So I just got my results back last week and I finally passed the CGAP on my second try. First attempt I scored a 71 — needed a 75 to pass — and I was devastated. I'd been a government auditor for six years and honestly thought my work experience would carry me through. It didn't. The exam goes way deeper on internal audit standards and risk assessment frameworks than I expected.
What changed the second time around was being more systematic. I spent about eight weeks studying, roughly 10-12 hours per week. The IIA's IPPF standards are absolutely fair game and I'd underestimated how much you need to internalize them, not just recognize them. I found a solid CGAP practice test that mimicked the real question style, which helped me get comfortable with the scenario-based questions — those tripped me up badly the first time.
For anyone currently in the trenches, my biggest CGAP exam tip is to focus on the government-specific standards that differ from the private sector IIA guidance. That's where the exam really tests whether you actually work in the public sector or just memorized generic audit content. Happy to answer questions if anyone's prepping right now.