CIA Part 3 Master Guide

What Part 3 assesses

CIA Part 3 is titled Internal Audit Function. It tests how internal audit operates as a function: how the activity is organized and resourced, how it builds and updates a risk-based plan, how it supports quality, and how it communicates results and tracks action. Its perspective is broader than the individual engagement focus of Part 2.

The current 2025 syllabus replaced the older Part 3 structure focused on separate business acumen, information security, information technology, and financial management domains. Those topics can still matter, but they are assessed in the context of the internal audit function and its work rather than as the old four-domain chart.

The four current domains are Internal Audit Operations (25%), Internal Audit Plan (15%), Quality of the Internal Audit Function (15%), and Engagement Results and Monitoring (45%). The unusually large results domain means candidates should understand communication, findings, management action plans, risk acceptance, and follow-up deeply. Do not treat reporting as a short last chapter.

Exam facts and score

Part 3 contains 100 multiple-choice questions and allows 120 minutes, an average of 72 seconds per question. The passing standard is 600 on a scaled range of 250 to 750. It is not a public raw percentage threshold. A practice-bank score cannot be converted into the official scale by simple arithmetic.

Under the delayed-scoring policy effective April 1, 2026 for the traditional three-part CIA exam, candidates receive one official result within three weeks of the exam date. The immediate unofficial score is no longer provided. Candidates must wait at least 30 days before retaking a part.

Passing Part 3 fulfills only that exam part. Candidates still need to complete the other applicable exams and program requirements, including education, experience, ethics, and administrative documentation. Keep the result notice and check the candidate record for remaining requirements.

The function-level lens

Part 3 asks questions that a chief audit executive or function leader must consider: What skills does the activity need? How should resources be allocated? How can the plan adapt to emerging risks? What does quality information show? Who should receive significant results? How will management action be validated?

The answer must preserve independence. Internal audit can advise, facilitate, evaluate, and report, but management owns business risks and controls. The chief audit executive manages the internal audit function; that role does not give the function authority to run procurement, approve operational transactions, or make management’s risk decisions.

Function-level decisions also involve governance. The board or appropriate governing body approves or oversees key elements such as the charter, mandate, and plan under the organization’s framework. Senior management supports access, resources, and coordination. The precise arrangement depends on governance structures, but the function needs a direct and effective route to report interference and material risk.

Domain A: Internal Audit Operations, 25%

This domain covers planning, organizing, directing, and monitoring internal audit operations. It includes methodologies, external service providers, balance between assurance and advisory work, and conditions that warrant reviewing or revising methods. The function should use consistent processes while allowing engagement teams to adapt to risk and context.

The function also manages financial, human, and technology resources. Budgeting should connect to strategy and the risk-based plan. Resource decisions consider staffing, skills, recruitment, development, retention, performance, tools, and systems. A budget is not only a cost ceiling; it is a way to judge whether the function can deliver the coverage and quality required.

Suppose the plan includes cloud-security reviews, but the audit team lacks technical expertise. A function-level response could recruit, train, co-source, or rely on qualified specialists, while retaining responsibility for supervision and conclusions. Simply assigning an unqualified auditor because the budget is fixed creates risk and may produce weak assurance.

Performance measures should balance efficiency and effectiveness. Hours used, reports issued, and plan completion can be useful but do not prove value. Consider stakeholder outcomes, coverage of significant risks, quality of findings, action follow-up, staff development, and adherence to standards. Incentives should not reward high report volume at the expense of risk relevance.

Domain B: Internal Audit Plan, 15%

The plan is based on a documented risk assessment and should align with organizational objectives, the internal audit strategy, governance expectations, and relevant risks. It is not simply a rotation of departments. Consider the risk universe, emerging risks, prior coverage, assurance providers, changes, incidents, and available resources.

Risk assessment should be refreshed when conditions change. A merger, new regulation, major system rollout, fraud incident, or strategic shift can alter priorities. The chief audit executive should communicate significant plan changes and resource constraints to the appropriate governance recipients.

Coordination with other assurance providers can reduce duplicate coverage and reveal gaps. Before relying on their work, consider independence, competence, scope, methods, evidence, and reporting. Reliance should be documented. The internal audit function remains accountable for its own conclusions.

Domain C: Quality, 15%

A quality assurance and improvement program (QAIP) evaluates whether the internal audit function conforms with the Global Internal Audit Standards and achieves performance objectives. It includes ongoing monitoring, periodic internal assessments, and an external quality assessment at least once every five years by a qualified independent assessor or assessment team.

