Prep
What this CISA study guide covers
This CISA study guide gives you a 12-week plan for ISACA's Certified Information Systems Auditor exam, mapped to the five domains of the current CISA job practice. It also covers the exam format, how ISACA scores the CISA exam, and what tends to make the questions hard for people who come from technical roles.
All exam facts on this page come from ISACA's CISA pages, the CISA exam content outline and ISACA's 2026 Exam Candidate Guide, checked on November 7, 2026. The study plan and the advice on how to pass CISA are our editorial recommendations, not ISACA guidance.
| Item | Detail |
|---|---|
| Questions | 150 multiple choice |
| Time | 4 hours (240 minutes) |
| Passing score | 450 on a 200 to 800 scale |
| Exam fee | USD 575 member / USD 760 non-member |
| Largest domains | Operations and Business Resilience 26%, Protection of Information Assets 26% |
| Experience to certify | 5+ years, within 10 years before applying; waivers up to 3 years |
| Maintenance | 20 CPE hours a year, 120 per 3 years, annual fee |
CISA exam facts
- Questions: 150 multiple-choice questions.
- Time: 4 hours (240 minutes).
- Scoring: a scaled score from 200 to 800. You need 450 or higher to pass. ISACA explains that 800 is a perfect score and 450 represents the minimum standard of knowledge.
- Delivery: computer-based, at a PSI test center or by remote proctoring. Registration is continuous, and your eligibility to schedule lasts six months from registration.
- Languages: English, Spanish, Chinese Simplified, French, German, Korean and Japanese.
- Exam fee: USD 575 for ISACA members, USD 760 for non-members. Fees are non-refundable and non-transferable.
- Retakes: four attempts within a rolling 12-month period. You wait 30 days after a first failed attempt and 90 days before the third and fourth. Each attempt means paying the registration fee again.
Passing the exam is only the first step. To become certified you also apply with five or more years of IS audit, control, assurance or security experience, gained within the 10 years before you apply, and pay a one-time USD 50 application fee. ISACA's candidate guide says experience waivers are available for a maximum of three years. You have five years from passing to apply.
The five CISA exam domains and their weights
The CISA exam domains, from ISACA's exam content outline, decide how you should split your time. Two domains make up more than half the exam.
| Domain | Weight | What it covers |
|---|---|---|
| 1. Information System Auditing Process | 18% | Audit standards and ethics, risk-based audit planning, control types, sampling, evidence, data analytics, reporting and audit quality assurance |
| 2. Governance and Management of IT | 18% | Laws and standards, IT strategy and structure, enterprise architecture and risk management, privacy and data governance, vendor and IT resource management |
| 3. Information Systems Acquisition, Development and Implementation | 12% | Project governance, business cases, development methodologies, control design, testing, release management, migration and post-implementation review |
| 4. Information Systems Operations and Business Resilience | 26% | IT operations, asset and change management, incident and problem management, log and database management, business impact analysis, backup, business continuity and disaster recovery |
| 5. Protection of Information Assets | 26% | Security frameworks, physical controls, identity and access management, network and endpoint security, encryption and PKI, cloud and mobile, security testing, monitoring and incident response |
Each domain is split into a Part A and a Part B in the outline. ISACA also publishes task statements, such as assessing change, configuration and patch management or performing post-implementation reviews. Read them: they describe what an auditor does, which is exactly the angle the questions take.
The 12-week CISA study plan
This plan assumes about 8 to 10 hours a week, roughly 100 to 120 hours in total. We allocated weeks roughly in proportion to the domain weights, and put the auditing process first because every other domain is tested through an auditor's eyes.
