CRMA certification: exam, cost and requirements
The CRMA — Certification in Risk Management Assurance — is The IIA’s certification for internal auditors who provide assurance on risk management. The CIA is no longer a prerequisite: you need one to five years of internal audit experience depending on your education. The exam has 120 questions in 150 minutes, a score of 600 on a 250–750 scale passes, and fees total US$565 for IIA members or US$830 for non-members.
- Certification
- Certification in Risk Management Assurance (CRMA), issued by The IIAIIA CRMA page, checked 10 October 2026
- Fees
- Application US$100 member / US$220 non-member; exam US$465 member / US$610 non-memberIIA CRMA page, checked 10 October 2026
- Questions
- 120IIA CRMA page, checked 10 October 2026
- Duration
- 150 minutesIIA CRMA page, checked 10 October 2026
- Passing score
- 600 on a scale of 250 to 750IIA Certification Candidate Handbook, checked 10 October 2026
- Delivery
- Computer-based at Pearson VUE test centresIIA CRMA page and Candidate Handbook, checked 10 October 2026
- Eligibility
- No CIA required; 1 year of internal audit experience with a master’s, 2 with a bachelor’s, 5 otherwiseIIA CRMA page, checked 10 October 2026
- Program period
- 2 years from acceptance to pass the examIIA CRMA page and Candidate Handbook, checked 10 October 2026
- Renewal
- 20 CPE hours a year, reported 1 October – 31 DecemberIIA CPE requirements, checked 10 October 2026
Know if you're ready for CRMA — before you book.
Certsqill measures your CRMA readiness across every official exam domain — one 0–100 score from coverage, accuracy and consistency that tells you whether to book, keep studying, or sit.
Why people switch to Certsqill
Everything you need to walk in ready
Know where you stand, understand every mistake, and study in your language — one payment, no subscription.
Your CRMA Readiness Score, not a guess
One number from three signals — coverage, accuracy, and consistency — tells you whether to book the exam or keep studying.
Understand every CRMA mistake
When you miss a question, it explains why — using your own answer history to catch the patterns you keep repeating. Included, no subscription.
Explanations in your language, questions stay exam-accurate
Get every explanation in your language while the questions stay in exam-accurate English. Technical terms stay in English — the way the exam writes them.
Everything you need to pass
Why you can trust these CRMA questions
What is CRMA certification?
CRMA stands for Certification in Risk Management Assurance. It is issued by The IIA, the Institute of Internal Auditors, and it certifies the specialised knowledge an internal auditor needs to give assurance on an organisation’s risk management.
So what is a CRMA certification in practice? It is a single-exam specialty credential for internal auditors, built on three areas: internal audit roles and responsibilities, risk management governance and risk management assurance. The last one carries more than half of the exam.
Two recent points matter. The IIA states that the CRMA no longer requires the CIA as a prerequisite, which opens it to internal auditors who have not taken the three-part CIA exam. And The IIA notes that the CRMA syllabus is currently supported by the 2017 Standards, so prepare against that framework.
Source: The IIA — Certification in Risk Management Assurance (CRMA). Checked 10 October 2026.
CRMA certification cost
The IIA charges two fees, and both depend on membership. The application fee is US$100 for members and US$220 for non-members; the exam fee is US$465 for members and US$610 for non-members. All fees are non-refundable and non-transferable.
For a first attempt that is US$565 as an IIA member or US$830 as a non-member. A retake means paying the exam fee again. IIA membership has its own cost, so compare the two totals before you decide whether to join.
- Application: US$100 (member) / US$220 (non-member)
- Exam: US$465 (member) / US$610 (non-member)
Source: The IIA — Certification in Risk Management Assurance (CRMA). Checked 10 October 2026.
CRMA requirements
The CRMA requirements are internal audit experience plus education, and since the CIA prerequisite was dropped, the CIA designation is not required. The IIA accepts these routes:
- Master’s degree (or equivalent): 1 year of internal audit experience
- Bachelor’s degree (or equivalent): 2 years of internal audit experience
- High school diploma, associate’s degree, A-levels or equivalent: 5 years of internal audit experience, 2 of them within the past 3 years
- Active Internal Audit Practitioner (IAP) certification: 5 years of experience, or 1–2 years with a master’s or bachelor’s
Source: The IIA — Certification in Risk Management Assurance (CRMA). Checked 10 October 2026.
How to get CRMA certification
How to get CRMA certification comes down to four steps: apply to The IIA’s CRMA programme and pay the application fee, register and pay for the exam, pass it, and complete the eligibility requirements. The IIA gives you two years from acceptance into the programme to do this, and you must pass the exam within two years of applying.
If you do not pass, the handbook sets the earliest retake at 30 days after your last attempt and limits you to eight attempts within the eligibility period. Plan your first attempt early in the two years, so a retake still fits.
