Skip to content
CertGPS

Certified Information Systems Auditor

Proves you can plan and run risk-based IT audits, and it is granted only after five years of verified audit, control or security work

ExpertISACA

The exam

Exam cost
$760
Study time
6-12 months
Passing score
450 (scaled 200–800)
Valid for
3-year CPE cycle, renewed annually

Before you book

  • Required: five years of IS audit, control, assurance or security experience within the 10 years before applying, at least two in one CISA domain
  • Up to three years waivable: one year of IS or financial audit experience, plus one education waiver (associate degree, bachelor's, relevant master's, CIMA, ACCA, IT Audit Fundamentals or CCAK)
  • Pass the exam, then apply within five years; ISACA members can hold the CISA Associate designation meanwhile

What it covers

Security domains

Career

US pay and outlook from the Bureau of Labor Statistics for the closest BLS occupation to each role this certification fits. BLS doesn't report pay by certification, and counts most of these roles only within a wider occupation, so the figures describe that occupation, not the role or the credential.

Where people with it work

  1. Entry level

  2. Mid level

  3. Senior level

Where it leads

Study guide

Last updated

CISA Study Guide: The 2024 Outline, Experience Waivers and the CISA Associate

CISA is the credential for IT auditors. It tests whether you can plan a risk-based audit, test controls, collect evidence and report findings across IT governance, systems development, operations and security. The exam has followed the outline ISACA introduced on 1 August 2024, and no replacement has been announced. Experience is the usual hurdle. Certification needs five years, ISACA waives up to three, and since July 2025 members who pass without the experience can hold the CISA Associate designation while they build it.

Who should sit CISA

It suits IT auditors in internal audit teams and audit firms, financial auditors moving into technology work, and compliance or security staff whose job is testing whether controls work. ISACA counts five years of information systems audit, control, assurance or security work within the ten years before you apply, and at least two of those years must fall within one of the five exam domains.

Waivers cover up to three years, and the rules are specific:

  • One year of information systems or financial audit experience can replace one year, provided it's a continuous year with one employer.
  • One education waiver may be added: one year for an associate degree, ISACA's IT Audit Fundamentals certificate or the Certificate of Cloud Auditing Knowledge (CCAK); two years for a bachelor's, master's or doctorate in any field, CIMA certification or ACCA membership; three years for a master's in information systems or a related field.

If you own a security program instead of assessing one, CISM is written for that role. If your work is identifying and treating IT risk on the second line, look at CRISC. For technical breadth across security domains, CISSP goes deeper.

The exam in one table

CISA
Format150 multiple-choice questions, four options each, one best answer
Time4 hours (240 minutes)
Passing score450 on a scaled range of 200 to 800
PriceUS$575 for ISACA members, US$760 for non-members; US$50 application fee after passing
DeliveryPSI test centers or remote proctoring; English, Spanish, Simplified Chinese, French, German, Korean and Japanese
ExperienceFive years of IS audit, control, assurance or security work; up to three years can be waived
OutlineEffective August 2024
RenewalAnnual fee of US$45 (members) or US$85; 20 CPE hours a year, 120 over three years; compliance with ISACA's IS auditing standards

Five domains, and where the marks are

  • Information System Auditing Process: 18%
  • Governance and Management of IT: 18%
  • Information Systems Acquisition, Development, and Implementation: 12%
  • Information Systems Operations and Business Resilience: 26%
  • Protection of Information Assets: 26%

Operations and protection together are 52% of the exam, so most questions are about systems you'd audit rather than the audit itself. The operations domain runs from job scheduling and system interfaces to shadow IT, end-user computing, log management, database management and service levels, then into business impact analysis, backups and disaster recovery. Protection covers identity and access management, network and endpoint security, data loss prevention, encryption, PKI, cloud, mobile and IoT, plus incident response and forensic evidence.

The audit process domain is only 18% but its logic runs through all five. Questions turn on what an auditor should do: plan by risk, choose a sampling method, judge whether evidence is sufficient, report rather than fix, stay independent of the system under review. Several of the 2024 outline's 43 tasks reach into newer ground, such as using data analytics in audits, evaluating automated decision-making systems and running technical security tests to find vulnerabilities. Acquisition and development is the smallest domain at 12%, covering business cases, development methods, implementation testing, data migration and post-implementation review.

A study plan for auditors and non-auditors

Start with ISACA's CISA Review Manual, 28th edition, which ISACA released for the 2024 outline, and its Questions, Answers and Explanations database with 1,070 questions. The online review course is a third option if you learn better from video. Among third-party texts, Peter H. Gregory and Mike Chapple's Sybex study guide (January 2025) covers the 2024 objectives.

How you split the time depends on where you come from. Auditors usually know the process domain and need hours on infrastructure, security and resilience, which carry more than half the marks. Security staff tend to have the reverse problem, so they should spend early weeks on audit planning, sampling, evidence and reporting, and on ISACA's IT Audit Framework (ITAF). Its 5th edition, free from ISACA, was released in February 2026, after the exam outline was set, so learn its standards and principles and don't chase edition-specific wording.

Practise on real material. Pull a sample of change tickets and test them against your change policy, deciding what counts as an exception. Read a business continuity plan and list the evidence you'd ask for to show it was tested. Review a user access recertification and note who approved what. These map to tasks the outline lists by name.

With 150 questions in 240 minutes you have about a minute and a half for each. When you review a missed practice question, ask whether you picked what a manager or engineer would do instead of what an auditor would.

Associate status, renewal and next steps

You have five years after passing to apply, and a supervisor, manager, colleague or client must verify your experience. If you're an ISACA member without the five years, the CISA Associate designation costs US$25 to apply for, needs no CPE and lasts four years or until you become certified, provided your membership stays active. Because the designation lasts four years and the application window five, it can lapse before your chance to apply does.

Certified holders report 20 CPE hours a year and 120 over each three-year cycle, with at least 90 mapped to the CISA outline. The annual fee is US$45 for members or US$85 for non-members, US$25 or US$50 once you hold more than two ISACA certifications. CISA alone also requires you to follow ISACA's information systems auditing standards.

Where to go next:

  • AAIA, ISACA's AI audit credential, accepts any CISA holder (US$459 for members, US$599 for non-members).
  • CRISC, if you want to move from assessing risk to owning it.
  • CISM, where a current CISA counts for two years of the experience requirement.

Our view

CISA is the established IT audit credential, with more than 151,000 holders by ISACA's count, and the experience check means it signals more than a pass. Its critics say the exam rewards learning ISACA's view of what an auditor does first, and that it's broad but shallow on technology; you won't configure anything to pass it. We agree on both counts and still recommend it to anyone building a career in IT audit, where it remains the credential to hold. For security engineers who audit occasionally, the money goes further on CISSP or a technical certification, unless an employer asks for CISA by name.

Sources