The CIA Challenge 10-Year Pathway Closes September 30, 2026

Quick answer

The IIA is running a six-month pilot that opens the CIA Challenge Exam to professionals with 10 or more years of experience in internal audit or an adjacent discipline — no source certification required. Applications opened 1 April 2026 and close 30 September 2026. If you qualify, this is the shortest route to the CIA that has ever existed: one 150-question exam instead of three Parts.

Two things make this urgent rather than merely interesting. It is a pilot, with no commitment from The IIA to repeat it. And of the three testing windows attached to it — June, September and November 2026 — only November is still realistically reachable for someone applying today.

What the pathway actually changes

The CIA Challenge Exam is not new. It has existed for years as a shortcut for holders of specific credentials — CCSA, CFSA, CGAP, CRMA, full ACCA membership, CPA, CIMA — who could skip the three-Part CIA and sit a single exam instead.

The barrier was always that you needed one of those certifications first. A career internal auditor with fifteen years of practice and no letters after their name was ineligible, and had to sit all three Parts like a graduate.

The pilot removes exactly that barrier. Announced on 1 April 2026, it substitutes verified professional experience for the source credential. In The IIA's framing, the goal is to widen access for experienced practitioners who never formalised the designation:

"Our priority at The IIA is to stay ahead of the evolving needs of practitioners and ensure our guidance and certifications reflect the expanding role of internal audit." — Benito Ybarra, Executive Vice President of Global Standards, Guidance, and Certifications

Do you qualify?

You need 10+ years of experience in one or more of these seven disciplines:

• Internal Audit
• Quality Assurance
• Risk Management
• Audit / Assessment Disciplines
• Compliance
• External Audit
• Internal Control

The list is broader than most people assume, and this is where candidates rule themselves out too early. You do not need ten years inside an internal audit function. A compliance officer, a second-line risk manager, an external auditor from a Big Four practice, an internal control specialist in a finance department, a quality assurance lead — all of these count, and they can be combined. Ten years accumulated across compliance and external audit qualifies as readily as ten years in one internal audit shop.

If you have been working in the second or third line since roughly 2016, you should be checking your dates rather than assuming you are out.

The part that catches people out

The application requires the Professional Certification Experience Verification Form, available in English, French and Spanish. Every field must be completed — roles, responsibilities, organisations, and time spent in each position.

Then comes the step that determines your timeline: The IIA verifies your employment history by contacting your previous employers.

This is not a formality you can compress. If your ten years span four organisations, one of which has been acquired and another where your manager has left, verification is the slowest part of the process — and it starts only once you submit. Applying on 29 September is legal, but it leaves The IIA a single day of runway before the window shuts.

Practical consequence: gather your employment records first, submit second. For each role you intend to claim, you want the exact start and end dates, your title as it appeared on record, and a current contact at the organisation. Chasing an HR department for a 2017 employment date is the failure mode that costs candidates this window.

The timing maths

The pilot attaches to three 2026 testing windows: June, September and November. June has passed. September is, for anyone starting the application now, effectively closed — verification alone will not clear in time.

That leaves November 2026, and it defines the whole plan:

Between submitting now and testing in November you have roughly eight to ten weeks of preparation. That is tight but well matched to the exam: guidance across the major providers converges on 140–160 hours over 9–12 weeks for the Challenge Exam. Eight to ten weeks at 15–18 hours per week lands squarely inside that band.

What you are actually sitting

Three hours for 150 questions works out to 72 seconds per question. That pacing is the single most common reason experienced practitioners underperform: they know the material but deliberate like a reviewer rather than a test-taker. Timed practice is not optional here, and it matters more for you than it would for a graduate candidate.

What it costs

All fees are non-refundable and non-transferable. The membership gap is $630 — larger than the cost of IIA membership itself, so if you are not currently a member, joining before you apply is straightforwardly cheaper than not.

The trap experienced candidates fall into

Ten years of practice is exactly why people underprepare for this exam.

The Challenge Exam is not a test of whether you can do the job. It tests whether you can recognise the IIA's articulation of concepts you have been applying under your own organisation's vocabulary for a decade. You have been calling something a control owner; the exam calls it a process owner. Your risk methodology is house-built; the exam assumes the Three Lines Model as published. You know how assurance works at your company; the exam asks what the Standards require.

This gap is narrow but it is real, and it does not close through experience — only through deliberate exposure to the source material. Practitioners who fail this exam almost never fail on competence. They fail on vocabulary, on Standards citations, and on pacing.

The efficient correction is diagnostic-led: find where your working vocabulary diverges from the IPPF, and spend your hours there rather than re-reading material you have lived for ten years.

If you miss the window

You sit the three-Part CIA — Part 1, Part 2, Part 3 — at roughly 300–400 study hours total, typically across 12–18 months. The credential is identical at the end. The path is simply four to six times longer.

The IIA has not said whether the pilot will return. Treating 30 September 2026 as a one-time door is the rational assumption.

---

Prepping for the November window? The CIA Challenge Exam programme builds an adaptive plan calibrated on where your existing experience already covers the syllabus, so your hours go to the gaps rather than the material you have practised for a decade. Seven-day free trial, no card required.

Sources: The IIA — CIA Challenge Exam for Experienced Professionals and the IIA press release of April 2026. Fees and dates verified 4 September 2026 — confirm against The IIA before applying.