The CCSA candidates must meet the following eligibility requirements for education, character and work experience.
Education: CCSA candidates must have a bachelor’s (four-year) degree or equivalent. Two years of post-secondary schooling with an accredited organization plus three years of general business experience may be substituted for a bachelor’s degree.
The Global Board of Directors has approved an alternate path to eligibility for the CCSA for those candidates who do not possess a Bachelor’s degree from an accredited university. Candidates may now become eligible for the CCSA, subject to approval, who possess:
- Two years post-secondary education and five years verified experience in internal audit or its equivalent, OR
- Seven years verified experience in internal audit or its equivalent.
Character Reference: CCSA candidates must exhibit high moral and professional character and must submit a Character_Reference_Form signed by a CIA, CGAP, CCSA, CFSA or the candidate’s supervisor.
Work Experience: CCSA candidates must obtain one year of control-related business experience, such as CSA, auditing, quality assurance, risk management, or environmental auditing. A completed Experience_Verification_Form is required. Candidates may apply to the program and sit for the exam prior to satisfying the professional experience requirement, but will not be certified until all program requirements have been met.
Facilitation Experience/Training: CCSA candidates must obtain at least seven hours of acceptable facilitation experience or at least 14 hours of acceptable facilitation training. To be considered acceptable, facilitation experience or training must meet the guidelines listed on the CCSA_Facilitation_Validation_Form. Validation of facilitation experience/training may accompany application or be submitted later.
Candidates may apply to the program and sit for the exam prior to satisfying the professional experience requirement, but will not be certified until all program requirements have been met. The certification program’s eligibility requires candidates to complete the program certification process within four years of application approval. If a candidate has not completed the certification process within four years, all fees and exam parts will be forfeited.
You need to apply for admission by loggin in to the CCMS-system.
The CCSA exam is offered in one part containing 125 multiple choice questions. Candidates are given three hours and fifteen minutes to complete the exam. Some of the exam questions are included for research purposes only and do not affect the candidate’s score. These research questions are not identified, so candidates should answer all questions to the best of their ability. The use of research questions benefits CCSA candidates by allowing The IIA to include only pretested, statistically valid questions in scoring the CCSA exam.
CCSA Exam Topic Outline
The topics tested on the CCSA exam are framed in the context of a variety of industry situations. Candidates are not expected to be familiar with industry-specific controls, but should be able to relate to risks and controls that generally apply to business processes in various industries. Exam topics are subject to change.
The Certification in Control Self-Assessment (CCSA) exam covers the following domains. Click on the topic outline for details.
Domain I: CSA Fundamentals (5-10 percent)
Domain II: CSA Program Integration (15-25 percent)
Domain III: Elements of the CSA Process (15-25 percent)
Domain IV: Business Objectives/Organizational Performance (10-15 percent)
Domain V: Risk Identification and Assessment (15-20 percent)
Domain VI: Control Theory and Application (20-25 percent)
The IIA provides a limited number of sample CCSA exam questions (with answers) to give candidates an understanding of the types of questions that typically appear on the exam.
Apply for admission to the CCSA-program
The IIA’s Certification Candidate Management System (CCMS) is a powerful, user-friendly application to help you apply for, complete, and maintain your certifications and related information, while keeping you connected to and informed about The IIA’s certification programs.
After you log in, you’ll be able to:
- Apply for IIA certification programs.
- Register for IIA certification examinations.
- Review your certification status.
- View your exam score report.
- Review your next steps in the certification process.
- Update your personal information.
- Review your credential and exam history.
The CCSA exam is available through computer-based testing, allowing you to test year-round at more than 500 locations worldwide. Candidates are able to sit for exams at any IIA-authorized Pearson VUE testing center worldwide, regardless of whether the testing center is located in your hometown or country. To locate the testing centers nearest you, visit the Pearson VUE website. You must apply and register in The IIA’s Certification Candidate Management System (CCMS) prior to scheduling an exam.
You pay by credit card when applying for the program or register for an exam. As of 2015 the pricing structure is as follows:
Application Fee USD 200 USD 300
Exam Fee USD 350 USD 450
Exam Preparation Resource
The IIA publishes a CCSA study guide to assist candidates in preparing for the Certification in Control Self-Assessment exam.
Certification in Control Self-Assessment® (CCSA®) Study Guide
It is available for order through The IIARF’s Bookstore. The guide provides a general overview of the topics that will be covered in the exam. However, it is critical that candidates perform additional study in areas where their experience or background dictates the need for additional review. A list of reference materials is included in the study guide to provide additional resources to supplement your studies.
Sample Exam Questions
The IIA includes a limited number of sample CCSA exam questions (with answers) on its Web site to give candidates an understanding of the types of questions that typically appear on the exam.
