PrepCertified Information Systems Auditor (CISA)
CISA is ISACA's certification for IT auditors. It tests whether you can plan and run risk-based audits of information systems and judge IT governance, system development, operations, resilience and security controls. You can take the exam at any stage, but full certification requires five years of IS audit, control, assurance or security experience.
Who it is for
- IT auditors and internal auditors who review information systems and controls
- Risk, compliance and control professionals who assess IT controls for regulators or management
- External audit and assurance staff moving into technology audit work
- Security professionals who want an audit and assurance credential alongside a security one
The exam at a glance
| CISA | |
|---|---|
| Exam | CISA Certification Exam (job practice effective August 1, 2024) |
| Questions | 150 multiple-choice |
| Time | 240 min |
| Format | Computer-based multiple-choice exam at PSI test centers or by remote proctoring. Some items are unscored pretest items. Offered in English, Spanish, Chinese Simplified, French, German, Korean and Japanese. Registration gives a six-month eligibility window. Retake policy: four attempts within a rolling 12-month period (wait 30 days before the second attempt and 90 days before the third and fourth), with the full fee paid for each attempt. |
| Passing | 450 or higher on a scaled score range of 200-800. The score is based on the total number of items answered correctly. |
| Price | US$575 for ISACA members, US$760 for non-members (exam registration). A one-time US$50 application processing fee is due when applying for certification after passing. |
| Prerequisites | None to sit the exam. To become certified: at least five years of professional IS/IT audit, control, assurance or security work experience, gained within the 10 years before the application date. Experience waivers are available for a maximum of three years. Apply within five years of passing the exam and agree to ISACA's Code of Professional Ethics. |
| Validity | Earn at least 20 CPE hours each year and 120 CPE hours over each three-year reporting period, and pay the annual maintenance fee by 1 January: US$45 for members, US$85 for non-members (US$25 / US$50 for a third or later ISACA certification). |
Checked against the official ISACA pages on 2026-11-07: www.isaca.org, www.isaca.org, www.isaca.org, www.isaca.org, www.isaca.org, www.isaca.org. Exam details change; confirm on the issuer's site before you book. Some details could only be confirmed from secondary sources and are marked for re-checking.
Exam domains
CISA
| Domain | Weight |
|---|---|
| Information System Auditing Process | 18% |
| Governance and Management of IT | 18% |
| Information Systems Acquisition, Development and Implementation | 12% |
| Information Systems Operations and Business Resilience | 26% |
| Protection of Information Assets | 26% |
How to prepare
- Download the CISA exam content outline and rate yourself against each of the five domains
- Check your experience against the five-year rule and the three-year waiver limit before you pay
- Give most time to the two biggest domains, operations and business resilience and protection of information assets, at 26% each
- Learn to answer as an independent auditor: choose the option that gives objective evidence and reports facts, not one where the auditor takes over management's job
- Practise timed sets of 150 questions to build stamina for a four-hour exam
- Book within your six-month eligibility window and plan the US$50 application within five years of passing
CISA guides
FAQ
How many questions are on the CISA exam?
150 multiple-choice questions in four hours (240 minutes). Some are unscored pretest items, and you cannot tell which, so answer every question.
What is the CISA passing score?
450 or higher on ISACA's scaled range of 200 to 800. The scaled score is based on the total number of questions you answer correctly, not on separate domain scores.
How much does the CISA exam cost?
US$575 for ISACA members and US$760 for non-members, plus a one-time US$50 application fee when you apply for certification after passing.
How do I keep the CISA?
Earn at least 20 CPE hours a year and 120 over each three-year period, and pay the annual maintenance fee of US$45 (members) or US$85 (non-members) by 1 January.