Skip Ribbon Commands
Skip to main content
Global Institute of Internal AuditorsBreadcrumb SeparatorCertificationBreadcrumb SeparatorCRMA CertificationBreadcrumb SeparatorCRMA Exam: Why and How It's Changing

CRMA Exam Syllabi Update

CRMA: Why, How, and What's New

Why?

Risk management assurance is an essential internal audit responsibility. As the risk landscape has continued to expand and change, The IIA recognized the need for the Certification in Risk Management Assurance® (CRMA®) program to keep pace. This required a thorough evaluation of the exam requirements and content to ensure they reflect the skills needed to audit today’s emerging risks, as well as consider the organizational view required to effectively execute risk management assurance. The IIA conducted two studies — a market study in 2018 and a job analysis study in 2019. The market study revealed perceived ambiguity between the CRMA and the Certified Internal Auditor® (CIA®). Additionally, it confirmed that more business experience and a deeper level of risk management knowledge are required in order to provide holistic and effective risk management assurance. As such, the new CRMA is positioned as a career pathway for internal auditors after achieving the CIA designation. It is the only risk management assurance certification for internal auditors. 

How?

The amount of both business and internal audit-specific experience required to sit for the exam has increased. Additionally, the new exam includes multiple-choice questions, as well as advanced-format questions, such as scenario item sets, fill-in-the-blanks, and hot spots. The level of understanding has also been elevated from basic to proficient for all questions.  

What?

 
​ ​CURRENT CRMA REVISED CRMA​
PREREQUISITE​ ​CIA Part 1 exam ​Active CIA designation (all three parts of the exam)
​CRMA EXAM ​100 multiple-choice questions ​125 questions (multiple-choice, up to 50% advanced-format)
​COMPETENCY LEVEL ​Basic and proficient ​Proficient
​SEAT TIME ​120 minutes ​150 minutes
​WORK EXPERIENCE ​2 years of audit or controls-related business experience ​5 years of business experience, with a minimum of 2 years in internal auditing
or its equivalent
 

 When?

 

As of Mid-2021, the new program requirements, format, window, and pricing changes will officially take effect. Aspiring candidates, as well as current certification holders and in-progress candidates, can learn more about how these changes will impact them specifically by referencing the CRMA Transition FAQs below.

CRMA Transition FAQs
  •   What are the changes to the CRMA?

    The current CRMA prerequisites include successful completion of the CIA Part 1 exam and two years of audit or controls-related work experience. The new CRMA program requires an active CIA designation and five years of business experience, with a minimum of two years in internal auditing (or its equivalent).

    The current CRMA exam comprises 100 questions, all in multiple-choice format at both the basic and proficient levels. The new CRMA exam consists of 125 questions, including advanced-format questions, all at the proficient level.

    The current CRMA has a 120-minute seat time. The seat time for the new CRMA exam is 150 minutes.

    The current CRMA program window is four years from the date when candidates are approved into the CRMA program; the new CRMA program window is two years.

    Here is a summary of the changes:

  •   Why did the CRMA program change?

    To ensure that the exam’s content remains current and valid, The IIA conducted two studies — a market study in 2018 and a job analysis study in 2019. The market study revealed perceived ambiguity between the CRMA and the Certified Internal Auditor® (CIA®). It confirmed that more business experience and a deeper level of risk management knowledge are required to provide holistic and effective risk management assurance. As such, the new CRMA is positioned as a career pathway for internal auditors after achieving the CIA designation.

    During the job analysis study, The IIA reached out to internal audit practitioners and other stakeholders around the world to determine the knowledge, skills, and abilities most relevant to today’s risk management assurance professionals. The results of this research confirmed the need for a new CRMA exam and program in order to demonstrate the higher level of risk management assurance experience and expertise required by today’s internal auditors providing risk management assurance services.

  •   What are the new CRMA entry and exit requirements, effective Mid-2021?


    * or its equivalent

  •   What is the effective date of the new CRMA program?

    Mid-2021 is the effective date of the new CRMA program. This includes the new CRMA exam delivered in English, new prerequisites, new experience requirement, and new program window. Prior to the effective date, the current CRMA requirements are in effect. CRMA applications received after the November 2019 announcement will include an acknowledgement that the applicant understands the CRMA program will be different as of Mid-2021.

  •   What are the price changes for the new CRMA program?


