CRMA Certification Guide 2026: Exam, Cost, Requirements & Preparation

CRMA certification, officially called the Certification in Risk Management Assurance®, is a specialized credential from The Institute of Internal Auditors (IIA) for professionals who provide assurance over risk management, governance, and organizational controls. The current CRMA exam contains 120 questions, lasts 150 minutes, and does not require the CIA designation as a prerequisite. Candidates must meet education and relevant work-experience requirements and complete the certification requirements within two years of acceptance into the program.

What Is CRMA Certification?

The CRMA meaning is Certification in Risk Management Assurance. It is a professional credential designed specifically around the ability to evaluate whether an organization's risk-management processes, governance structures, controls, and assurance activities are working effectively.

So, what is CRMA in practical terms? A CRMA professional does more than identify risks. The credential tests whether a candidate can assess how risk is governed, determine whether assurance coverage is appropriate, evaluate risk-management effectiveness, and communicate significant risk concerns to management and the board.

The IIA CRMA is particularly relevant to internal auditors, risk professionals, compliance specialists, control professionals, audit managers, and assurance leaders. The IIA describes it as the only risk-management assurance certification specifically for internal auditors.

A common variation of the question “what is a CRMA?” refers to a professional who has successfully completed the IIA's certification requirements and maintains the credential through continuing professional education and annual renewal.

CRMA Certification Exam Overview

The current exam structure is straightforward:

CRMA Exam Detail

Current Information

Certification

Certification in Risk Management Assurance®

Certification Body

The Institute of Internal Auditors

Number of Questions

120

Exam Duration

150 minutes

Number of Exams

1

CIA Required?

No

Program Completion Period

2 years

Primary Focus

Risk, governance and assurance

Exam Management

IIA CCMS / Pearson VUE

The IIA confirms that candidates have two years from acceptance into the CRMA program to complete the requirements. Candidates cannot register for the examination until their application and supporting documents have been approved.

Since 1 April 2026, candidates taking the CRMA receive one official examination result within three weeks of the exam date, rather than receiving an immediate unofficial result at the testing center.

CRMA Exam Domains and Weightings

The current CRMA exam is divided into three major sections:

CRMA Domain

Weight

Internal Audit Roles and Responsibilities

20%

Risk Management Governance

25%

Risk Management Assurance

55%

These percentages matter when building a CRMA exam preparation strategy. More than half of the examination is devoted to Risk Management Assurance, making practical risk evaluation significantly more important than simply memorizing governance terminology.

Internal Audit Roles and Responsibilities — 20%

This section evaluates your ability to determine appropriate assurance and consulting activities, assess required competencies, preserve organizational independence, coordinate assurance providers, and develop appropriate risk-assurance coverage.

Candidates should understand how internal audit contributes to risk management without taking over management's responsibilities.

Risk Management Governance — 25%

This domain covers governance frameworks, risk and control frameworks, organizational risk culture, risk oversight, management's commitment to risk management, emerging risks, strategy integration, and risk reporting.

The exam expects candidates to connect risk management with organizational objectives, strategy, performance and operations, rather than treating risk management as an isolated compliance process.

Risk Management Assurance — 55%

This is the largest and most important CRMA domain.

Candidates are expected to evaluate risk-assessment processes, apply appropriate risk frameworks, prioritize risk-based audit engagements, assess remediation activities, evaluate risk-monitoring processes, use data analytics, and communicate assurance conclusions.

The syllabus also includes project management, change controls, systems-development lifecycle risks, cybersecurity, data privacy, IT controls and information security. Professionals searching for CRMA strategic projects should pay particular attention to these areas because they demonstrate how risk assurance extends into transformation initiatives and major organizational projects.

CRMA Certification Requirements and Eligibility

The CRMA certification requirements depend largely on your education.

Education / Status

Relevant Experience Required

Master's degree or equivalent

1 year

Bachelor's degree or equivalent

2 years

No degree / qualifying secondary education

5 years

Active IAP without qualifying degree

5 years

Acceptable experience may include internal audit, risk management, compliance, quality assurance, external audit, internal control, and audit or assessment disciplines. Candidates with the required education may sit for the exam before completing the required work experience, but all certification requirements must still be satisfied within the program period.

For candidates without a degree, five years of relevant experience are required, and two of those five years must fall within the previous three years.

One important change is that becoming a Certified Internal Auditor (CIA) is no longer required before pursuing the CRMA.

