The CISA exam from ISACA is a 150-question, four-hour multiple-choice test covering five job practice domains, with the current content outline effective August 2024. Passing requires a scaled score of 450 on a 200-to-800 scale. Passing the exam alone does not make you certified: you then have five years to apply, demonstrating five years of IS audit, control, assurance or security experience.
What the CISA exam covers
The CISA exam tests five job practice domains using 150 multiple-choice questions in four hours. The current content outline took effect in August 2024.
The Certified Information Systems Auditor (CISA) credential is issued by ISACA and aimed at professionals who audit, monitor and assess information systems. The exam consists of 150 questions covering five job practice domains, and all questions use one best answer drawn from four options.
ISACA's current CISA content outline has been effective since August 2024. Study materials older than that version can describe different domain names or weights, so check any resource against the outline in the official candidate guide. A domain heading tells you the topic area; the outline's supporting tasks describe what you are expected to do with it, such as planning audits against a risk-based IS audit strategy or evaluating controls across the systems development life cycle.
- Domains 4 and 5 together account for 52% of the outline, the largest share of tested content
- Domain-level results on your score report are informational only; scoring is based on total correct answers
| Domain | Weight | Coverage in brief |
|---|---|---|
| 1. Information System Auditing Process | 18% | Audit planning and execution, evidence, reporting, quality assurance |
| 2. Governance and Management of IT | 18% | IT governance, policies, enterprise risk, vendor and resource management |
| 3. Information Systems Acquisition, Development, and Implementation | 12% | Project governance, business cases, development methodologies, implementation |
| 4. Information Systems Operations and Business Resilience | 26% | Operations management plus business impact analysis, continuity and recovery |
| 5. Protection of Information Assets | 26% | Security controls, identity and access, encryption, incident response and forensics |
Official sources: ISACA 2026 Exam Candidate Guide: current exam rules and CISA outline effective August 2024 — Sections I-IV, Appendices; CISA® Exam Content Outline — Domain list and supporting tasks
Passing the exam is one step toward certification
A passing score lets you apply for certification. You must also pay a US$50 application fee, submit a verified experience application, and commit to ISACA's ethics and CPE policies within five years of passing.
Many candidates conflate the exam with the credential. ISACA is explicit that passing is only the first step. After your pass, you pay the US$50 application processing fee, submit an application demonstrating the experience requirements, and adhere to the Code of Professional Ethics, the Continuing Professional Education Policy and, for CISA, the Information Systems Auditing Standards.
You have five years from passing the exam to apply for certification. If you plan to change roles before applying, note that the experience requirement, covered next, is judged at application time, not at exam time.
Official sources: ISACA 2026 Exam Candidate Guide: current exam rules and CISA outline effective August 2024 — Sections I-IV, Appendices; CISA® Certification | Certified Information Systems Auditor® — Registration and certification pages
Experience requirements and waivers
Certification requires five years of IS audit, control, assurance or security experience, with defined waivers that can substitute up to three years of it.
ISACA's certification requirements list five years of IS audit, control, assurance or security work experience, all within the ten years before your application. Your work must map to the job practice areas, and a minimum of two years must come from at least one of the five CISA domains. Experience is verified by someone you have worked with, such as a supervisor, manager, colleague or client; family members and HR departments cannot verify it.
Waivers can reduce the five years. Only one education waiver may be applied, and documentation is required. The following worked example shows how the pieces combine.
The general waiver year must be either information systems audit experience or financial audit experience, not both, and it must be one continuous year with a single organization. Only one education waiver may be applied in total. If your experience is mostly in one domain, confirm it maps to that domain's task statements before you apply.
Worked example
Priya has three years of continuous IS audit experience, all within CISA Domain 1, and holds a bachelor's degree in history. How much of the five-year experience requirement can she demonstrate at application, and through which combination?
Show answer
Priya can demonstrate all five years: three years of actual IS audit experience plus a two-year education waiver for her bachelor's degree.
A bachelor's degree in any field of study earns a two-year education waiver, and only one education waiver may be applied. Her three years of IS audit experience satisfy the rule that a minimum of two years must come from at least one of the five CISA job practice domains. Three plus two equals the required five years, all within the ten-year application window.
- 1-year general waiver: one year of information systems or financial audit experience
- 1-year education waiver: associate degree, IT Audit Fundamentals, or the CCAK certificate
- 2-year education waiver: bachelor's, master's or doctorate in any field, or full CIMA certification, or ACCA member status
- 3-year education waiver: a master's degree in Information Systems or a listed related field
Official sources: Certification Application: What are the requirements to become CISA certified? — Answer section
Registering, scheduling and fees
Registration is continuous and online. The exam costs US$575 for members and US$760 for nonmembers, and you get a six-month eligibility window to schedule and sit the exam.
