CISA exam resources

The Certified Information Systems Auditor (CISA) is ISACA's credential for professionals who audit, monitor and assess information technology and business systems. ISACA describes it as the standard of achievement for the IS audit profession, and the credential has real institutional weight behind that claim: it dates from 1978, has been earned by more than 200,000 professionals, is accredited by ANSI under ISO/IEC 17024:2012, and is approved for use under the U.S. Department of Defense's cyberspace workforce program (DoD Manual 8140.03).

It is the natural credential for IT auditors, and it also serves people moving between audit and adjacent disciplines: internal auditors taking on systems-heavy work, security and risk professionals who need audit fluency, and controls specialists in regulated industries. Where the CIA is built around the internal audit function as a whole, the CISA is built around auditing the technology that runs the business — the two overlap in governance and risk territory but test genuinely different bodies of knowledge.

Per ISACA's official exam pages, the CISA exam is a computer-based test of 150 multiple-choice questions in 4 hours. Each question presents a stem with four options and one correct answer. The exam mixes scored items with unscored pretest items, and your result is based on the scored items regardless of which domains they come from.

Scoring uses a scaled score from 200 to 800, with 450 required to pass. A scaled score is a conversion of your raw performance onto a common scale so that results are comparable across exam forms — it is not a percentage, and ISACA does not publish a "percent correct" passing threshold, so treat any such figure you see elsewhere as estimation rather than fact.

The current exam content outline — the job practice effective for exams from 1 August 2024 — organises the CISA exam into five domains with these official weights:

The weighting tells you where the exam's centre of gravity sits: Domains 4 and 5 — operations, resilience and information-asset protection — together account for over half of the exam. Candidates from a pure audit background often underestimate the depth of the technology content those two domains carry; candidates from a security background often underestimate Domain 1's audit-process discipline. Study materials written before the August 2024 job practice may allocate emphasis differently — our blueprint update policy explains how we track official changes like that update.

CISA certification requires three things per ISACA's official requirements: passing the exam, meeting the experience requirement, and applying for certification (with a US$50 processing fee). The experience requirement is five years of professional information systems auditing, control or security work, gained within the ten years preceding your application — and you must apply within five years of passing the exam.

Up to three of the five years can be satisfied through substitutions — for example, ISACA's published waivers allow one year for an associate's degree, two years for a bachelor's degree, or three years for a master's degree in information systems or a related field, and one year for general IS or audit experience. The combination rules have detail to them, so before planning around a waiver, confirm your specific situation against ISACA's official requirements page. You can sit the exam before the experience is complete — many candidates do — but the certification itself waits for the application to be approved.

ISACA runs continuous testing: there are no exam windows, and you can register at any time. Registration gives you a 365-day eligibility period in which to schedule and take the exam, at an authorised PSI test centre or via remote online proctoring. Appointments can be scheduled up to 90 days ahead, and rescheduling is free until 48 hours before your appointment.

If you don't pass, ISACA's retake policy allows up to four attempts within a rolling twelve-month period — with a 30-day wait after a first attempt and 90-day waits after the second and third. Each attempt requires the full exam fee, which makes a genuinely honest self-assessment of readiness worth real money.

As of our August 2026 review, ISACA lists the exam registration fee at US$575 for ISACA members and US$760 for non-members — nonrefundable, nontransferable, and payable in full before scheduling. After certification, maintaining the credential costs an annual maintenance fee (US$45 members / US$85 non-members) plus continuing education: at least 20 CPE hours every year and 120 hours over each three-year cycle.

Fees change; always confirm the current amounts on ISACA's exam candidate guide pages before budgeting. Whether ISACA membership pays for itself depends on your situation — the exam-fee discount alone covers a substantial share of a typical membership, which is worth checking rather than assuming in either direction.

This hub is the start of Certuvo's CISA library: domain-by-domain deep guides are in the pipeline and will publish only after passing the same three-stage editorial review as our CPA, CMA and CIA guides — never before. Our free study-plan generator and cost calculator now model CISA, with the hour estimates and fee categories researched to the same standard as this page — including continuous testing and the member/ non-member exam pricing above. Everything factual here is dated, reviewed on a schedule, and correctable through our public corrections policy.