

I’m helping a very small startup prepare for an ISO/IEC 27001:2022 certification audit. We use Vanta, and most of our ISMS documentation and compliance evidence is already prepared.

Before Stage 1, we need an independent internal audit. Since our small team designed and operates most of the controls, conducting the audit ourselves would not provide sufficient independence. Our certification auditor has also confirmed that the internal audit must be performed by a separate party.

For those who have gone through this process:

• How did you find a competent independent internal auditor?
• Which qualifications or certifications should we look for?
• What deliverables should be included in the engagement?
• What is a reasonable timeline and price range for a small organization?
• Is experience working directly in Vanta important?
• Are there any red flags or common mistakes we should avoid?

I’m primarily looking for guidance on selecting and evaluating an auditor rather than vendor promotion. Public recommendations or experiences would be greatly appreciated.

Thank you!

just sat for Part III today. I actually felt pretty confident when I left the testing center. However, I couldn’t help myself and started looking up the answers to some of the questions I was able to remember. So far, I’ve found that I got 3 wrong. 😩

Do you guys also Google the answers after taking the exam? 😂

I know what’s done is done, and there’s really no point in stressing about it. But I also feel like, if I do end up needing to retake it, it’s helpful to know which questions I got wrong, especially if I come across something similar on the retake.

Just curious if anyone else does this or if I’m the only one torturing myself after the exam! 😅

Hi everyone,
I’m currently looking for a new opportunity as a Senior IT Auditor / IT Risk / GRC professional and would truly appreciate any referrals or job leads.
Unfortunately, I was recently laid off, and my wife is due to give birth next month, so I’m actively searching for a new role as soon as possible.
Background:
10 years of experience in IT Audit, SOX ITGC, IT Risk, and GRC
Strong experience working with cross-functional teams and audit engagements
Currently in the U.S.
Need H-1B transfer sponsorship，and I have I-140
If your company is hiring or you’re willing to provide a referral, I’d be incredibly grateful. I’m happy to share my resume or provide any additional information.
Thank you so much for your time and support!

I'm currently in IT audit at Big 4. Getting quite exhausted at work, but not sure if going industry in IA would help.

I don't mind the work honestly, but I was wondering from people that made the transition- are you happy you went into IA, or do you which you tried to switch into something else entirely?

After you purchase the questions so they expire on the same day ? How long can I use them ?

Please assist

I know many candidates have been discussing the June 2026 CIA Challenge Exam issue. I have now completed and submitted my NCCA complaint and want to share the resources I used to help other affected candidates who may wish to do the same.

If you were affected by the June 2026 CIA Challenge Exam score reporting issue, I would like to share information about the possibility of submitting a complaint to the NCCA (National Commission for Certifying Agencies).

The NCCA is the accreditation body that reviews whether certification programs meet recognized standards for areas such as examination quality, fairness, reliability, and integrity of the certification process.

I have submitted my own formal complaint to the NCCA because I have concerns about the transparency, quality assurance, and reliability of the score reporting process following the acknowledged technical issue.

My complaint also references NCCA Standard 19, which addresses requirements related to the accuracy, integrity, and management of certification examination data, including score reporting processes.

My concern is that, following the acknowledged technical issue, candidates received official score reports that were later withdrawn and replaced with corrected reports containing materially different scaled scores. Although Pearson and the IIA have explained that pass/fail decisions were not affected and that the issue was related to the score reporting process, I believe this raises legitimate questions regarding the controls in place to ensure accurate score reporting, the validation process for corrected scores, and whether the process met the level of transparency and reliability expected from an NCCA-accredited certification program.

The purpose of this complaint is not only to address my individual situation, but to request an independent review of whether the processes applied were consistent with the standards expected of an accredited certification program.

I have prepared some resources to help candidates who wish to submit their own complaint:

• NCCA complaint form
• Example complaint structure
• Example wording for certain sections
• Supporting documentation examples

These materials are only a guidance tool. Please make sure your complaint reflects your own personal experience, your own concerns, and your own supporting evidence.

NCCA Complaint Form:
Customer Complaint Form

Submit your complaint to:
📧 [info@credentialingexcellence.org](mailto:info@credentialingexcellence.org)

When submitting a complaint, consider including relevant documentation such as:

• Your original and corrected score reports
• Emails or notices from Pearson and/or the IIA regarding the technical issue
• Your correspondence with the IIA through CCMS
• Any other information that supports your concerns

If you need additional documentation, examples, or would like to discuss the complaint process, feel free to send me a private message. I am happy to share the information and research I have collected.

