There are almost countless IT certifications. Some focus on IT security and there are a few which are dedicated to auditing.
Previously, we have compared CISA vs CISM , CISA vs CISSP and CISM vs CISSP. But there are two auditing certifications that people are often confused about. They ask whether they should go for CISA (Certified Information Systems Auditor) or CIA (Certified Internal Auditor). Or will it be even more useful if you go for both CIA and CISA.
What is CIA and CISA?
CIA or CISA is a frequently asked question among those considering a certification that is targeted towards auditing profession.
Certified Internal Auditor certification is granted by Institute of Internal Auditors, a non-profit founded in 1941. Currently, IIA has more than 185,000 members worldwide.
Certified Information Systems Auditor is regulated by Information Systems Audit and Control Association (ISACA) which is also a non-profit founded in 1978. More than 150,000 have achieved CISA designation since 1978.
If we could try to summarize the differences in one sentence, it will be that CIA is for more generalist auditors and CISA is for specialist auditors focusing on the IT auditing.
CISA certification would roughly cost you around $1000 and CIA certification will cost you around $1500. However, this cost doesn’t cover the books and any exam preparatory materials and courses you might buy.
CISA vs CIA Certification
Coming back to the question about which certification is preferred? Is it CISA or CIA?
CISA plus points
We start with a brief introduction of CISA. It is a certification that is a standard for Information technology auditors. The certification requires that you have a mix of knowledge of basics of auditing and a fair amount of IT knowledge.
With the physical ledgers having already given way to electronic information systems, IT auditors are high in demand in different industries for roles ranging from information systems auditors, IT risk management and data security positions to name a few.
Let me clarify that you do not need to have practical skills of information technology if you want to pursue CISA but you need to have a solid understanding of principles of IT governance, operations, IS security, business continuity and disaster recovery principles.
CISA is a one- exam certification. It is likely that with a strong experience in auditing and exposure to IT systems, you would be able to pass the exam within 6 months to a year.
CIA plus points
On the other hand CIA is a general auditing certification geared towards internal auditing. While basics of IT auditing is covered during this, it is not solely for IT auditors and also the content and syllabus do not go into as many details of IT systems auditing as CISA does.
Certified Internal Auditor is a three-exams certification and you have to pass all the three exams within 4 years. It would be appropriate if you consider between one and two years to complete the 3 CIA exams.
Since CIA is a general certification, it opens up more opportunities in internal auditing. Whereas CISA is precisely focused for roles related to information technology auditing.
Therefore, if your aim is to explore avenues in internal audit function but are not sure of your specialization, then CIA is a good choice. Moreover, if you are more interested in management positions and roles in internal auditing department, then CIA is the most probable choice.
CIA and CISA Exams
The minimum education qualification for appearing in CIA exam is an associate degree. Depending on your level of education, you would need at least 1 year of experience. Experience exemptions are available if you hold an ACCA or CPA qualification.
For CISA you need to pass the CISA exam with a graduate or higher degree. For getting certification after clearing the CISA exam, you need to show 5 years of information security, systems audit or control experience. Certain experience exemptions are also available.
Certification Maintenance
After you have achieved certification of CIA, you do not need to meet any continuing professional education requirements for next two years and after that you need 40 CPE hours every year for maintaining your CIA certification.
CISA CPE hours per year are 20 hours but in a three-year cycle you need to ear 120 total CPE hours.
Should you have both CISA and CIA?
For someone who is already CIA certified and looking to specialize in the field of IT auditing, going for CISA credential will add immense value to the profile. During part 3 of the CIA exam, you might have already been introduced to IT auditing because the part 3 of CIA.
If you have CISA already and are happy with your specialization in IT audit, CIA might not be of immediate benefit. But if you are looking to pursue leadership positions and managerial roles in general auditing/internal auditing, then pursuing CIA certification along with CISA is highly advisable.
Another possible reason might be that you want to change your career trajectory away from IT auditing to general internal auditing. In this case also CIA would be a good road to take.
Summary
If you like the technical stuff and are more interested in specialized IT audit jobs, then CISA certification is for you to pursue the highest standards of IT auditing. And if you, like me, are convinced that auditing profession is being realigned and the future of auditing is heavily reliant on information technology, then CISA is your way to go.
