CISA certification combines exam success, certification requirements, practical audit competence, and continuing professional obligations after approval. Treating it as mainly an exam creates a misleading picture of what candidates must prepare for and sustain.
The ISACA CISA certification is designed for professionals who audit, assess, monitor, or advise on information systems and related controls. It is most relevant to IT auditors, assurance professionals, security and compliance practitioners, and IT professionals whose work involves governance, risk, control testing, or audit evidence.
What the CISA certification represents
CISA stands for Certified Information Systems Auditor. The credential was introduced by ISACA in 1978 and has become a recognised benchmark for professionals who work with information systems audit, assurance, control, and governance. Its value comes from the way it connects technical systems knowledge with audit judgement, evidence quality, and business risk.
In practice, CISA is less about memorising isolated control names and more about understanding how an auditor plans work, evaluates controls, tests evidence, reports findings, and follows up with stakeholders. A candidate who has worked on access reviews, change management testing, operations controls, system development reviews, cloud configuration assessments, or third-party risk reviews will usually find the exam concepts easier to place in context.
CISA is also often compared with other ISACA credentials. CISA validates information systems audit and assurance skills, while CISM is more focused on managing information security programmes and CRISC is more focused on risk identification, assessment, control design, and monitoring. The better choice depends on day-to-day responsibilities: audit and assurance point toward CISA, security programme management toward CISM, and enterprise IT risk work toward CRISC. Readers comparing adjacent options can review ISACA training courses at Readynez as a starting point for mapping those paths.
Who can sit the CISA exam, and who can become certified
A common source of confusion is the difference between sitting the CISA exam and earning the CISA certification. Candidates do not need to have all required professional experience before taking the exam. The experience requirement applies when applying for certification after passing the exam, subject to ISACA’s current certification policies.
At a high level, certification requires relevant professional experience in information systems auditing, control, assurance, or security. ISACA allows certain substitutions and waivers for education and related credentials, subject to limits and documentation requirements. Because these rules can change, candidates should confirm the current details in ISACA’s official candidate guide and certification application guidance before making decisions based on eligibility or waiver assumptions.
Documenting experience should be treated as part of the certification project rather than an afterthought. Candidates should map job duties to CISA-relevant tasks, such as audit planning, walkthroughs, IT general controls testing, application control reviews, governance assessments, risk evaluation, evidence collection, and reporting. Supervisor attestations are easier to secure when the candidate can clearly explain which duties align to information systems audit and assurance work.
Exam format, scoring, and what scaled scoring means
The CISA exam contains 150 multiple-choice questions and is delivered over four hours. ISACA reports results on a scaled score from 200 to 800, with 450 as the passing score. The passing score should not be interpreted as a simple percentage, because scaled scoring adjusts raw performance into a common reporting scale.
That scoring model has practical implications for exam strategy. Candidates should aim for steady accuracy across the full paper rather than spending too long trying to perfect individual questions. Four hours sounds generous, but it can disappear quickly when scenario-based questions require careful reading and elimination of plausible distractors.
A sensible pacing approach is to move through the exam with strict time discipline, flag uncertain questions, and return only after completing the full pass. This reduces the risk of leaving easier questions unanswered late in the session. It also helps manage cognitive load, because the exam tests judgement across audit planning, governance, acquisition, operations, resilience, and asset protection rather than one narrow technical topic.
CISA domains and what they test
The CISA exam content is organised into domains with weightings published by ISACA. Candidates should verify the current exam content outline before studying, because domain names, task statements, and weighting can be updated. The current structure places the greatest emphasis on protection of information assets and information systems operations and business resilience, which means practical control evaluation matters as much as audit process theory.
| CISA domain |
Weighting |
What it tests in practice |
| Information System Auditing Process |
|
How audits are planned, scoped, executed, evidenced, reported, and followed up. |
| Governance and Management of IT |
|
How IT aligns with organisational objectives, risk appetite, policies, performance, and oversight. |
| Information Systems Acquisition, Development and Implementation |
|
How projects, SDLC practices, change, testing, migration, and implementation risks are assessed. |
| Information Systems Operations and Business Resilience |
|
How operations, service management, incident handling, backup, recovery, and continuity controls are evaluated. |
| Protection of Information Assets |
|
How security controls, access, cryptography, network protection, data handling, and monitoring are assessed. |
These domains become easier to study when translated into audit tasks. A candidate might plan an audit, perform a process walkthrough, test IT general controls for access, change, and operations, review SDLC approvals, assess cloud configurations against policy or CIS benchmarks, evaluate third-party risk, and report findings in language that management can act on. That practical frame prevents the exam from becoming a collection of abstract definitions.
A practical six-to-eight week study plan
A study plan should reflect the exam weighting without ignoring smaller domains. Higher-weighted areas deserve more time, but the lower-weighted acquisition and development domain can still affect the result, especially for candidates with limited project or SDLC exposure. The plan below assumes a candidate has some audit, security, IT operations, or governance background and can study consistently each week.
- Week one: review the exam content outline, take a baseline practice test, and identify weak domains before reading in depth.
- Week two: study the information system auditing process, focusing on audit planning, evidence, sampling concepts, reporting, and follow-up.
- Week three: study IT governance and management, linking policies, risk, organisational structure, performance measures, and assurance expectations.
- Week four: study acquisition, development, and implementation, with emphasis on SDLC controls, project risk, testing, migration, and change governance.
- Weeks five and six: spend concentrated time on operations, resilience, and protection of information assets, because these carry the highest weighting and often contain scenario-heavy questions.
- Week seven: complete mixed practice sets under timed conditions, review explanations, and build a short list of recurring judgement errors.
- Week eight: sit at least one full timed practice exam, refine pacing, and use the final days for targeted review rather than broad rereading.