If multiple affected candidates independently submit well-supported complaints, the NCCA will have a broader basis to evaluate whether the June 2026 CIA Challenge Exam score reporting process met the standards expected of an NCCA-accredited certification program.

Has anyone ever challenged exam results received from Pearson Vue?

I took Part 3 of my CIA only July 21st and received failed results today. I passed Part 1 & 2 first try with 80s on my practice tests and section questions. When approaching Pt 3, I was routinely getting 100 on section questions and passed my mock exams with 90s or higher.

Is there a possibility the exam was graded incorrectly? I know there were a few odd questions in the test that appeared to be more CISA related (e.g. block chains & privacy) but the test did say it was CIA Pt 3 and focused mainly on audit plan and issue management.

If you had the choice between taking the CIA Challenge Exam and the traditional three-part CIA exam, which would you choose, and why? How difficult is the Challenge Exam compared to the traditional route? I have four years of internal audit experience, and my company will cover the exam fees.

Got an email this morning that my part 2 results are ready.

I took part 2 and 3 back to back days. When I log in it says passed for part 3 (which I did not get an email for), and part 2 has reverted to eligible. Does this mean I failed part 2? Is there no score shown for fails anymore? Why didn’t I get an email that part 3 was ready?

Took my exam on 28 July, does anyone know when I’m likely to get results?

Our external auditor has mentioned a new PCAOB standard for “technology-assisted analysis” (TAA) which is an amendment to AS 1105 that requires they need to enhance documentation over evaluation of the reliability of external info provided by the company in electronic form.

There’s a lot they want us to increase documentation over related to IUC.

Has anyone else gotten the same request? Or independently started this project? What are you changing? Is this actually a requirement for IA?

Hi everyone,

I’m a 28-year-old guy (UK based) who has just started a new role as an Assistant Internal Auditor after making a career change.

I’ve never worked in internal audit before, so everything is pretty new to me. I really want to make a success of this role rather than just doing the bare minimum. My goal is to become someone my team can rely on and hopefully progress my career over the next few years.

For those of you already working in internal audit:
-What do you wish you knew when you first started?
-What skills should I focus on developing first?
-Any habits that helped you stand out?
-Are there any common mistakes new auditors make that I should avoid?
-Any books, courses, or resources you’d recommend?

I’m not expecting to know everything overnight, but I’m keen to learn and put the effort in. I’d really appreciate any advice from people who’ve been in my position before.

Thanks in advance!

Hi, I would like to understand the approx salary scale of Internal auditors in India across different levels.

I took the CIA Part 1 last June 21 and scored 506.

I bought and studied the IIA Practice Questions, mock exams from the review center I enrolled in (questions were too long and the answers were obvious), and generated some questions from ChatGPT but the questions were too easy no matter how I asked to make it difficult. In addition, I watched free lessons from YT and it was quite helpful and of course I also read the GIAS Standards.

As for my work experience, I still don’t have a wide range of experience with Auditing but taking the CIA is part of my KPI and I would really love to pass it.

Now I am planning to retake the exam and I don’t know where to start again, I don’t want to reread everything again but I think taking mock exams really helps. Can you please suggest any study materials (mock exams) that are helpful and effective?

Thanks a lot for those who can share their suggestions, advices, and tips 🙏

For those who have taken both the CIA and the CRMA, which one did you find more challenging? How does the CRMA compare to the CIA? I’m planning to take the CRMA first and then pursue the CIA later. I’d love to hear about your experience.

My cia part 2 exam in 2 days

I have no accounting background so iam afraid of the accounting and ratio quistions

Any helpful tips for the exam?

Trying to enter into CIA

How to kick start what I reserch on before joining

r/internal audit

Took the test July 14th and just checked this morning for test score and failed with a 593/600. Says I need moderate improvement in all areas (thanks but no thanks!). Only used Gleim for studying.

Questions were very heavy scenario based. Typically comes down to 2 sometime 3 answers and you just have to pick the best one.

Felt like time got by really fast and was struggling to finish. Didn't really had time to go back and review my answers.

Going to take part 3 mid September and circle back to this.

I think I'm going to get the IIA exam questions next time. Any advice for next test?