CIA Part 2 Exam Format, Questions, and Timing

At a glance

The current CIA Part 2 exam contains 100 multiple-choice questions and provides 120 minutes of exam time. The average available time is 1.2 minutes, or 72 seconds, per question. The exam assesses engagement planning, evidence collection and evaluation, and supervision and communication using the current 2025 syllabus.

The passing standard is a scaled 600 on a range of 250 to 750. Do not convert that value into an 80% raw score or infer how many answers must be correct. The scaled result is the reported standard; The IIA does not publish a fixed raw-score conversion for candidates to apply to practice sets.

How question format translates into reasoning

Multiple choice does not mean the questions are simple recall. A short case may describe a process, a control, a sample, a stakeholder request, or evidence limitation. The question asks for the most appropriate objective, procedure, analysis, conclusion, or communication step. Read the specific task and stage of the engagement before selecting an answer.

For example, if a question describes a control that appears reasonable on paper but lacks evidence of performance, the distinction is between design and operating effectiveness. An answer that tests policy wording again may not address whether staff performed the control. An answer that immediately declares fraud goes farther than the facts support.

Current domains and their emphasis

Engagement Planning is 50%. It covers determining objectives and scope, risk assessment, understanding the area and its controls, planning procedures and the work program, and identifying the resources and skills required. This is the largest share, so learn planning as a sequence rather than a list of unrelated definitions.

Information Gathering, Analysis, and Evaluation is 40%. It includes obtaining relevant information, using interviews, walkthroughs, observation, sampling and data analysis, assessing evidence, documenting work, and developing conclusions. The auditor must connect the selected procedure to the engagement objective and explain what the result does and does not establish.

Engagement Supervision and Communication is 10%. It includes directing and reviewing work, maintaining communication with stakeholders, developing engagement results, and handling risk acceptance or escalation. The smaller weight is not a reason to skip it: questions about review and communication frequently test professional judgment across the whole engagement.

Pacing around 72 seconds

A 72-second average is a planning anchor. Some questions are direct and take less time; a longer scenario may deserve more. Do not spend several minutes defending an early answer while simple items remain. Take one pass through the exam, answer questions you can resolve, mark items needing more thought if the interface supports it, and return to them with remaining time.

During practice, note the time at regular intervals and compare it with progress. If you have completed about half the questions but used more than half of the available time, shorten your first-pass reasoning. If you are far ahead, slow down enough to catch words such as “most appropriate,” “first,” “sufficient,” or “except,” which can change the task.

A practical question routine

First identify what the question asks: choose an objective, next action, evidence source, sampling approach, conclusion, or communication. Second identify the phase: planning, fieldwork, evaluation, supervision, or reporting. Third underline the decisive fact, such as an incomplete population, an untested control, conflicting evidence, a scope restriction, or an unsupported management assertion.

Next eliminate options that are outside internal audit’s role, assume facts not supplied, or jump to a conclusion. If the issue is an unclear process, a walkthrough may be appropriate before designing a test. If the issue is whether a control operated over a period, inspect evidence from that period rather than relying only on inquiry. If a significant limitation prevents the planned work, communicate it and assess alternatives rather than fabricate assurance.

Worked timing example

Suppose a scenario says the engagement objective is to determine whether refund approvals comply with policy. The auditor finds a spreadsheet maintained by the supervisor and a system log showing a different number of refunds. The question asks what to do next. The central fact is a population mismatch. Selecting a sample from the spreadsheet would risk omitting transactions; first reconcile the population to a reliable system source, determine which dataset is complete, and document the basis for testing.

This item can be answered efficiently by naming the objective, noticing the data integrity issue, and eliminating “report noncompliance” because no valid test has occurred yet. It does not require a long debate about every possible sampling technique. Practicing this short decision routine helps preserve time for cases that truly require deeper analysis.

What timing should not change

Speed does not justify skipping evidence evaluation. A question may invite a quick answer based on a dramatic allegation, but the auditor still needs reliable facts. Conversely, do not delay an urgent escalation while pursuing perfect certainty if the facts indicate an immediate threat, evidence destruction, or significant exposure. Follow the established reporting route and continue appropriate work.

Avoid reading all four options as equally plausible before understanding the question. A useful first pass is to state the correct action in your own words, then compare options. This reduces the risk that a polished distractor pulls you toward a response that addresses a related but different problem.