Continuing Education Requirements
Candidates holding a Certification in Control Self-Assessement are responsible for maintaining and updating their knowledge and skills related to improvements and current developments in auditing standards, procedures, and techniques. This document contains the mandatory Continuing Professional Education (CPE) requirements for the Certification in Control Self-Assessment (CCSA) and specifies the method of reporting by CCSAs who wish to keep their designation in good standing.
CPE Requirements for CCSAs
This document contains the mandatory Continuing Professional Education (CPE) requirements for Certification in Control Self-Assessment Professionals (CCSAs). It also specifies the method of reporting by CCSAs who wish to keep their designation in good standing. Note: If you are a Certified Internal Auditor (CIA), the CPE reporting that you complete for the CIA program satisfies the CPE reporting requirements for the CCSA and all other IIA specialty certifications.
NOTE: If you are a Certified Internal Auditor® (CIA®), the CPE reporting that you complete for the CIA program satisfies the CPE reporting requirements for the CCSA and all other IIA specialty certifications. CPE reporting for specialty certifications requires that 25% of the hours earned must be in the specialty area of expertise.
CCSA professionals are responsible for:
- Maintaining their knowledge and skills.
- Updating their knowledge and skills related to improvements and current developments in internal auditing standards, procedures, and techniques.
CPE Requirement Regarding IIA Internnational Standards
- In order to encourage understanding of and compliance with The IIA’s International Standards for the Professional Practice of Internal Auditing (Standards), The IIA’s Professional Certification Board (PCB) has instated a requirement that CCSAs stay abreast of the Standards as part of their CPE.
- CCSAs must review or receive training on The IIA’s International Standards at some point during their CPE reporting period.
- If you are completing your CPE reporting form and have not already met this requirement, please take a moment to review the International Standards before submitting your form.
- While there, we also encourage you to review the Practice Advisories (accessible with an IIA member password) and other sections of The IIA’s Professional Practices Framework.
CPE Reporting Requirements
Certificate holders are required to self certify as to the completion of the required continuing education hours. It is the CCSA’s responsibility to assure that the CPE hours claimed conform to the guidelines established by The IIA’s Professional Certification Board (PCB). Forms are submitted by CIAs on an annual basis and serve as signed statements that all applicable CPE requirements have been met.
Candidates must submit CPE reporting via CCMS. The reporting deadline is December 31st of each year. Reporting is free for members of IIA Norway. Non-members pay USD 100 by credit card when reporting.
Each candidate should maintain a copy of the CPE reporting form, along with all supporting documentation, for at least three years after the records no longer apply to filed CPE reports. Records must be made available to IIA Norway on request from global IIA. The records maintained by the CIA in support of the reporting form filed with IIA Norway should include, as appropriate, the following information:
a. Title of program and/or description of content.
b. Dates attended.
c. Location of course or program.
d. Contact hours of credit as recommended by the course sponsor.
e. A letter, certificate, or other written independent attestation of course completion.
f. Documentation supporting publications, oral presentations, and committee or other participation.
A CCSA who is practicing control self assessment must complete a total of 20 hours of acceptable CPE each year.
A CCSA who is not practicing control self assessment may request non-practicing status by notifying the Certification Department in writing. Non-practicing CCSAs must complete a total of 10 hours of acceptable CPE every year. As long as their CPE requirements are met, non-practicing CCSAs may use the CCSA designation; however, if they resume practicing control self assessment, they must report as a practicing CCSA.
A CCSA who is not practicing control self assessment because of retirement may request retired status by notifying the Certification Department in writing. Retired CCSAs are not responsible for completing CPE requirements. Retired CCSAs may use the CCSA designation; however, if they resume employment, they must report as a practicing or non-practicing CCSA, as appropriate.
NIRF automatically places a CCSA in inactive status when the CCSA fails to meet established CPE requirements. CCSAs in the inactive status may not use the CCSA designation. Any wrongful use of the CCSA designation will be reported to the IIA’s Ethics Committee for disciplinary action.
Restoration to Active Status
Candidates that are inactive for less than 12 months need to report CPE for the prior year. The number of hours required is equivalent to the reporting status (practicing or non-practicing). Candidates that are inactive for greater than 12 months fall under the reinstatement policy and are required to submit 40 hours of CPE. In addition, inactive CCSAs will be required to pay the applicable reinstatement fee at the time of reporting.Qualifying CPE Activities
It is anticipated that CCSAs will maintain the high standards of the profession in selecting quality educational programs to fulfill the CPE requirements. The following general criteria are to be satisfied in order for a continuing education program to be accepted:
- The overriding consideration in determining whether a specific program is acceptable is that it shall be a formal program of learning that contributes directly to the professional competence of a CCSA.
