What is risk management assurance?

Risk management assurance is the process of identifying, evaluating, and managing financial and operational risks. Assurance provides organizations with protection, confidence in their decision-making, and insight into opportunities.

What are the responsibilities of risk assurance?

The responsibilities vary by organization and individual. In general, risk assurance educates and advises leaders on their organization's exposure to risk. The risk assurance process often includes internal audits, data and privacy reviews, and law and regulation compliance services.

What is a risk audit?

A risk audit reviews an organization's finances and operations to determine risk. Successful audits highlight potential risks and help organizations identify pathways to manage, control, or alleviate the risk.

What is a pass score for CRMA?

The CRMA exam has a maximum scaled score of 750. The minimum passing score is 600.

CRMA Certification: Complete Guide

The certification in risk management assurance (CRMA) recognizes professionals with in-depth knowledge and skills related to organizational risk management. This credential, awarded by the Institute of Internal Auditors (IIA), demonstrates an understanding of risk assessment, identification, response, and controls.

CRMAs typically come from accounting careers as internal auditors and compliance officers, among others. They evaluate organizations' risk management controls and processes to provide strategic advice based on their findings. While not required for employment, the CRMA certification can improve a professional's credibility and employability.

Since 1941, the IIA has awarded credentials to internal auditors, including nearly 17,000 CRMA certifications. Members of the global organization join a network of over 210,000 professionals. Discover pathways to CRMA certification and some professional benefits this credential can provide with this helpful guide.

Why Get Certified as a CRMA?

How Do You Qualify for the CRMA Certification?

To qualify for the CRMA credential, candidates no longer need a valid certified internal auditor (CIA) certification. They must possess between one and five years of relevant experience, depending on their education level, and a passing score on the examination.

Candidates have two years from the date they are accepted into the CRMA program to complete the eligibility requirements. The CRMA has the same requirements worldwide. Candidates can gain experience from any state or country and can take the exam in over 500 worldwide locations.

Educational Requirements

The CRMA no longer requires the CIA prerequisite. Candidates can meet eligibility requirements through various paths, including holding a Master's degree, a Bachelor's degree, an Active Internal Audit Practitioner (IAP) designation, or applying without a degree.

Professional Requirements

The professional requirements for the CRMA include one to five years of experience in internal auditing or risk management, depending on the candidate's education level. This work may occur within audit-related roles, such as audit managers, directors, associates, and specialists. Depending on their experience, professionals from accounting, financial services, risk assurance, and internal control positions may qualify.

Candidates cannot substitute education for the experience requirement.

What Does the CRMA Exam Cover?

The CRMA exam features 120 questions with up to 150 minutes of test time. The test has three sections: internal audit roles and responsibilities (20%), risk management governance (25%), and risk management assurance (55%). Question formats include multiple choice, fill in the blank, and matching. Test-takers must complete all components in one sitting.

Along with more than 500 testing locations worldwide, some CRMA candidates may take the exam online. A proctor will review the testing space before starting the exam to ensure it is free of unauthorized preparation materials.

CRMA Exam Structure
Section	Topics	Format
Internal Audit Roles and Responsibilities	Roles and competencies Coordination	Multiple choice and multiple response Fill in the blank Categorizing and ordering Matching and scenario sets Hot spot
Risk Management Governance	Governance, risk management, and control frameworks Risk management integration	Multiple choice and multiple response Fill in the blank Categorizing and ordering Matching and scenario sets Hot spot
Risk Management Assurance	Risk management approach Assurance processes Communication	Multiple choice and multiple response Fill in the blank Categorizing and ordering Matching and scenario sets Hot spot

Scoring the Exam

CRMA exams are scored and scaled by the IIA's Professional Certifications Board. The scale ranges between 250-750, and test-takers need a score of at least 600 to pass.

According to the IIA, the CRMA exam has a 50% global pass rate. Candidates who fail the exam must wait 30 days before retaking the test.

Following an update to the exam scoring process on April 1, 2026, candidates now receive a single, official exam result within three weeks of their exam date.

How Do You Register for the CRMA Exam?

To register for the IIA's CRMA exam, candidates need to access their profile on CCMS.

From their CCMS profile, candidates must pay the program application costs, with IIA members saving $120 compared to non-members. Each applicant also submits a government ID and proof of experience.

After applying, submitting their documents, and receiving approval, candidates can register for the exam and schedule their test time. Test times operate on a first-come, first-served basis and may fill up quickly depending on the location and time of year.

For more information, the IIA runs a 30-minute Q&A webinar.

Paying for the Exam

CRMA exam registration costs $465 for IIA members and $610 for non-members. Test-takers should arrive at the testing center 30 minutes early and with proper identification to ensure they have time to sign in and get situated.

Candidates who arrive late or without identification may be denied entry or told to forfeit their registration fee. Test-takers may cancel or reschedule their exam up to two before the test date for a $75 fee. Any changes within 48 hours of the test date will result in a no-show and fee forfeiture.

How Can You Prepare for the CRMA Exam?

Every person has their own study methods and requirements. With a 50% pass rate, the CRMA exam is challenging enough that test-takers should take their preparation seriously. Candidates should study early and often to ensure their success.

Top Tips

Practice Exams and Study Resources

What Is Needed to Maintain Risk Management Certification?

Certified CRMAs need to maintain their credential with continuing professional education (CPE). The IIA requires practicing CRMAs to report at least 20 CPE hours annually, including two hours of ethics. Non-practicing CRMAs need 10 CPE hours to maintain certification.

Eligible CPE hours include:

Relevant professional education and development programs
Relevant examinations
Authoring or translating publications
Oral presentations
Subject matter expert volunteering
Quality assessment

Newly certified professionals automatically earn 40 CPE hours, which cover their test year and the following year.

Should You Get Multiple Certifications?

While the CRMA credential no longer requires a valid CIA certification as a prerequisite, earning multiple credentials can still be highly beneficial. The CIA credential prepares professionals to handle core internal auditor responsibilities.

Along with the CIA and CRMA, the IIA offers the internal audit practitioner (IAP) certification. This permanent certification helps aspiring auditors qualify for the CIA credential. The IAP is a permanent credential that requires 20 hours of annual continuing professional education (CPE) to maintain.