  •   What is the new CRMA program window?
    The CRMA program window is two years from the date a candidate is approved into the program.
  •   If I apply into the CRMA program before Mid-2021, what is my program expiration date?

    If you apply into the CRMA program before Mid-2021, your program window expires on the current CRMA program expiration date or 31 December 2022, whichever occurs first.

  •   If I apply into the CRMA program on or after Mid-2021, what is my program expiration date?

    If you apply into the CRMA program on or after Mid-2021, your program window expires two years after your CRMA application is approved.

  •   How many questions are there and what is the seat time for the new CRMA exam?

    The new CRMA exam will consist of 125 questions. The seat time will be 150 minutes.

  •   What are the types of questions on the new CRMA exam?

    In addition to multiple-choice questions, there will be advanced-format question types, such as scenario item sets, fill-in-the- blanks, matching, etc.

  •   Will a CIA challenge exam be offered to active CRMA holders who don’t currently hold a CIA designation?

    Individuals with an active CRMA designation earned by 30 June 2020 will be eligible to take a CIA Challenge Exam. Application for this CIA Challenge Exam opens on 1 July 2020.

  •   Will my previously awarded CRMA remain valid?

    Previously awarded CRMA designations will remain valid provided the CRMA holder reports 20 hours of CPE annually.

  •   What are the references for the new CRMA exam?
    • COSO frameworks and guidance
    • ISO 31000
    • The IIA's IPPF
    • OECD Risk Management and Corporate Governance
    • NIST Privacy Framework V1.0
    • King IV Report on Risk Management
    • IRM - Risk Appetite and Guidance Paper
    • IRM - Risk Culture: Resources for Practitioners
    • Assessing and Managing Strategic Risks
    • Practical Enterprise Risk Management: Getting to the Truth
    • Managing Risk in Uncertain Times
    • Sawyer's 7th edition
    • The Internal Auditor's Guide to Risk Assessment
    • Data Analytics: A roadmap for expanding analytics capabilities
    • Current resources on risk management assurance and relevant topics

    Please note that on a periodic basis, new references are added and outdated references are removed from the reference list.

​CRMA Transition Candidate Scenarios
  

​I have applied or will apply into the CRMA program before Mid-2021, I hold an active CIA designation, and I meet the new CRMA experience requirement. How am I affected?
  • Your CRMA program expires the earlier of the current CRMA program expiration date or 31 December 2022.
  • Before Mid-2021, you can obtain your CRMA designation by passing the current CRMA exam.
  • Starting Mid-2021, you must pass the new CRMA exam to obtain your CRMA designation​.
I have applied or will apply into the CRMA program before Mid-2021, I hold an active CIA designation, but I do not meet the new CRMA experience requirement. How am I affected?​
  • ​Your CRMA program expires the earlier of the current CRMA program expiration date or 31 December 2022.
  • Before Mid-2021, you can obtain your CRMA designation by passing the current CRMA exam and possessing two years of related internal audit experience.
  • Starting Mid-2021, you must pass the new CRMA exam and, as an exit requirement, meet the new CRMA work experience requirement to obtain your CRMA designation.
​I have applied or will apply into the CRMA program before Mid-2021, but I do not hold an active CIA designation. How am I affected?
  • ​Your CRMA program expires the earlier of the current CRMA program expiration date or 31 December 2022.
  • Before Mid-2021, you can obtain your CRMA designation by passing the CIA Part 1 exam, passing the current CRMA exam, and possessing two years of related internal audit experience.
  • Starting Mid-2021, you must first obtain your CIA designation (and keep it active by reporting CPE annually), and then reapply for the CRMA program (application fee will be waived). You must pass the new CRMA exam and meet the new CRMA experience requirement to obtain your CRMA designation.
​I will apply into the CRMA program after Mid-2021, and I hold an active CIA designation. How am I affected?
  • ​Your CRMA program window expires two years after your CRMA application is approved.
  • You can obtain your CRMA designation by passing the new CRMA exam and meeting the new CRMA experience requirement.
​I will apply into the CRMA program after Mid-2021, but I do not hold an active CIA designation. How am I affected?
  • ​Unfortunately, you will not be eligible to apply into the CRMA program. Beginning Mid-2021, candidates must hold an active CIA designation in order to enter the new CRMA program.
 
Copyright © The Institute of Internal Auditors. All Rights Reserved.