The cover depicts a hypothetical situation. It does not show an actual audit or establish the qualifications of anyone pictured.
Before asking someone for a "CIA signature," I would first ask what document needs to be signed. Verification of experience for certification, an internal audit report, and an auditor's report on financial statements serve different purposes and have different people responsible for them. Calling all three a signature can lead us to the wrong person from the start.
CIA is a professional certification in internal auditing. It stands for Certified Internal Auditor and is issued by The Institute of Internal Auditors (The IIA). The Institute of Internal Auditors of Thailand (IIAT) uses the Thai name "วุฒิบัตรผู้ตรวจสอบภายในที่ได้รับการรับรอง." A CIA certification is distinct from a Thai Certified Public Accountant (CPA) license. Holding a CIA certification alone does not confer the legal authority to sign an auditor's report in place of a licensed CPA. [IIAT information on the CIA]
This is the first article in the series "What CIA, CPA, and CFA Prepare You to Do." I start with the question the work needs to answer, then consider the relevant qualification. Letters after a person's name do not tell us what that person has been assigned to do in the decision at hand.
A CIA looks at how a business operates
Internal auditing examines how an organization's governance, risk management, and controls work. Auditors gather evidence to provide assurance and advice while maintaining independence and objectivity. The work goes beyond checking whether numbers match on two documents. [Global Internal Audit Standards]
Consider a hypothetical parts manufacturer that uses an enterprise resource planning system (ERP) and receives a request to change a vendor's bank account. The owner might ask: Who verifies that the request really came from the vendor? Who changes the record? Does someone else check it before payment? A single approval document does not show whether those duties are separated in practice.
An auditor might trace a sample of bank-account change requests from receipt through payment, comparing who requested, changed, approved, and released each payment. If one person can perform every step, the next question is whether the organization deliberately accepts that risk or has another review in place. Evidence might include a change log, confirmation through a channel the organization trusts, and the actual payment records.
The search for evidence also has to account for ERP settings, work outside the system, and the team's constraints. Some systems may not retain the history an auditor wants, so the auditor must establish what data actually exists.
Separate three kinds of signatures
| Document or verification | What it confirms | Whose requirements to check |
|---|---|---|
| Experience for a CIA application | Work experience the applicant actually has, for The IIA to assess against its certification requirements | IIAT identifies a direct supervisor or a holder of a certification from The IIA, using the Certification Candidate Management System (CCMS). The verifier must be able to confirm the facts; the role is not restricted to CIA holders. |
| Internal audit report | Results within the audit's objectives and scope, with conclusions or recommendations | Check the internal audit function's authority and the chief audit executive's approval of the final communication under the standards. The signer's certification alone is not enough. |
| Auditor's report on financial statements | The auditor's opinion on the financial statements under the applicable standards and law | Check the auditor's license and legal authority for that engagement. CIA certification does not replace a Thai CPA license. |
The table draws on IIAT's guidance on experience verifiers The IIA's standards for communicating results, and Thailand's Accounting Professions Act B.E. 2547 (2004) . Saying "it has a signature" is therefore insufficient. We need to know the capacity in which the person signed and the rules that apply.
Another common point of confusion is timing. The IIA explains that experience verification must be complete before certification is awarded and may be submitted during the program. An applicant does not have to wait until passing every exam part to begin seeking verification. [CCMS questions and answers]
Who fixes a weakness when an auditor finds one?
Return to the hypothetical factory. If the person who changes a vendor's bank account can also release the payment, a useful finding should state what the auditor found, what evidence supports it, and the possible effect. Simply writing "controls are inadequate" leaves the people responsible unsure what to change.
Auditor
Reviews evidence, explains the risk, recommends a response, and follows up within the engagement's scope
Process owner
Chooses the response, assigns people and dates, and keeps the process operating under appropriate controls
One recommendation might be to assign vendor-data maintenance and payment release to different people, or add a reviewer where the team is too small to separate those jobs. Management must choose a workable response, name an owner, and set a follow-up date. The auditor can then examine evidence of whether the change took place.
This matters directly to people who implement systems. We may help design permissions and approval steps, but providing assurance on a process we designed ourselves raises conflicts and calls for safeguards to protect objectivity. Depending on the work, an independent reviewer or a suitable separation of roles may be needed. CIA certification does not remove that constraint.
The CIA path involves more than passing exams
For applicants with a bachelor's degree, The IIA specifies two years of relevant experience; for those with a master's degree, one year. Experience may come from internal auditing or related fields under the criteria, such as risk management, internal control, and compliance. The actual duties and evidence matter more than a job title alone. [The IIA's CIA requirements]
The usual exam has three parts covering the foundations of internal auditing, performing audit engagements, and the work of the internal audit function. The current topic names and content appear in the official exam syllabus which also provides a Thai document for reference.
The program allows three years from application approval, so applicants need to plan to meet all requirements within that period. Passing the exams does not by itself mean certification has been awarded. The applicant must also complete the documentation and other requirements set by The IIA.
Associate-degree holders, students, and applicants without a degree have paths and conditions that need individual review. Check the options currently available in CCMS and ask IIAT before paying an application fee. [The IIA's candidate handbook]
After certification, holders also face renewal, continuing education, and ethics requirements. The time and work involved during application and in maintaining the credential deserve attention alongside the number of exam parts.
Choose the person by the question the business needs answered
If the question is "Where are the gaps in purchasing, receiving, and payment?" internal audit expertise can help define the scope and examine evidence. If the need is a legally recognized opinion on financial statements, the CPA's work and authority must be considered. Assessing an investment's value and risk is another task, which I will cover in the CFA article.
Before asking for a signature, ask the issuer for the document name, its purpose, and its rules for who may verify or sign it. Then choose someone with the authority and information to attest to that particular matter. Starting with the document helps get the role right.
Official sources were checked on October 18, 2026. The factory and control examples are hypothetical scenarios by the author. They are not audit findings, confirmation of anyone's qualification, or a determination of anyone's legal authority. Check the current application requirements with the relevant organization.