Practice with realistic variation

Build practice across different industries and process areas: payroll, procurement, grants, cybersecurity access, inventory, and customer refunds. The audit principles are transferable, but process details influence which evidence is relevant. A log may be reliable for system access but not prove that a manager considered a business rationale. An approval form can evidence authorization but not the completeness of the transaction population.

Use original practice questions and do not rely on recalled or copied secure exam content. After each item, explain the evidence and authority behind the answer. If you chose “expand testing,” explain why the initial sample and exception justify expansion. If you selected “communicate,” identify which person needs the information and why the issue is material or time-sensitive.

Results and readiness

A 600 scaled score is the passing standard. A practice tool’s percentage is useful only as a diagnostic against that tool’s own questions. Track performance by domain, question type, confidence, and time. A candidate who consistently answers correctly but takes too long needs a different intervention from one who moves quickly but repeatedly overstates evidence.

Readiness means more than reaching a particular percentage on repeated questions. You should solve unfamiliar situations, explain why a conclusion fits the evidence, and keep a steady pace through all 100 items. If you remember a question’s answer but cannot reproduce the reasoning on a changed fact pattern, the underlying skill may not yet be stable.

A short pacing drill

For a 25-question practice set, allow about 30 minutes as a proportional timing target. Record start and finish time. For each missed or flagged item, tag the reason: objective unclear, wrong stage, evidence reliability, sample inference, criteria confusion, management responsibility, or communication sequence. Review tags after several sets and study the two most frequent weaknesses rather than rereading every chapter.

Repeat a timed set with new questions after correcting those errors. Preserve enough time to revisit flagged items. If a practice platform does not allow flagging or backtracking, train with its actual controls so your pacing plan fits the tool, but do not infer that a third-party interface exactly matches the live testing interface.

Quick facts to remember

The current count is 100 questions and the time limit is 120 minutes. The blueprint is 50% Engagement Planning, 40% Information Gathering, Analysis, and Evaluation, and 10% Engagement Supervision and Communication. The passing standard is 600 scaled points on a 250-to-750 scale.

Those facts answer the format question; sound preparation then turns them into decisions. Use 72 seconds as an average, distinguish design from operation, test a population that is complete and reliable, and report only what the evidence supports.

What the 50/40/10 split means for a sitting

The syllabus weights show relative emphasis across the tested content. They should guide preparation, but candidates should not expect exactly 50 questions from planning, 40 from evidence and evaluation, and 10 from supervision and communication on every exam. The exam blueprint controls content emphasis; the item allocation in a particular sitting can vary.

Use the weights to avoid a common preparation imbalance. Candidates who work in the field may feel comfortable with testing and spend little time on engagement planning. Yet choosing a strong objective, setting scope, identifying criteria, and designing a program determine whether later evidence answers the right question. Build competence in all three domains.

Managing uncertainty under the clock

If an item is unfamiliar, identify what is known before searching the options for a memorized phrase. What is the engagement objective? What has already been done? Which fact creates the risk? What evidence is missing? This narrows the decision. If the question asks for the first step, do not jump to final communication. If it asks for a conclusion, do not return to preliminary interviews unless the evidence is inadequate.

A candidate can spend too long comparing two attractive alternatives. State the difference in one sentence. One might verify population completeness; the other might expand sample size. If the population itself is suspect, completeness comes first. Another pair might propose a recommendation versus report a limitation; if the limitation prevents an objective conclusion, communicate the scope issue before proposing a fix. Sequence resolves many close choices.

Practice pacing with evidence types

Use timed drills that mix inquiry, observation, inspection, external confirmation, data analysis, and reperformance. Ask what each evidence type can establish and what remains uncertain. An interview can identify a process owner’s understanding but may not prove that a control operated. Observation can confirm a current practice at a point in time but may cause staff to behave differently. A system log can show a recorded event, but only if the log is complete and protected from alteration.

Keep a pace log for 100 questions: time at 25, 50, 75, and 100. A proportionate target is roughly 30 minutes per 25 questions. Use this as a checkpoint, not a rigid deadline. If an unfamiliar scenario requires a little longer, recover time on straightforward items rather than rushing every remaining question.