Quality is not merely an external score. Ongoing monitoring can include engagement supervision, workpaper review, stakeholder feedback, adherence checks, and analysis of performance measures. Periodic self-assessment can examine whether policies, processes, and engagements align with standards. Findings should lead to improvement actions and follow-up.

The chief audit executive is responsible for communicating quality program results and significant nonconformance to the board and senior management as required. A statement that work was conducted in accordance with the Standards should be used only when the function’s quality program supports that assertion. Do not claim conformance because a template contains the phrase.

Domain D: Engagement Results and Monitoring, 45%

This domain covers effective communication of results and monitoring progress. Final communication should be accurate, objective, clear, concise, constructive, complete, and timely. It should include objectives, scope, conclusions, significant findings, recommendations or agreed action plans, and management responses as appropriate.

Findings compare condition with criteria and explain cause and effect when supported. Recommendations should address risk without transferring management responsibilities to audit. Management may choose an alternative response; the function evaluates whether it addresses the exposure.

Monitoring tracks action plans and verifies implementation. Closure should rely on evidence, not solely a verbal assurance or revised policy. If management accepts significant risk, the chief audit executive determines whether it is within the organization’s tolerance and management’s authority and escalates unresolved concerns appropriately.

Interim communication matters when an issue is urgent or could affect the organization before the final report. A suspected fraud, immediate safety exposure, or evidence destruction may require prompt communication under established protocols. The auditor preserves confidentiality and uses the correct escalation route.

Worked example: plan change after a major incident

A company’s audit plan schedules a routine review of customer refunds in the fourth quarter. In May, a cyber incident disrupts order processing and the board asks whether the internal audit plan addresses the new risk. The chief audit executive reassesses the risk universe, consults management and other assurance providers, considers the incident’s effect on objectives, and estimates resources needed for a focused engagement.

The function may defer a lower-priority engagement, add cyber recovery work, or co-source technical procedures. It documents the rationale and discusses the material plan change and resource effect with the board or committee under its governance process. It does not simply add work without resources and then report a failure to complete the original plan as if nothing changed.

After the engagement, the report explains the objective, scope, results, and recommendations. Management agrees to recovery testing and assigns owners. Internal audit tracks the action and obtains evidence of implementation. If a major residual risk is accepted without authorized approval, the chief audit executive escalates it.

Part 3 and Part 2 in context

Part 2 focuses on planning and performing a particular engagement. Part 3 considers the function that establishes methodologies, sets the audit plan, sustains quality, and monitors results. The same subject can appear at both levels. Part 2 may ask what evidence an engagement auditor should gather; Part 3 may ask how the chief audit executive ensures the function has capacity to do that work.

Do not answer a function question with an engagement-only response. A single auditor can notify a supervisor about an evidence issue; a chief audit executive may revise methodology, adjust resources, or communicate a plan constraint. Identify who is acting and what authority the scenario gives them.

A practical study strategy

Start with the four domain weights and map each syllabus task to a function-level decision. For operations, practice budget, staffing, external providers, methodologies, and performance measures. For planning, practice risk universe, prioritization, coordination, emerging issues, and resource limits. For quality, practice QAIP components and conformance communication. For results, practice clear reporting, action plans, acceptance of risk, and follow-up.

Use realistic cases where one decision affects another. A resource shortage can change the plan; a quality issue can require methodology changes; a serious finding can affect risk acceptance and board communication. Explain both the immediate response and the longer-term function responsibility.

Do not spend all study time memorizing historic technology, finance, and security topics as stand-alone domains. Learn enough context to recognize risks, then focus on how the internal audit function plans and assures work in those areas. This matches the 2025 syllabus.

Pacing and readiness

At 72 seconds per question on average, keep a steady first pass. Identify the actor (auditor, supervisor, chief audit executive, board, or management), the decision level (engagement or function), and the requested result. Eliminate options that assign management ownership to audit or promise a quality assertion without supporting evidence.

You are better prepared when you can explain how the function responds to a new risk, why a metric is incomplete, when to rely on another provider, how a QAIP supports improvement, and what evidence closes an action. Use unfamiliar cases to test transfer and review both incorrect and uncertain answers.

A single practice score is not an official pass prediction. Track timing and error patterns across all four domains. If one domain remains weak, study its decision logic rather than repeating the same questions.

Final checklist

Remember the current weights: operations 25%, plan 15%, quality 15%, and results/monitoring 45%. The exam has 100 questions, 120 minutes, and a 600 scaled passing standard. Official results arrive within three weeks under the 2026 policy, with at least a 30-day wait before retake.