ISACA exams are computer-based, either at authorized PSI testing centers or as remotely proctored exams. You can register at any time, but you cannot schedule an appointment until fees are paid in full, and fees are nonrefundable and nontransferable.
From registration you have six months of eligibility to take the exam. If you need more time, a six-month extension costs US$75, and only one extension is allowed. Miss the window, skip your appointment, or arrive more than 15 minutes late, and your fees are forfeited.
A few scheduling rules are worth noting when you book. Appointments open only 90 days in advance, rescheduling is free if done at least 48 hours before your slot, and special accommodation requests must be submitted no later than four weeks before your preferred exam date. Your account name must match the government-issued ID you present, which must be a current, original document with your name, signature and photograph; digital IDs are not accepted.
- Register online and pay in full before scheduling
- Schedule through the PSI dashboard from your MyISACA account
- Reschedule or cancel at least 48 hours ahead to avoid forfeiture
- Check PSI site availability and device compatibility before registering
Official sources: ISACA 2026 Exam Candidate Guide: current exam rules and CISA outline effective August 2024 — Sections I-IV, Appendices; CISA® Certification | Certified Information Systems Auditor® — Registration and certification pages
Exam format, scoring and pacing
Expect one-best-answer multiple-choice questions, some built on scenarios, scored on a scale from 200 to 800 with 450 required to pass. There is no penalty for wrong answers.
Questions pair a stem with four options, and scenario items may describe a situation and ask two or more questions about it. ISACA advises reading qualifiers such as MOST likely or BEST carefully, eliminating clearly wrong options, and answering every question, since grades reflect the total number answered correctly.
Scores are scaled so different exam versions remain comparable. A score of 800 is perfect, 200 is the lowest possible score, and 450 or higher is a pass. You see a preliminary pass or fail status on screen immediately, the official score arrives within 10 working days, and no question-level results are provided. Domain percentages show how much of the exam reflects each domain, not how your score was calculated.
Pacing is the practical skill you can rehearse in advance. The next exercise works the arithmetic with the official timer rules.
Two breaks of no more than ten minutes each are permitted with proctor approval. The exam pauses during an approved break, but the timer keeps running, which is why any pacing plan must subtract break time.
Worked example
You plan to use one 10-minute break and want 20 minutes of review time at the end. Across the remaining 240 minutes, how much time can you budget per question while answering, in minutes and seconds?
Show answer
About 1.4 minutes per question, or 84 seconds.
Subtract the 10-minute break and the 20-minute review from the 240-minute exam, leaving 210 minutes of answering time. Divide 210 by 150 questions to get 1.4 minutes, which is 84 seconds per question. The break costs you time even though the exam pauses, because the timer does not stop during approved breaks.
- Four hours (240 minutes) for 150 multiple-choice questions
- Scaled score of 450 or higher to pass, on a 200-to-800 scale
- Preliminary result on screen; official score within 10 working days
- No negative marking, so never leave a question blank
Official sources: ISACA 2026 Exam Candidate Guide: current exam rules and CISA outline effective August 2024 — Sections I-IV, Appendices
Where to focus your study time
Weight your preparation toward Domains 4 and 5, but cover all five domains, and use the outline's supporting tasks to check whether you can do what each domain expects.
With Domains 4 and 5 worth 26% each, operations, resilience and information-asset protection deserve the largest share of study time. Domain 3, at 12%, is the smallest, though its topics such as business cases and post-implementation review connect to tasks tested elsewhere.
A useful check is to read each supporting task in the outline and ask whether you could perform it. Tasks include evaluating an organization's storage and backup processes, reviewing change and patch management programs, and assessing risk from shadow IT and end-user computing. Where you cannot describe how you would perform a task, that domain area is a study priority.
Practice with realistic multiple-choice items, including scenario questions that ask several questions about one situation. You can start with the free practice set on this site, and ISACA's own preparation resources, such as the Questions, Answers & Explanations database and review manual, are listed on the CISA certification page.
- Prioritize Domains 4 and 5, which carry 26% each in the current outline
- Use the outline's supporting tasks as a self-assessment checklist
- Practice scenario-style items where multiple questions share one situation
Official sources: ISACA 2026 Exam Candidate Guide: current exam rules and CISA outline effective August 2024 — Sections I-IV, Appendices; CISA® Exam Content Outline — Domain list and supporting tasks; CISA® Certification | Certified Information Systems Auditor® — Registration and certification pages
Exam-day rules that trip candidates up
The rules are strict about items, devices, breaks and behavior, and violations can void your score. Prepare your ID, your route and your workspace plan in advance.
