thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

ISACA · Governance, Risk & Privacy · Professional

ISACA CISA exam guide

Exam CISA

CISA is the global standard certification for IT audit, control and assurance. It proves you can plan and perform IS audits, assess governance and controls, and report on information security and resilience. It is widely required in internal audit, external audit and compliance teams.

Questions150
Time limit240 minutes
Passing score450 (200-800 scale)
Exam fee$760 USD
Valid for3 years
DeliveryPSI test center or remote proctored

Format: Multiple choice. Fee note: $575 for ISACA members; $50 application fee after passing.

Who it's for

IT auditors, internal and external auditors, and control and compliance professionals with IS audit experience.

What the exam covers

Information Systems Auditing Process18%
Governance and Management of IT18%
Information Systems Acquisition, Development and Implementation12%
Information Systems Operations and Business Resilience26%
Protection of Information Assets26%

Eligibility & prerequisites

Required: 5 years of professional experience in IS audit, control, assurance or security, with substitutions and waivers of up to 3 years for qualifying education or experience. Experience must be within 10 years before applying or within 5 years after passing. You have 5 years after passing to apply.

Recommended: Hands-on IT audit and control work.

Keeping it active

Annual and 3-year CPE cycle: earn at least 20 CPE hours each year and 120 hours every 3 years, and pay ISACA's annual maintenance fee (lower for members).

Skills & careers

Skills it validates

  • Planning and executing risk-based IS audits
  • Evaluating IT governance and management
  • Reviewing system acquisition and development controls
  • Assessing IT operations, BC and DR
  • Testing security and access controls
  • Reporting audit findings and following up

Job roles

IT AuditorInternal AuditorIT Audit ManagerCompliance AnalystRisk and Controls ConsultantSOX IT Specialist

DoD 8140

Recognized in the DoD 8140 qualification matrix for audit and security control assessment work roles. Open the DoD Workforce Navigator

Where it fits in your path

Planning a degree too? See how this cert earns college credit in the College Credit Navigator.

Build my study plan

  1. Week 1-2: Domain 1 auditing process: standards, risk-based planning, sampling, evidence, reporting.
  2. Week 3: Domain 2 governance and management of IT.
  3. Week 4: Domain 3 acquisition, development and implementation.
  4. Week 5-6: Domain 4 operations and business resilience (26%).
  5. Week 7-8: Domain 5 protection of information assets (26%).
  6. Week 9-10: ISACA QAE question database practice, then full timed exams.

Make it yours: pick your exam date and weekly hours. We'll split your time by domain weight and give you a printable plan.

Exam-day tips

  • Think like an auditor: the best answer is usually what the auditor should do or report, not fix.
  • Domains 4 and 5 are 52% of the exam combined.
  • Know the difference between auditor independence and management responsibility.
  • Use ISACA's official question database; its wording style differs from third-party tests.
  • Watch for MOST, BEST and FIRST qualifiers.

Key terms for this exam

All 160 terms Study with thinQcards™

Commonly confused on this exam

Frequently asked questions

How much does CISA cost?

$575 for ISACA members and $760 for non-members, plus a $50 application fee after passing.

How long is the CISA exam?

150 questions in 4 hours.

Can I take CISA without experience?

Yes. You can pass first and then have 5 years to submit the experience requirement.

How do I maintain CISA?

Earn 20 CPE hours each year and 120 every 3 years and pay the annual maintenance fee.

CISA vs CISM?

CISA is for auditors who assess controls; CISM is for managers who run security programs.

Official page: www.isaca.org. Reviewed November 2026. Vendors change fees and objectives, so confirm with the vendor before you book. Spot something out of date? Tell us.