Source: The IIA — Certification Candidate Handbook (March 2026). Checked 10 October 2026.
CRMA exam format and passing score
The CRMA exam has 120 questions in 150 minutes — one minute and 15 seconds per question. It is computer-based and administered by Pearson VUE at test centres; The IIA’s CRMA page refers to test centres and does not mention an online-proctored option for this exam.
Scores are converted to a reporting scale from 250 to 750, and The IIA’s handbook states that a score of 600 or higher is required to pass any IIA exam. The 600 is a scaled score, not a percentage of correct answers. The IIA does not publish a CRMA pass rate on the pages checked.
Source: The IIA — Certification Candidate Handbook (March 2026). Checked 10 October 2026.
What is on the CRMA exam?
The IIA’s CRMA examination syllabus has three sections. Risk management assurance alone accounts for 55% of the exam — more than the other two combined — so the core skill tested is assessing and reporting on risk management, not general audit knowledge.
- Section 1: Internal Audit Roles and Responsibilities — 20%
- Section 2: Risk Management Governance — 25%
- Section 3: Risk Management Assurance — 55%
Source: The IIA — CRMA Examination Syllabus. Checked 10 October 2026.
CRMA study materials and exam questions
The IIA publishes the CRMA syllabus and a list of CRMA references, and sells its own preparation: the CRMA Preparation Course and the CRMA Study Guide and Practice Questions, 3rd Edition. Whatever you use, check it against the three syllabus sections and their weights, and against the 2017 Standards that the syllabus is based on.
CRMA exam questions from the live exam are confidential. The IIA’s handbook states that reproducing, sharing, discussing, posting or uploading any exam content, in whole or in part, is strictly prohibited. Practice material written for preparation is the only legitimate kind.
Source: The IIA — Certification Candidate Handbook (March 2026). Checked 10 October 2026.
CRMA certification lookup and renewal
For a CRMA certification lookup, The IIA runs a public Certification Registry. It shows the holder’s name, certificate ID, certification status and country — but only for active holders who have opted in, because inclusion is voluntary. If someone is not listed, that does not prove they are uncertified; The IIA does not issue verification letters.
To stay certified, CRMA holders report 20 CPE hours each year, including the required ethics hours, and self-attest during the annual renewal period from 1 October to 31 December. Only holders who meet the CPE requirement may appear in the registry or claim active status.
Source: The IIA — Certification Registry. Checked 10 October 2026.
CRMA vs CIA
The CIA is The IIA’s core internal audit certification with a three-part exam; the CRMA is a specialty certification with a single 120-question exam focused on risk management assurance. Until recently the CRMA required the CIA first. The IIA has removed that prerequisite, so the two are now independent routes.
If you want a broad internal audit credential, the CIA is the one. If you already work in internal audit and your role centres on assurance over risk management, the CRMA is the narrower route with a single exam, and it requires 20 CPE hours a year to maintain.
Source: The IIA — Certified Internal Auditor (CIA). Checked 10 October 2026.
CRMA practice questions
Certsqill’s CRMA practice questions are expert-developed: every question explains each answer option, and a readiness score for each syllabus section shows whether risk management assurance, at 55% of the exam, is ready before you pay for an attempt.
CRMA questions people ask
What is CRMA certification?
The Certification in Risk Management Assurance from The IIA, a specialty certification for internal auditors who give assurance on risk management. Source: IIA, checked 10 October 2026.
Do I need the CIA for the CRMA?
No. The IIA states that the CRMA no longer requires the CIA prerequisite. Source: IIA CRMA page, checked 10 October 2026.
How much does CRMA certification cost?
US$100 application plus US$465 exam for IIA members (US$565), or US$220 plus US$610 for non-members (US$830). Source: IIA, checked 10 October 2026.
How many questions are on the CRMA exam?
120 questions in 150 minutes. Source: IIA CRMA page, checked 10 October 2026.
What is the CRMA passing score?
600 on a reporting scale of 250 to 750. Source: IIA Candidate Handbook, checked 10 October 2026.
What experience do I need for the CRMA?
1 year of internal audit experience with a master’s, 2 with a bachelor’s, or 5 years otherwise (2 within the last 3). Source: IIA, checked 10 October 2026.
How long do I have to pass the CRMA exam?
Two years from acceptance into the programme, with up to eight attempts and at least 30 days between them. Source: IIA, checked 10 October 2026.
How do I do a CRMA certification lookup?
Search The IIA’s Certification Registry. It lists only active holders who have opted in, so a missing name is not proof of anything. Source: IIA, checked 10 October 2026.
How many CPE hours does the CRMA require?
20 CPE hours a year, including the required ethics hours, reported between 1 October and 31 December. Source: IIA, checked 10 October 2026.
