, , , , ,


I received a helpful reminder letter from the Chartered Institute of Internal Auditors (UK) in the last few weeks. It states that I should be aware that I need to do 40 hours of CPE (continuing professional education) for the CIA qualification and 20 hours of CPE for the QIAL. Some activities can contribute to both. I was concerned – why did the Institute feel the need to write to me to remind me? Had something changed? Was the guidance more strict? 60 hours seems a lot of formal CPE – two whole weeks? Surely learning comes from lots of different sources?

The UK IIA provides a helpful link to some guidance here . This guide states that the following activities contribute to CPE and the hours required:

  1. Attending courses, conferences, seminars and master classes
  2. Undertaking structured reading and research, including technical updates and guidance
  3. Working towards relevant qualifications
  4. Participating in external quality assessments (EQAs)
  5. Participating in, or leading, professional discussions or learning conversations
  6. Networking and sharing good practice with colleagues in the profession
  7. Leading meetings or projects
  8. Engaging in in-house training and development, by external trainers as well as by colleagues and peers
  9. Engaging in work-shadowing, job exchanges, professional placements and secondments
  10. Soliciting peer reviews and analysing feedback on own performance
  11. Receiving or giving mentoring and coaching
  12. Reflective practice, such as maintaining a journal
  13. Supported induction into new areas of activity, eg if you’ve been promoted or you’re on rotation
  14. Contributing to the activity of relevant professional bodies and their committees
  15. Developing and producing technical papers, reports and other resources

Wow. Almost every day at work for me counts. So this guidance does not really specify which contribute to each qualification and which do not. What’s the balance between formal and informal CPE (the old chestnut of reading professional press etc). The template provided makes this no clearer either, just a simple table – surely a spreadsheet would  make better sense?

So let’s head over to the Global (US) IIA’s website to see if this makes anything clearer. The relevant link is here .  Once you’ve got there it’s all a bit vague and fluffy, so you need to click into the detail on an ominously title Administrative Direction Number 4. This is here . So the overall objectives seem reasonable to me:

  •  To maintain their knowledge and skills.
  • To update their knowledge and skills related to improvements and current developments in internal auditing standards, procedures, and techniques or in their specialization area (government auditing, financial services, control self-assessment, or risk management assurance).

Then there’s a set of requirements for the Global Standards (presumably as part of the wider IPPF):

  1. To encourage understanding of The IIA’s International Standards, the Professional Certification Board (PCB) requires that certification holders incorporate review of The IIA’s International Standards as part of their annual CPE program.
  2. Certificants must review or receive training on The IIA’s International Standards during the CPE reporting period.
  3. In addition to reviewing the Standards, The IIA encourages individuals to review the Practice Advisories (accessible with an IIA member password) and other sections of The IIA’s Professional Practices Framework.
  4. Certified individuals will be asked to certify their conformance to the Code of Ethics and the International Standards as part of the annual CPE report submission to The IIA.

These are less good in my view. The annual training on the Standards? Well they seem to change annually, so I guess any self respecting auditor should know about them – but formal training? Or is this something more informal? Also the Practice Advisories referred to are in fact not accessible to UK members from the US website or on the Global IIA website. There is also some lag between their publication from the US to the UK site. So does this mean I cannot certify to the Global IIA that I am compliant?

The CPE certification then states the evidence requires:

  1. Title of program and/or description of content.
  2. Dates attended.
  3. Location of course or program.
  4. Sponsoring organization.
  5. Contact hours of credit as recommended by the course sponsor.
  6. A letter, certificate, or other written independent attestation of course completion.
  7. Documentation supporting publications, oral presentations, and committee or other participation.

So this must be for courses – but this describes a very limited view of professional training and seems to narrowly focus on formal training courses. As I get older and more experienced as a CAE I learn more from doing and informal training than I do from formal training. Most training nowadays is not a formal classroom based thing in any case.

Then we have a useful table setting out the CPE hours required:



Use Certification / Designation?


Internal Auditing?

Annual CIA Required Hours

Annual Specialty Certification (CCSA, CFSA, CGAP, CRMA, Internal Audit Practitioner)

Annual QIAL Required Hours


Actively performing internal audit or related activities.







Not actively performing internal audit or related activities







No longer in the workforce






This means I require 40 for my CIA, 20 for my QIAL and 20 for my CRMA (Certificate in Risk Management Assurance). I also hold the ITAC (IT Auditing Certificate from the UK IIA). This is not mentioned anywhere on the UK website. I’ve never been asked to pay anything for it, or return CPE. It does not attract post nominal letters, so perhaps that is why.

Fees prices take some time to find and are difficult to obtain I found them here – however, just to report my CPE (just the admin cost of me filling a web form in the CCMS (Certification candidate management system) is $25 for the CIA and $10 for each specialty certification (my CRMA and QIAL in this case). So this is $45 just to fill in a form annually. These don’t seem to be to an annual cycle  – reminders come in at various times – I assume all are due 31 December. On top of this I pay the UK Institute an annual fee – in my case paid through a corporate membership of the UK IIA of my audit service.  This, from memory, was c.£250.

