PrepWhat is the CISA certification?
CISA is ISACA's certification for IT auditors. It tests whether you can plan and run risk-based audits of information systems and judge IT governance, system development, operations, resilience and security controls. You can take the exam at any stage, but full certification requires five years of relevant experience. See our CISA certification guide.
How do I get CISA certified?
To get CISA certified you pass the exam, then apply with at least five years of professional IS/IT audit, control, assurance or security experience gained within the 10 years before you apply. Waivers can cover up to three years; ISACA's pages do not list every qualifying substitution, so check with ISACA. You must apply within five years of passing and agree to ISACA's Code of Professional Ethics.
Is the CISA certification worth it?
CISA is worth it if you work, or want to work, in IT audit, risk, compliance or assurance. It is the ISACA credential built for people who review information systems and controls, including external auditors moving into technology audit and security staff who want an audit credential. If you manage security rather than audit it, look at CISM instead.
What does CISA stand for?
CISA stands for Certified Information Systems Auditor. It is awarded by ISACA, and it is unrelated to the U.S. government agency also abbreviated CISA (the Cybersecurity and Infrastructure Security Agency). To earn it you pass the exam and show five years of IS audit, control, assurance or security experience.
How hard is it to get a CISA?
The CISA exam is demanding mainly because you must answer as an independent auditor, not as the person fixing the problem. It has 150 questions in four hours, and you need 450 on a 200-800 scale. The five-year experience requirement is the other hurdle. Check your level with our free CISA practice test.
How much does CISA cost?
The CISA exam costs US$575 for ISACA members and US$760 for non-members. After passing, a one-time US$50 application processing fee is due, then an annual maintenance fee of US$45 (members) or US$85 (non-members). ISACA membership dues vary by country, so whether joining saves money depends on where you live.
What is an information systems audit?
An information systems audit is an independent review of whether an organization's IT systems and controls protect assets, keep data accurate and support business goals. Auditors gather objective evidence about governance, development, operations, resilience and security, then report their findings to management. This is the work the CISA exam tests.
How many questions are on the CISA exam?
The CISA exam has 150 multiple-choice questions and lasts four hours (240 minutes). Some items are unscored pretest questions you cannot identify, so answer everything. You can test at a PSI center or by remote proctoring, in seven languages including English, Spanish and Japanese.
What is the CISA passing score?
You need 450 or higher on ISACA's scaled range of 200 to 800 to pass CISA. The scaled score is based on the total number of questions answered correctly, not on separate domain scores. ISACA allows four attempts within a rolling 12-month period, paying the full fee each time.
How long should I study for CISA?
As an editorial estimate, most people with an IT background need about 10 to 12 weeks of part-time study. ISACA does not publish a figure. Working IT auditors may need 6 to 8 weeks, while accountants moving into IT audit often need 12 to 16. Our CISA study guide has a 12-week plan.
What does the current CISA exam cover?
The CISA exam covers five domains: the auditing process (18%), governance and management of IT (18%), systems acquisition and development (12%), operations and business resilience (26%) and protection of information assets (26%). According to ISACA's 2024 press release, this job practice took effect on August 1, 2024. See the CISA study guide.
How do I keep my CISA certification?
You keep CISA by earning at least 20 CPE hours each year and 120 CPE hours over each three-year reporting period. You also pay the annual maintenance fee by 1 January: US$45 for ISACA members or US$85 for non-members, with lower fees from your third ISACA certification onwards.
Should I get CISA or CISM?
Choose CISA if you audit IT and its controls, and CISM if you manage an information security program. Both are ISACA certifications with the same exam length, fees and passing score, but CISA needs audit, control, assurance or security experience while CISM needs security management experience. Our CISA vs CISM comparison helps you choose.