What Is CRMA Certification? 2026 Exam, Eligibility, Cost and Study Guide
CRMA Certification, or Certification in Risk Management Assurance®, is a specialist credential from The Institute of Internal Auditors (The IIA) for professionals involved in internal audit, governance, risk management, controls, and assurance. The current CRMA exam contains 120 questions and provides 150 minutes for testing. CIA certification is not required before pursuing CRMA. Eligibility is based on education and relevant professional experience, and candidates must complete all certification requirements within the applicable two-year program window.
CRMA stands for Certification in Risk Management Assurance.
The credential is issued by The Institute of Internal Auditors and focuses specifically on providing assurance over an organization's risk management and governance processes.
A useful CRMA definition is:
CRMA is a professional risk assurance certification that demonstrates a candidate's ability to evaluate governance, enterprise risk management, controls, and the effectiveness of risk-related processes.
The CRMA meaning should therefore not be confused with a general risk-management qualification. If you are looking for a hands-on IT risk credential instead, compare it with the CRISC certification.
The credential focuses strongly on risk assurance—evaluating whether management's approach to identifying, assessing, responding to, and monitoring risks is effective.
Who Is the CRMA Certification Designed For?
The IIA CRMA credential is particularly relevant for professionals working in:
Internal audit (the broader internal audit qualification is covered in our CIA certification guide)
Enterprise risk management
Governance
Compliance
Internal controls
Risk assurance
External audit
Quality assurance
Technology risk (see the CISA certification guide for IT audit roles)
Cybersecurity assurance
Strategic risk
It can be particularly useful for professionals whose responsibilities include evaluating risk-management frameworks rather than directly owning and managing individual business risks.
Is CRMA a Certification or a License?
CRMA is a professional certification and designation, not a government-issued license.
People occasionally search for CRMA license, but successful candidates receive the CRMA designation from The IIA.
The credential demonstrates professional competence in risk management assurance, governance, and internal audit responsibilities.
CRMA Exam Format in 2026
The current CRMA exam consists of one examination.
CRMA Exam Feature | Details |
Certification body | The Institute of Internal Auditors |
Full name | Certification in Risk Management Assurance |
Questions | 120 |
Exam duration | 150 minutes |
Exam language | English |
Number of syllabus domains | 3 |
CIA required first? | No |
Program completion period | 2 years |
Older CRMA preparation material may mention a different question count, so candidates should make sure their CRMA certification study material reflects the current exam structure.
What Are the CRMA Certification Requirements?
The CRMA requirements depend mainly on education and relevant professional experience.
Master's Degree or Higher
Candidates with a master's degree or equivalent generally need:
Proof of education
Valid identification
1 year of qualifying professional experience
Bachelor's Degree
Candidates with a bachelor's degree or equivalent generally need:
Proof of education
Valid identification
2 years of qualifying experience
Candidates Without a Bachelor's Degree
Candidates using an alternative education route may qualify with:
Appropriate secondary or equivalent educational documentation
Valid identification
5 years of relevant professional experience
Specific recency rules apply to this pathway.
Active IAP Holders
Professionals holding an active Internal Audit Practitioner (IAP) designation may also qualify for CRMA, with experience requirements depending on their education. (For how IAP compares with the full CIA, see our IAP vs CIA comparison.)
Qualifying professional experience can include:
Internal audit
Risk management
Compliance
External audit
Internal control
Quality assurance
Audit or assessment work
Candidates can generally sit for the examination before completing all required professional experience, but the experience requirement must be satisfied before receiving the certification.
What Is CRMA Eligibility Based On?
CRMA eligibility is not based on job title alone.
The IIA looks at the candidate's combination of:
Education
Relevant professional experience
Required documentation
Successful completion of the CRMA examination
This means someone working as a risk analyst, internal auditor, compliance professional, external auditor, control specialist, or assurance professional may potentially qualify if their experience meets The IIA's requirements.
Do You Need CIA Before CRMA?
No. The Certified Internal Auditor designation is not currently required before CRMA.
This is important because older websites and preparation resources may still state that candidates need to earn CIA first. If you do want both credentials, start with our CIA certification requirements, cost and exam structure guide.
Candidates preparing in 2026 should follow the current CRMA IIA requirements rather than older eligibility information.
What Does the CRMA Exam Cover?
The current syllabus contains three major domains.
CRMA Domain | Exam Weight |
Internal Audit Roles and Responsibilities | 20% |
Risk Management Governance | 25% |
Risk Management Assurance | 55% |
The most important preparation point is immediately visible from the table: Risk Management Assurance accounts for 55% of the exam.
Candidates should therefore spend more preparation time on this domain than on the other two.
Domain 1: Internal Audit Roles and Responsibilities – 20%
This part examines how internal audit contributes to risk assurance while maintaining independence and objectivity.
Candidates should understand:
Assurance responsibilities
Advisory activities
Internal audit independence
Coordination with other assurance providers
Risk assurance mapping
Required professional competencies
Organizational risk-management processes
One recurring concept is the difference between management responsibility and internal audit responsibility.
Management owns and manages risk.
Internal audit evaluates and provides assurance over whether those processes are effective.
Domain 2: Risk Management Governance – 25%
This domain focuses on how risk management connects with organizational governance and strategy. For the IT side of governance, see the CGEIT certification guide.
Important areas include:
Governance structures
Risk management frameworks
[Rest of your post continues here]
Keep Reading
Considering internal audit more broadly? Read the CIA certification guide.
Already a CPA, CA or CISA? See the CIA Challenge Exam guide.
Moving into IT audit? See the CISA exam guide, syllabus and fees.
Aiming for IT risk roles? Explore the CRISC certification guide.
Interested in fraud investigation? See the CFE requirements and exam cost.
Browse all audit, risk and governance certification guides.
Comments