Most important, retain the role boundary: the internal audit function independently evaluates and communicates; management owns risk and controls; the board provides governance oversight. Part 3 tests whether candidates can sustain that work through resources, plans, quality, and follow-up.

How to manage the function through a change

Function operations should give the audit activity reliable methods, capable people, suitable technology, and a way to monitor performance. Methodologies create consistency in planning, supervision, documentation, reporting, and follow-up. They should also permit professional judgment when a risk or engagement context requires a different approach. A rigid template that forces irrelevant steps can reduce quality; uncontrolled variation can make coverage and review inconsistent.

The chief audit executive monitors whether methods remain fit for purpose. Triggers for revision include changed Standards, a new technology environment, recurring quality findings, stakeholder feedback, mergers, regulatory change, or a serious engagement failure. Revising a method should include rationale, consultation, approval where required, communication, training, and a way to verify adoption.

External service providers can fill a skill or capacity gap, but the function must define scope, access, confidentiality, deliverables, supervision, quality expectations, and how results will be used. The provider’s work should be assessed for competence, objectivity, methods, and evidence. Co-sourcing does not transfer the chief audit executive’s accountability for the internal audit function.

A function balances assurance and advisory work. Advisory services can help management understand risk and options, but internal audit should not assume management responsibilities or allow advisory work to crowd out assurance over significant risks. Set boundaries, document purpose, and consider future objectivity if the same area will later be audited.

Use performance information carefully

Performance measures help the chief audit executive and board understand whether the function is operating effectively. Financial measures can compare budget with actual spending; operational measures can show cycle time or plan completion; quality measures can reflect review results and assessment findings; productivity and efficiency measures can show work delivered against resources; effectiveness measures ask whether the work addressed important risks and led to useful outcomes.

A single measure can distort behavior. If auditors are rewarded only for the number of reports issued, they may split engagements or prioritize volume over material risk. If plan completion is the only goal, the function may avoid changing the plan when major risks emerge. Balanced measures combine quantitative data with qualitative feedback and retain professional judgment.

Example: a function reports 95% plan completion but delayed every cybersecurity review because specialists were unavailable. The completion percentage masks an important coverage gap. A fuller dashboard shows completed and deferred high-risk coverage, reasons, resource constraints, quality results, and emerging-risk changes. The chief audit executive can then explain trade-offs to governance and adjust the plan.

Work through an integrated function case

A regional bank adopts a new digital lending platform. The board’s risk appetite and strategic plan change, but the annual audit plan was approved before launch. Operations must consider whether the function has expertise in automated decisioning, privacy, cybersecurity, model governance, and consumer-protection controls. The plan domain then reassesses risk priority and existing assurance coverage.

The chief audit executive identifies relevant providers: compliance, security, model risk, external assurance, and internal audit. Before relying on their work, the function evaluates scope, competence, independence, methodology, and evidence. It maps what each provider covers and identifies the gap around data changes after model approval.

The audit plan may add a focused engagement and defer lower-priority work. The chief audit executive estimates staff and technology needs and communicates the material change and any resource limitation. Engagement results later identify that model-change approvals were inconsistently documented. The report explains criterion, condition, risk, and management action.

Management selects a corrective process and owner. Internal audit follows up by inspecting approvals and testing whether monitoring works. QAIP review may identify that the engagement team lacked a documented method for model changes; the function updates methodology and trains staff. One scenario now connects all four domains: operations, planning, quality, and results.

A practical study method for experienced auditors

If you already work in internal audit, begin by mapping your experience to the 2025 domains. Can you explain function budgeting and staffing? How is the audit plan updated? What evidence supports a QAIP assertion? How are management actions validated and significant risk acceptance escalated? Familiarity with engagement testing alone is not full Part 3 readiness.

Study by decision level. For each topic, identify the chief audit executive’s responsibility, the board’s role, senior management’s role, and the engagement team’s role. Write a short scenario where each actor has a distinct action. This prevents choosing a plausible answer assigned to the wrong person.

Practice integrated cases rather than one chapter at a time. A new risk can affect the plan, which creates a resource need, which may expose a quality gap, which then affects communication and follow-up. Explain how the function responds across that chain.

Final readiness questions

Can you explain why a completed audit plan may still be ineffective? Can you identify when plan changes should be communicated? Can you assess another provider’s work before relying on it? Can you explain ongoing, internal periodic, and external quality assessment? Can you distinguish “action reported complete” from “risk reduced with evidence”?

If your answer to any is uncertain, use a concrete case. Write what evidence would support a decision and what limitation could remain. The objective is to reason from the current Standards and syllabus, not repeat broad claims about best practice.