Certification in Risk Management Assurance (CRMA)

The certification in risk management assurance (CRMA) recognizes professionals with in-depth knowledge and skills related to organizational risk management. This credential, awarded by the Institute of Internal Auditors (IIA), demonstrates an understanding of risk assessment, identification, response, and controls.

CRMAs typically come from accounting careers as internal auditors and compliance officers, among others. They evaluate organizations’ risk management controls and processes to provide strategic advice based on their findings. While not required for employment, the CRMA certification can improve a professional’s credibility and employability.

Since 1941, the IIA has awarded credentials to internal auditors, including nearly 17,000 CRMA certifications. Members of the global organization join a network of over 210,000 professionals. Discover pathways to CRMA certification and some professional benefits this credential can provide with this helpful guide.

To qualify for the CRMA credential, candidates no longer need a valid certified internal auditor (CIA) certification. They must possess between one and five years of relevant experience, depending on their education level, and a passing score on the examination.

Candidates have two years from the date they are accepted into the CRMA program to complete the eligibility requirements. The CRMA has the same requirements worldwide. Candidates can gain experience from any state or country and can take the exam in over 500 worldwide locations.

The CRMA no longer requires the CIA prerequisite. Candidates can meet eligibility requirements through various paths, including holding a Master’s degree, a Bachelor’s degree, an Active Internal Audit Practitioner (IAP) designation, or applying without a degree.

The professional requirements for the CRMA include one to five years of experience in internal auditing or risk management, depending on the candidate’s education level. This work may occur within audit-related roles, such as audit managers, directors, associates, and specialists. Depending on their experience, professionals from accounting, financial services, risk assurance, and internal control positions may qualify.

Candidates cannot substitute education for the experience requirement.

The CRMA exam features 120 questions with up to 150 minutes of test time. The test has three sections: internal audit roles and responsibilities (20%), risk management governance (25%), and risk management assurance (55%). Question formats include multiple choice, fill in the blank, and matching. Test-takers must complete all components in one sitting.

Along with more than 500 testing locations worldwide, some CRMA candidates may take the exam online. A proctor will review the testing space before starting the exam to ensure it is free of unauthorized preparation materials.

CRMA exams are scored and scaled by the IIA’s Professional Certifications Board. The scale ranges between 250-750, and test-takers need a score of at least 600 to pass.

According to the IIA, the CRMA exam has a 50% global pass rate. Candidates who fail the exam must wait 30 days before retaking the test.

Following an update to the exam scoring process on April 1, 2026, candidates now receive a single, official exam result within three weeks of their exam date.

To register for the IIA’s CRMA exam, candidates need to access their profile on CCMS.

From their CCMS profile, candidates must pay the program application costs, with IIA members saving $120 compared to non-members. Each applicant also submits a government ID and proof of experience.

After applying, submitting their documents, and receiving approval, candidates can register for the exam and schedule their test time. Test times operate on a first-come, first-served basis and may fill up quickly depending on the location and time of year.

For more information, the IIA runs a 30-minute Q&A webinar.

CRMA exam registration costs $465 for IIA members and $610 for non-members. Test-takers should arrive at the testing center 30 minutes early and with proper identification to ensure they have time to sign in and get situated.

Candidates who arrive late or without identification may be denied entry or told to forfeit their registration fee. Test-takers may cancel or reschedule their exam up to two before the test date for a $75 fee. Any changes within 48 hours of the test date will result in a no-show and fee forfeiture.

Every person has their own study methods and requirements. With a 50% pass rate, the CRMA exam is challenging enough that test-takers should take their preparation seriously. Candidates should study early and often to ensure their success.

Certified CRMAs need to maintain their credential with continuing professional education (CPE). The IIA requires practicing CRMAs to report at least 20 CPE hours annually, including two hours of ethics. Non-practicing CRMAs need 10 CPE hours to maintain certification.

Eligible CPE hours include:

Newly certified professionals automatically earn 40 CPE hours, which cover their test year and the following year.

While the CRMA credential no longer requires a valid CIA certification as a prerequisite, earning multiple credentials can still be highly beneficial. The CIA credential prepares professionals to handle core internal auditor responsibilities.

Along with the CIA and CRMA, the IIA offers the internal audit practitioner (IAP) certification. This permanent certification helps aspiring auditors qualify for the CIA credential. The IAP is a permanent credential that requires 20 hours of annual continuing professional education (CPE) to maintain.