During planning, an IS auditor has limited time to audit a large ERP environment. What should the auditor do FIRST?
Domain 1
Answer: B · whyRisk-based audit planning directs limited audit resources to the areas of greatest risk.
ISACA · Audit & Assurance
CISA - Certified Information Systems Auditor
IT/IS auditors, internal auditors, control and assurance professionals, compliance analysts and security professionals who assess IT controls. A strong first certification for anyone moving into IT audit or GRC.
Overview
- Prerequisites
- Pass the exam, then apply within 5 years. Certification needs 5+ years of experience in IS/IT audit, control, assurance or security; ISACA allows experience waivers of up to 3 years. US$50 application processing fee. Agree to the Code of Professional Ethics, CPE policy and IS Auditing Standards.
- Maintenance
- ISACA CPE policy: at least 20 CPE hours every calendar year and 120 CPE hours over a rolling 3-year cycle, plus the annual maintenance fee (US$45 members / US$85 non-members; reduced to US$25/US$50 for a 3rd+ ISACA certification). From 1 January 2027 at least 90 of the 120 hours must align to the certification's exam content outline; up to 30 may be broader professional development.
- Outline in effect
- 1 Aug 2024
Exam facts
- Questions
- 150
- Duration
- 4 hours (240 minutes)
- Question types
- Multiple choice, one best answer
- Passing score
- 450 on a 200-800 scaled score
- Format
- Linear (fixed form), computer-based
- Delivery
- PSI test centres worldwide or remote online proctoring; continuous registration with a 6-month eligibility window
- Languages
- English, Spanish, Chinese Simplified, French, German, Korean, Japanese
Cost
- Member
- US$575
- Non-member
- US$760
- Notes
- Plus US$50 application fee after passing. Optional 6-month eligibility extension US$75. Fees are non-refundable.
Domains & weights
- Domain 1 - Information System Auditing Process18%
- Domain 2 - Governance and Management of IT18%
- Domain 3 - Information Systems Acquisition, Development and Implementation12%
- Domain 4 - Information Systems Operations and Business Resilience26%
- Domain 5 - Protection of Information Assets26%
Upcoming changes
- ISACA CPE policy change from 1 Jan 2027: at least 90 of the 120 three-year CPE hours must map to the CISA outline.
Study plan
- Week 1
Orientation + Domain 1 (planning)
- Read the exam content outline and candidate guide end to end.
- Study ISACA IS audit standards, audit types, risk-based audit planning and control types.
- Take a 50-question diagnostic set to find weak areas.
- Week 2
Domain 1 (execution)
- Sampling (statistical vs judgemental), evidence quality, data analytics, CAATs.
- Reporting, follow-up and audit QA.
- Do 60+ Domain 1 practice questions; review every explanation.
- Week 3
Domain 2 - IT governance
- Governance vs management, IT strategy committee vs steering committee, policies/standards/procedures.
- Enterprise architecture, ERM, privacy principles, data governance and classification.
- Week 4
Domain 2 - IT management
- Vendor management, SLAs, right-to-audit, performance monitoring (BSC/KPIs), QA.
- Mixed set of 80 questions on Domains 1-2.
- Week 5
Domain 3
- Project governance, business case, feasibility, SDLC/Agile, controls by design.
- Testing types, configuration/release management, data conversion and post-implementation review.
- Week 6
Domain 4 - Operations
- IT asset management, job scheduling, interfaces, shadow IT/EUC, capacity, incident vs problem management.
- Change, configuration and patch management; log management; database controls.
- Week 7
Domain 4 - Resilience
- BIA, RTO/RPO/MTD, backup strategies, BCP vs DRP, recovery site types and testing.
- 120-question mixed set; track scores by domain.
- Week 8
Domain 5 - Asset protection
- Security frameworks, physical/environmental controls, IAM, network and endpoint security.
- DLP, encryption, PKI, cloud/virtualisation, mobile/IoT.
- Week 9
Domain 5 - Security events + full mock
- Awareness, attack methods, security testing, monitoring, incident response and evidence handling.
- Sit a timed 150-question mock in 4 hours.
- Week 10
Review and exam
- Re-study the two weakest domains; re-read explanations of every missed question.