CRMA Certification Cost in 2026

The current published CRMA certification cost differs according to IIA membership.

Fee

IIA Member

Non-Member

CRMA Application

$100

$220

CRMA Exam

$465

$610

Total

$565

$830

Therefore, the basic CRMA cost before training, study materials, taxes, membership, rescheduling or other optional expenses is $565 for members and $830 for non-members under the currently published pricing.

Pricing can differ in countries served through an IIA National Institute, and local taxes may also apply.

How to Earn the CRMA Certification

The application process can be broken into five practical steps:

1. Confirm your CRMA eligibility based on education and experience.
   
   

2. Create or sign in to your Certification Candidate Management System (CCMS) account.
   
   

3. Submit the CRMA application, identification and required education documentation.
   
   

4. After approval, register and schedule the examination.
   
   

5. Pass the exam and complete the required experience verification.
   
   

Once all program requirements have been completed, the CRMA designation is issued through CCMS.

CRMA Training and Exam Preparation

Effective CRMA training should focus on application and judgment rather than memorizing isolated definitions.

The IIA states that the CRMA is a self-study examination and does not require candidates to follow a prescribed curriculum. Candidates may choose their own preparation method.

A strong CRMA exam preparation plan should include:

• Reviewing the official CRMA syllabus first
  
  

• Studying governance, risk and control frameworks
  
  

• Practicing risk-assurance scenarios
  
  

• Learning risk-based audit planning
  
  

• Understanding assurance mapping and coordination
  
  

• Practicing data-analytics applications
  
  

• Reviewing cybersecurity, privacy and technology risks
  
  

• Completing timed CRMA practice questions
  
  

• Analyzing why incorrect answers are incorrect
  
  

The IIA's current CRMA study guide is the CRMA Study Guide and Practice Questions, 3rd Edition, which includes the syllabus, key terminology and more than 200 sample questions with explanations.

Candidates comparing CRMA certification study material, a structured CRMA course, or CRMA certification online training should check whether the material follows the current examination syllabus rather than relying solely on generic enterprise-risk-management content.

Important 2026 CRMA Syllabus Note

There is one unusual point candidates should know.

Although the Global Internal Audit Standards became effective in 2025, the current CRMA examination syllabus remains supported by the 2017 Standards. The IIA states that there are currently no plans to update the CRMA exam, noting that the core risk-management and internal-auditing principles remain relevant.

This makes syllabus alignment especially important when choosing CRMA certification study material. Newer is not automatically better if a study resource removes concepts still tested under the current examination blueprint.

Is CRMA Certification Worth It?

Whether CRMA certification is worth it depends on the type of work you want to perform.

It has particularly strong relevance if your responsibilities include:

• Enterprise risk management assurance
  
  

• Risk-based internal auditing
  
  

• Governance reviews
  
  

• Control assurance
  
  

• Audit leadership
  
  

• Compliance and regulatory assurance
  
  

• Technology and cybersecurity risk
  
  

• Strategic and project-risk assurance
  
  

• Reporting risk concerns to senior management or boards
  
  

CRMA is less about proving entry-level auditing knowledge and more about demonstrating that you can evaluate how effectively an organization understands, manages and monitors risk.

That distinction makes the CRMA Certified in Risk Management Assurance credential particularly relevant for professionals moving from performing individual audits toward enterprise-level risk assurance and advisory responsibilities.

Maintaining the CRMA Credential

Earning the credential is not the final requirement. Active practicing CRMA holders are generally required to complete 20 CPE hours annually, including at least two hours of ethics training, and complete annual certification renewal.

Annual renewal is available through CCMS, with the standard renewal deadline of 31 December. Failure to renew moves an active credential into Grace status, during which the holder may no longer represent themselves as actively certified.

Build Your CRMA Preparation Around Assurance Decisions

The biggest mistake in preparing for the certified in risk management assurance examination is studying it like a glossary test.

The CRMA syllabus repeatedly uses verbs such as evaluate, assess, analyze, determine, select, prioritize and formulate. That signals the real examination challenge: choosing the most appropriate assurance response when several answers appear reasonable.

Start with the official syllabus, give the 55% Risk Management Assurance domain the largest share of your preparation time, use a reliable CRMA certification study guide, practice scenario-based questions, and learn to distinguish management responsibilities from independent assurance responsibilities.

That approach prepares you not only to pass the CRMA exam, but also to apply risk-management assurance principles where the credential carries the most professional value.