So what CPE hours contribute to what? The directive begins to answer this question:

  • CPE/CPD hours earned can be applied across all IIA Global designations, with some exceptions.
    •   CFSA, CCSA, CGAP, CRMA – 25% of the hours earned must be related to the specialty.
    •   QIAL – Some CPD categories for QIAL do not apply to other IIA global certification programs.

So I need at least 40 hours. Of that 25% must be risk management oriented. Also I need some extra hours that pertain only to the QIAL.

So what are these? So formal training courses (either internal or external) can contribute 20 hours to both CIA and CRMA. Again this is very narrowly drawn to be formal training courses with the requirements I set out above. Other categories include: maximum of 10 hours of contributions to publications; translations of technical materials (max 10 hours); oral presentations (max 10 hours); and performing an EQA (max 10 hours).

For the QIAL the list of qualifying activities is more limited:

  • Delivering training on topics of relevance to senior practitioners of internal auditing;
  •   Authoring new case study materials for the QIAL;
  •   Acting as an assessor or moderator for QIAL case studies;
  •   Participation as an assessor on a panel assessing QIAL candidates’ presentations and final panel interviews;
  •   Acting as an assessor for the QIAL Portfolios of Professional Experience;
  •   Receiving relevant training at an advanced level;
  •   Serving as an officer or committee member for an IIA affiliate or the global body, or a professional industry organization relevant to senior practitioners of internal auditing;
  •   Presenting at a conference;
  •   Writing for one of The IIA’s publications;
  •   Authoring materials for The IIA Research Foundation;
  •   Contribution to external quality assessments.

So tackling these eligible items: the delivery of training (max 10 hours); authoring of QIAL case study (max 10 hours); serving as assessor or panelist for QIAL (10 hours max split 5 hours for panel member and assessor respectively); being trained (max 20 hours); serving as a committee member for the IIA (max 10 hours); presenting (max 10 hours); authoring IIA publications (max 10 hours);  translations (max 10 hours); and performing EQAs (max 10 hours).

So what is all of this telling me? Well first I think it shows the transitional mess that the UK and Global qualifications are in. UK members are stuck somewhere mid-Atlantic with no real clear and single reporting route for CPD. Second I think the salami adding approach of certifications across the IIA needs to be streamlined into a single return to a single point. This should include a single fee. Third, I think the Global IIA needs to consider the value for money for its qualifications reporting – the fees are clearly above the administrative cost and their cumulative nature is not particularly fair on those members most committed to the Institute. Fourth I think the definitions of CPD need to be modernised, less restrictive and more focused on the real world learning. To get an external certification of an internal training course is challenging. Also as  CAE for a large audit team, with auditors at many different levels of progression, a formal training course is not likely to occur or be helpful. Instead we have smaller learning groups and professional practices group that is more flexible. Fifth, the UK IIA says it makes sense to use your normal appraisal and development processes as applied in your organisation. These formal and restrictive CPE requirements do not play well into this.

One additional complication for me is that I am also a Chartered Accountant (of the UK’s ICAEW – Institute of Chartered Accountants of England and Wales). This has an annual reporting and fee deadline too (with a single significant fee).  The approach from the ICAEW is thus:

‘Unlike some professional bodies, we don’t dictate how much CPD members must do. There are no set hours or points to attain. You simply need to complete as much development activity as you feel is required to remain competent in your role(s).’ See here.

They have an approach which is less restrictive:

‘You don’t necessarily need to attend training courses to maintain CPD compliance. We recognise that people learn in different ways, through several different channels.

These are the popular ways members stay up to date:

Read the ICAEW email alert – it contains updates and news relevant to your role
Attend a workshop, conference, seminar or webinar
Read a book or journal, such as a faculty publication
Participate in the ICAEW community
Arrange an informal training session with a colleague’

They have a ‘reflect, act, impact, declare’ approach. This treats the professional as a mature adult and enables a more reflective learning approach to be adopted. It also recognises that ICAEW members act in a variety of different roles, for which the training and CPD will look different.

I am afraid all of this rather makes the IIA’s approach seem rather dated and unhelpful. It’s odd, given accounting has a much more restrictive remit and role than internal audit, so broader reflection would appear more appropriate for internal auditing than perhaps accounting.

So what do I suggest? I suggest the UK and the Global IIAs take a step back from the labyrinthine CPD and qualifications structure they’ve created. I think a single point of fees and CPD declaration makes sense. Why not do this through the IIA UK and share data with the Global IIA? I think the administration fees need to be looked at, especially as UK members cannot access global resources, despite holding a global qualification. I also think the guidance on CPD could be made shorter, clearer, and in a single place.

I take my CPD very seriously and it is a key priority for me and my audit team. The recent perturbation of UK IIA qualifications has been unhelpful and now needs to be tidied up and modernised, with clearer UK and Global integration. For the UK and Global Institutes in my view risk competition from other Institutes where they don’t make membership an easier and clearer proposition for busy internal audit professionals.