Your workspace must be completely clear, and calculators are prohibited. So are phones, smart watches, notes, bags, food, drink and water, both at test centers and in remote sessions. Screenshots and photos of any part of the exam, including the results screen, are forbidden.
Arrive at a test center at least 30 minutes early with an acceptable original government-issued ID. For remotely proctored exams, complete a device compatibility check beforehand and expect a mandatory room scan, including a mirror check to show blind spots around your laptop. Remote proctors communicate in English via live chat.
Leave the testing area without authorization and your exam may be terminated. The two permitted breaks require proctor permission, and the timer keeps running through them. Post-exam, you have 48 hours to raise administration concerns with ISACA.
- No calculator, notes, phone or water during the exam
- Original government-issued photo ID with signature; digital IDs rejected
- Two 10-minute breaks maximum, timer running, proctor permission required
- Remote exams require a room scan and mirror check before check-in completes
Official sources: ISACA 2026 Exam Candidate Guide: current exam rules and CISA outline effective August 2024 — Sections I-IV, Appendices
Retakes, application and keeping the credential
You get four attempts in a rolling 12 months with escalating wait times. After certification, you must report CPE hours annually and pay maintenance fees to keep the CISA active.
If you do not pass, you have four attempts within a rolling 12-month period, paying the registration fee each time. The waits are 30 days after your first attempt, then 90 days after your second and third attempts. Once you pass, you cannot retake the same exam within the five-year application window.
After you apply and are certified, the CPE policy requires at least 20 CPE hours per year and 120 hours per three-year reporting period, plus an annual maintenance fee, with payment and reporting due by 31 December. The policy also explains how to convert activity time into reportable hours, which the exercise below practices.
The CPE hour math is worth knowing before you attend any qualifying activity, because break and lunch time does not count.
Worked example
A CISA attends a full-day qualifying seminar running 9:00 a.m. to 5:00 p.m., with a one-hour lunch and two 15-minute breaks. Using the CPE policy's calculation method, how many CPE hours can be reported?
Show answer
7.75 CPE hours.
The session spans 480 minutes. Subtract the 60-minute lunch and the two 15-minute breaks, which are excluded, leaving 390 minutes of active participation. The policy awards one CPE hour per 50 minutes, so 390 divided by 50 equals 7.8, rounded to the nearest quarter hour: 7.75. The excluded breaks and lunch are why a nominal eight-hour day does not earn eight hours.
- Four exam attempts per rolling 12 months; waits of 30, then 90, then 90 days
- Annual minimum of 20 CPE hours; 120 hours per three-year period
- Report and pay by 31 December each year to retain certification
- Noncompliance with the CPE policy can lead to revocation
Official sources: ISACA 2026 Exam Candidate Guide: current exam rules and CISA outline effective August 2024 — Sections I-IV, Appendices; Continuing Professional Education Policy (CISA) — Certification requirements and calculating CPE hours
Your next steps
Confirm the current outline, verify your eligibility logistics, and build a study plan weighted by domain.
Start by downloading the ISACA Exam Candidate Guide and the CISA Exam Content Outline, since both are the controlling documents for rules and topics. Verify that a PSI test center or remote setup works for you, register when you are ready, and treat the six-month eligibility window as a deadline for your study plan.
From there, study the five domains with extra weight on Domains 4 and 5, practice scenario-based questions, and rehearse your pacing. If you are ready to test yourself now, try the free practice questions linked below, and browse the study guides for related ISACA credentials if you are comparing options.
- Read the official candidate guide and August 2024 content outline
- Map your experience to the five domains and plan your waiver strategy early
- Practice with scenario questions and time yourself at about 1.4 minutes per item
- Register, then schedule within your six-month eligibility window
Official sources: ISACA 2026 Exam Candidate Guide: current exam rules and CISA outline effective August 2024 — Sections I-IV, Appendices; CISA® Certification | Certified Information Systems Auditor® — Registration and certification pages
Official sources
Exam facts verified against ISACA's 2026 candidate guide and the August 2024 CISA content outline.:
- ISACA 2026 Exam Candidate Guide: current exam rules and CISA outline effective August 2024
- CISA® Exam Content Outline
- CISA® Certification | Certified Information Systems Auditor®
- Certification Application: What are the requirements to become CISA certified?
- Continuing Professional Education Policy (CISA)