| Week | Focus | What to do |
|---|---|---|
| 1 | Baseline and Domain 1, Part A | Take a short diagnostic quiz. Read the full exam content outline. Study audit standards, ethics, audit types and risk-based planning. |
| 2 | Domain 1, Part B | Audit execution: sampling, evidence, data analytics, reporting, follow-up. Do 40 to 60 practice questions on Domain 1. |
| 3 | Domain 2, Part A | IT governance: strategy, policies, enterprise architecture, enterprise risk management, privacy and data governance. |
| 4 | Domain 2, Part B | IT management: resources, vendors, KPIs and KRIs, quality management. Mixed quiz on Domains 1 and 2. |
| 5 | Domain 3 | Acquisition and development: business cases, SDLC controls, testing, migration and post-implementation reviews. |
| 6 | Domain 4, Part A | Operations: change, configuration and patch management, incident and problem management, logging, databases, service levels, shadow IT. |
| 7 | Domain 4, Part B | Business resilience: business impact analysis, backup and restoration, BCP and DR plans and how an auditor tests them. |
| 8 | Domain 5, Part A | Asset security and control: frameworks, physical controls, IAM, network and endpoint security, encryption, PKI, cloud and mobile. |
| 9 | Domain 5, Part B | Security event management: awareness training, attack methods, security testing, monitoring, incident response and forensics. |
| 10 | Weak-domain review | Mixed questions across all five domains. Rework every domain where you score lowest. |
| 11 | Full-length practice | One timed 150-question session in 4 hours. Review every miss and write down why the right answer was better. |
| 12 | Final review | Second timed session, light review of notes, rest before exam day. |
If you already work in IT audit, you can likely compress weeks 1 and 2. If you come from a security or operations background, expect Domains 4 and 5 to feel familiar and Domains 1 and 2 to need the most work.
How to pass CISA: think like an auditor
The main reason technical people find the CISA exam harder than expected is the viewpoint. Most questions ask what the IS auditor should do, recommend or check first. The best answer is usually not the most technical fix. Keep these habits in mind:
- The auditor reports and recommends; management decides and implements. An answer where the auditor fixes the problem personally is usually wrong, because it threatens independence.
- Risk comes first. Audit planning is risk-based, so answers that start by understanding the business and its risks often beat answers that jump straight to testing.
- Evidence matters. Independent, documented evidence is stronger than verbal assurance from the person being audited.
- Read the qualifier. Words like FIRST, BEST, MOST and PRIMARY decide the question. Several answers can be true; only one fits the qualifier.
ISACA's candidate guide notes that your score is based on the number of questions answered correctly. Answer every question, even when you are unsure.
Practice questions and review
Reading alone will not get you through 150 scenario questions. We recommend starting practice questions in week 1 and never stopping. Retrieval practice is one of the best-supported study methods; see our page on the testing effect.
- After each study block, answer questions on that domain only.
- From week 5, mix domains so you learn to identify which domain a question belongs to. This is interleaving.
- Keep an error log: question topic, the answer you chose, the correct answer and the reasoning. Review it weekly.
- Space your reviews of earlier domains; see spaced repetition.
Start with our free CISA practice test to find your weakest domain before you commit to a schedule.
How long to study for the CISA exam
ISACA does not publish a recommended number of study hours, and it does not publish pass rates, so we do not quote any. Our 12-week plan assumes some IT background. Use this rough guide, which is our estimate rather than an ISACA figure:
- Working IT auditor: 6 to 8 weeks, mostly practice questions and Domain 3 to 5 refreshers.
- Security, risk or IT operations professional: 10 to 12 weeks, with extra time on Domains 1 and 2.
- Accountant or financial auditor moving into IT audit: 12 to 16 weeks, with extra time on Domains 4 and 5.
Book the exam once you consistently score well on mixed, timed practice questions you have not seen before.
After you pass
Apply for certification within five years of passing, with your experience verified and the USD 50 fee paid. Once certified, ISACA requires at least 20 CPE hours each year and 120 over each three-year period, plus an annual maintenance fee of USD 45 for members or USD 85 for non-members, due by 1 January.
If you are deciding between ISACA certifications, our CISA vs CISM comparison explains when the audit credential or the security management credential fits better. For the wider picture, see the cybersecurity certification roadmap, and visit the CISA certification hub for the exam overview.