- Acceptable formal programs should:
- Contribute to the professional competence of participants;
- State program objectives which specify the level of knowledge the participants should have attained, or the level of competence to be demonstrated upon completing the program;
- State education or experience prerequisites, if appropriate for the program;
- Be developed by individuals qualified in the subject matter and instructional design;
- Provide program content which is current;
- Be on a professional level and related to the CCSA Topic Outline.
The CCSA Examination Topic Outline includes:
- CSA fundamentals
- CSA program integration
- Elements of the CSA process
- Business objectives and organizational performance
- Risk identification and assessment
- Control theory and application
Activities other than those listed in this guidance may be deemed acceptable if the CCSA can demonstrate that they contribute to professional competence. Substantiating that a particular activity qualifies as acceptable and meets the requirements is the responsibility of the CCSA.
CPE credit will be awarded for whole hours only with a minimum of 50 minutes constituting one hour. As an example, 100 minutes of continuous instruction would count for two hours; however, more than 50 minutes but less than 100 minutes of continuous instruction would count for only one hour. Only class contact or acceptable self-study hours are allowable. For chapter meetings throughout the reporting period or continuous conferences/conventions when individual segments are less than 50 minutes, the sum of the segments should be considered one total program. For example, five 30-minute presentations would equal 150 minutes and should be counted as three contact hours.
Hours are awarded for the year in which the CCSA certification is earned. (Candidates receive 20 hours in the year the certification is awarded and 20 hours the subsequent year). The 40 CPE hours awarded for the CCSA certification are based on earning the certification.
A maximum of 20 CPE hours may be awarded in the education category each year reported. At least 5 of the 20 CPE hours required must be in this category. Educational activities include:
- Professional education and development programs, such as seminars and conferences, provided by national/federal, state, and local auditing and accounting organizations.
- Technical sessions at meetings of national/federal, state, and local auditing and accounting organizations and chapters.
- Formal in-house training programs.
- Programs of other sponsors (industrial, professional societies, etc.).
- College or university courses passed (credit and non-credit courses).
- Fifteen hours of CPE credit are awarded for each semester hour of college/university credit earned;
- Ten hours of CPE credit are awarded for each quarter hour of college/university credit earned.
- Other certification examinations passed.
- A maximum of 20 hours may be awarded in the year passed.
- 10 CPE hours are awarded for passing each part of another appropriate professional certification examination.
- Formal correspondence and self-study programs relevant to control self-assessment that include evidence of completion.
A maximum of 10 hours may be awarded in the publications category for each year for books, articles, research papers, and training materials. Generally, one full journal page of single-spaced print is equal to 2 hours of CPE credit. Contributions to publications should pertain to control self assessment audit disciplines related to CCSA Examination Topic Outline. Published articles or books not related directly to control self assessment audit are acceptable if CCSAs are able to demonstrate that these activities contribute to their professional proficiency.
A maximum of 10 hours may be awarded in the publications category each year. Generally one full journal page of single-spaced print is equal to two hours of CPE credit, with the following limits on one translation:
- Books: 12 hours
- Articles: 6 hours
- Research papers: 6 hours
Translations of publications should pertain to certification domains or disciplines related to the Common Body of Knowledge, and/or the specialty examination topic outlines. Translations of published articles or books not related directly to internal auditing are acceptable if the certified individual is able to demonstrate that these activities contribute to their professional audit proficiency.
A maximum of 10 CPE hours may be awarded in the oral presentation category each year.
- The hours reported for the first presentation will be based on the presentation time, plus credit for preparation time equivalent to three times the presentation time.
- Subsequent presentations of the same material may be reported as presentation time only, up to a maximum of 5 CPE hours each year.
A maximum of 10 CPE hours may be awarded in the participation category each year for participation as an officer or committee member in a professional industry organization related to control self assessment auditing. One CPE hour for each hour of qualifying participation will be awarded.
External Quality Assessments
A maximum of 10 CPE hours may be awarded each year in the category of external quality assurance review activities. One CPE hour will be awarded for each hour spent on site, with the following limits on any one quality assurance review activity:1. Independent (external) validation of an internal audit activity’s self-assessment (as defined in the IPPF): maximum of five CPE hours per review.
2.One-week external quality assurance review: maximum of five hours per review.
3.Two-week external quality assurance review: maximum of 10 hours.No CPE hours will be awarded for activities such as preparation time and writing the report.
The Institute will verify on a test basis the records of CCSAs and/or course sponsors in the manner it deems appropriate to determine compliance with the requirements set forth in this guidance. The potential penalty for submitting false information will be determined in accordance with the administrative directive, Disciplinary Policies and Procedures.