The most common study mistake is treating practice questions as a memory bank. Their real value is diagnostic. Each wrong answer should be reviewed for the reasoning error behind it: misunderstanding the audit objective, choosing a management action when the question asks for an audit response, prioritising technology over risk, or missing a keyword such as “first,” “best,” or “most appropriate.”
Candidates who prefer an instructor-led, time-boxed route can use a structured CISA course and exam readiness bootcamp to consolidate the domains and practise exam-style reasoning. The important point is that any course, book, or question bank should be tied back to the official exam content outline rather than followed passively.
Scheduling the exam and choosing a delivery option
CISA exams are scheduled through ISACA’s authorised exam delivery process. Candidates should review official scheduling, rescheduling, identification, and exam-day policies before selecting a date, especially if work travel, audit deadlines, or month-end responsibilities could interfere with availability.
Remote proctoring and test centre delivery each have trade-offs. Remote delivery offers control over travel time and a familiar environment, but it depends on a stable internet connection, a compliant room, camera readiness, and a quiet period without interruptions. A test centre reduces home-environment risk and technical setup burden, but it introduces travel time, local conditions, and less control over the physical environment.
The safer choice is the one with fewer preventable distractions. Remote candidates should run system checks early, prepare the room, remove unauthorised materials, and have a contingency plan for connectivity issues. Test centre candidates should plan arrival time, route, identification, and food or hydration around a four-hour exam session.
Applying for certification after the exam
Passing the exam is an important milestone, but it does not automatically grant the credential. Candidates must submit the CISA certification application, document relevant work experience, agree to ISACA’s Code of Professional Ethics, and comply with continuing professional education requirements after certification is awarded.
The application is easier when evidence has been gathered before the pass result. Job descriptions, audit plans, control test workpapers, risk assessment responsibilities, system review tasks, and supervisor confirmations can help demonstrate how the candidate’s work maps to the certification requirements. Sensitive employer information should not be submitted unnecessarily; the aim is to describe duties clearly and obtain appropriate verification.
Ethics also matters beyond the application form. CISA holders are expected to maintain professional conduct, confidentiality, objectivity, and competence. In audit and assurance roles, those principles affect how findings are written, how conflicts are handled, and how evidence is represented to stakeholders.
Maintaining CISA through CPE
CISA certification maintenance requires continuing professional education across an annual and multi-year reporting cycle, along with adherence to ISACA’s current maintenance policies. Candidates should check the official CPE policy for the current annual minimum, multi-year total, reporting rules, and any certification maintenance fees rather than relying on informal summaries.
CPE records should be maintained with the same discipline as audit evidence. Certificates of completion, agendas, learning objectives, attendance confirmations, and relevance notes can all matter if activities are selected for review. The practical habit is to record CPE shortly after completing an activity, while details are still available.
Maintenance should also be used to close capability gaps, not simply to collect hours. A CISA holder working more with cloud audits may prioritise cloud security, identity, logging, and configuration assessment. Someone moving toward governance may focus on risk management, control frameworks, regulatory expectations, and board-level reporting. Options such as Unlimited Security Training can support ongoing development when a professional expects to maintain skills across several security and audit topics.
Career relevance for audit, security, and GRC roles
CISA is strongest when it supports work that requires independent assessment of systems and controls. It is commonly relevant for IT auditors, internal auditors with technology scope, security analysts moving into assurance, compliance professionals, risk practitioners, and consultants who evaluate control environments.
The credential can also help technical professionals communicate with audit and governance stakeholders. For example, an infrastructure or cloud engineer who understands audit evidence, control design, and risk language is better placed to support reviews without treating them as paperwork exercises. Meanwhile, auditors with stronger systems knowledge can ask better questions and identify control weaknesses that purely process-based reviews might miss.
Membership considerations may also affect preparation quality. ISACA membership is often discussed in terms of fee differences, but candidates should also consider access to local chapters, peer study groups, professional events, and official preparation resources such as question databases. Those resources can improve study structure and expose candidates to the judgement-based style of audit discussion.
Readers who want broader context on security, audit, and compliance topics can continue with Security, audit and compliance articles covering related professional skills and technology themes.
FAQ
Do candidates need five years of experience before sitting the CISA exam?
No. The professional experience requirement applies to becoming certified, not simply sitting the exam. Candidates can pass the exam first and then complete the certification application process according to ISACA’s current rules.
What is the CISA exam format?
The CISA exam has 150 multiple-choice questions and a four-hour time limit. The questions are organised around five domains covering audit process, IT governance, acquisition and implementation, operations and resilience, and protection of information assets.
What is the passing score for the CISA exam?
ISACA reports CISA exam results on a scaled score from 200 to 800, with 450 as the passing score. This should not be converted into a simple percentage, because scaled scoring is used to report performance consistently.
How long should candidates study for CISA?
Many candidates use a six-to-eight week plan if they can study consistently and already have some relevant audit, security, governance, or IT experience. Candidates with less exposure to audit methods or information systems operations may need more time.
How should candidates prepare their CISA certification application?
Candidates should map their work experience to CISA-relevant duties, gather role descriptions or supporting evidence, and secure supervisor attestations where required. The strongest applications describe actual responsibilities clearly rather than relying on job titles alone.
Building a CISA plan that holds up in practice
The most effective CISA preparation connects the official exam outline with real audit work: planning, evidence, control testing, risk judgement, and clear reporting. Candidates should use domain weightings to guide study time, practise under timed conditions, and prepare certification documentation before it becomes urgent.
A practical next step is to verify the latest ISACA policies, choose an exam window, and build a study plan that matches current workload and experience. If structured support would help, Readynez can discuss preparation options and next steps through a short conversation with the training team.