- Second timed mock; aim for a consistent 75%+ on quality practice sets before booking.
Exam tips
- Read every question for the role you are playing (auditor, risk practitioner, security manager): ISACA rewards the answer that fits that role, not the most technical one.
- Watch qualifier words such as FIRST, BEST, MOST, PRIMARY and GREATEST: several options are often true, and only one is the best next step.
- There is no penalty for wrong answers, so never leave a question blank.
- Budget about 1.5 minutes per question (150 questions in 240 minutes) and flag long scenario items to revisit.
- Bring a current, original, government-issued photo ID whose name exactly matches your ISACA profile; arrive 30 minutes early at a PSI centre, or run the PSI system check well before a remote exam.
- Think like an auditor: you identify, evaluate and report; you do not design, implement or fix controls yourself.
- When an option involves reviewing documentation, interviewing or testing, prefer the one that gives the most reliable, independent evidence.
Common pitfalls
- Choosing the technical fix instead of the audit action (report, recommend, verify).
- Ignoring auditor independence: an auditor who helped implement a control should not audit it.
- Mixing up RPO (data loss tolerance) and RTO (downtime tolerance).
- Studying only from question dumps; ISACA tests judgement and changes items frequently.
- Under-weighting Domains 4 and 5, which together are 52% of the exam.
Resources & official links
Official
- CISA Exam Content Outline (effective Aug 2024)
- CISA Review Manual, 28th Edition (ISACA)
- CISA Questions, Answers & Explanations Database (ISACA, 6-month subscription)
- Free CISA practice quiz (10 questions)
- ISACA Certification Exam Candidate Guide (CISA, CRISC, CISM, CGEIT, CDPSE)
Also widely used
- ISACA Engage CISA study groups (members)
- Local ISACA chapter review courses
- Hemang Doshi's CISA study guide and question sets
- ISACA IT Audit Framework (ITAF) and ISACA glossary
Sources
- ISACA CISA certification page (fees, process)
- ISACA CISA Exam Content Outline
- ISACA press release: CISA exam updated (1 May 2024)
- Maintain CISA certification
- ISACA Certification Exam Candidate Guide (CISA, CRISC, CISM, CGEIT, CDPSE)
- ISACA CPE Policy changes for 2027
Last verified 19 Oct 2026. Values marked “check official site” could not be confirmed from an official source.
Practice questions
Which type of evidence is generally the MOST reliable?
Domain 1
Answer: C · whyEvidence obtained directly by the auditor from an independent source is more reliable than evidence produced by the auditee.
An auditor wants every item in a population to have an equal chance of selection so results can be projected. Which method fits?
Domain 1
Answer: B · whyStatistical sampling allows objective projection of results to the whole population.
Who is PRIMARILY accountable for approving an organisation's IT strategy alignment with business goals?
Domain 2
Answer: B · whyStrategic alignment is a governance responsibility of the board and its IT strategy committee.
An outsourcing contract has no right-to-audit clause. What is the GREATEST risk?
Domain 2
Answer: B · whyWithout audit rights the organisation may not be able to verify that outsourced controls work.
The PRIMARY purpose of a post-implementation review is to:
Domain 3
Answer: B · whyA PIR checks whether objectives and business benefits were realised and captures lessons learned.
Which control BEST ensures data integrity during migration to a new system?
Domain 3
Answer: B · whyReconciliation of counts and control totals confirms data was transferred completely and accurately.
An emergency change was applied directly to production. What should the auditor verify?
Domain 4
Answer: B · whyEmergency changes are acceptable if they are logged, retrospectively approved and reviewed.
A business process can tolerate losing at most 2 hours of data. This value is the:
Domain 4
Answer: B · whyRecovery Point Objective is the maximum acceptable data loss measured in time.
Which recovery site provides the FASTEST recovery but at the highest cost?
Domain 4
Answer: C · whyA hot site is fully equipped and can be operational within hours.
Which is the BEST control to detect inappropriate access rights accumulated after job changes?
Domain 5
Answer: B · whyOwner-led access recertification detects privilege creep.
An auditor finds that the security administrator can also approve their own access requests. This is primarily a weakness in:
Domain 5
Answer: B · whyRequesting and approving one's own access violates segregation of duties.