The CISA Exam, Explained: What ISACA Requires, What It Costs, and What You Need Before the Letters Are Yours

What the CISA Actually Certifies

Certified Information Systems Auditor (CISA)  is the credential IT auditors get asked about first, and it is also the one that catches people who assume passing the exam is the finish line. ISACA has offered it since 1978. It is accredited by ANSI under ISO/IEC 17024, the international standard for bodies that certify individuals, which is part of why job postings and regulators name it so often.

What the exam measures is auditor judgment more than hands-on technical depth. You will be asked what an IS auditor should do first, which finding deserves the most attention, or which control is most effective. Often two or three options are defensible and only one is the auditor's answer.

Passing the exam gives you a score, not the designation. The letters come after ISACA approves an application showing your experience, you pay the application fee, and you agree to its ethics code and CPE policy. Both routes are covered below.

Who Should Take It, and Who Should Wait

CISA fits IT auditors, internal auditors moving toward technology, GRC and compliance analysts, security professionals in assurance roles, and consultants who review client environments. If your day job already involves testing controls or writing findings, the exam's mindset will feel familiar.

It fits less well if you want to be the person configuring firewalls or running penetration tests. Nothing here asks you to do that. If you want to run a security function rather than assess one, CISM is the closer match (see the comparison below). And if you have no exposure to audit concepts at all, you can still pass, but budget more time for Domain 1, because it shapes how every other domain is questioned.

ISACA's CISA page advertises an average annual salary of US$149K or more. It does not explain the methodology, and pay varies enormously by country, sector and seniority, so read it as a marketing figure rather than a forecast.

The Exam Format: Four Hours, 150 Questions, One Best Answer

What the numbers mean in practice

Four hours for 150 questions works out to 96 seconds each. Every question has a stem and four options, and you pick the best one. Watch the qualifiers: MOST likely, BEST, FIRST. Some questions arrive in scenario sets, where one situation description supports two or more questions.

Some of the 150 items are pretest questions that do not count toward your score, and you cannot tell which. There is no penalty for wrong answers, so leave nothing blank.

My guidance, not ISACA's: aim for roughly 75 seconds per question on the first pass. That leaves close to an hour to revisit flagged items, and the scenario sets are where that hour tends to go.

Test center or remote

Both are delivered through PSI. Test-center candidates should plan to arrive at least 30 minutes early. Remote candidates complete a room scan and a mirror check before starting, and the exam is closed book and proctored throughout. You can chat with a remote proctor, but only in English, even though the exam itself is offered in seven languages.

Rules that catch people out

• You get two breaks of up to ten minutes each, with the proctor's permission. The clock keeps running.

• No food, no drink (water included), no calculators, no notes, no phones or watches.

• Your ID must be a single valid government-issued document whose name matches your ISACA account exactly.

• Arriving more than 15 minutes late forfeits your fee.

A preliminary pass or fail appears on screen when you finish. The official score follows by email within ten working days. You do not get question-level results.

Domains and Weightings

The current outline took effect in August 2024 and has five domains. Percentages describe how much of the exam each domain represents. They are not separate pass marks.

Where to spend your hours

Domains 4 and 5 together make up 52% of the exam, so splitting your time evenly is a mistake. Domain 3 is the smallest slice and rarely deserves more than its share.

Domain 1 is the exception to weighting logic. At 18% it looks modest, but it teaches the risk-based, evidence-first perspective that decides the best answer in the other four. The supporting task statements also include evaluating automated and decision-making systems and emerging technologies, which is where AI-related questions come from.

What the Exam and Certification Cost

All figures are in US dollars, per ISACA's CISA page and 2026 candidate guide as of September 2026. ISACA's checkout is the final word, since fees can change.

Other charges worth knowing:

• Exam fees are nonrefundable and nontransferable.

• Every retake requires the full registration fee again.

• A single six-month eligibility extension costs US$75.

• A rescore request costs US$75.

Whether membership pays for itself is a fair question. The exam discount is US$185. ISACA membership has recently been quoted at about US$135 a year plus local chapter dues, so on the exam alone you net very little. It starts to make sense if you will also buy ISACA's own review resources at member prices, or keep the credential for years, since the maintenance fee is US$40 lower for members. Check the current join price before deciding.

Prerequisites: Sitting Versus Certifying

Anyone can register and sit the exam. There is no experience gate at the door.

Certification is where the requirement lives. ISACA asks for five or more years of experience in IS/IT audit, control, assurance or security. Waivers can cover up to three of those years, and ISACA's requirements article on its support site lists what qualifies. After passing, you have five years to submit your application. That window is why plenty of people sit the exam early and collect the experience afterward. Just remember you cannot use the designation until the application is approved.

Scoring, Results and Retakes

ISACA reports a scaled score from 200 to 800. You need 450. The scale exists so that different exam versions stay comparable, which means 450 is not a percentage of questions answered correctly, and ISACA does not publish the raw cut score. It also does not publish pass rates. Figures circulating online range from around half to noticeably lower, and none are sourced to ISACA, so treat them as chatter.

If you fail, ISACA allows four attempts in a rolling twelve-month period. The waits are 30 days after the first attempt, then 90 days after the second, and 90 days after the third. Each attempt is a new full fee. If you pass, you cannot sit the same exam again during the five-year application window, and current CISA holders cannot retake it while certified.

Keeping the Credential Active

CISA has no re-exam. It stays active as long as you do three things:

• Earn and report at least 20 CPE hours every calendar year.

• Reach at least 120 CPE hours across each three-year reporting period.

• Pay the annual maintenance fee, and follow ISACA's Code of Professional Ethics.

You cannot bank 120 hours in one year and coast, because the annual floor applies on its own. ISACA audits a sample of CPE reports each year, so keep documentation. Non-compliance leads to revocation. If you hold several ISACA certifications, ISACA reduces the annual fee for the third and later ones to US$25 for members and US$50 for non-members.

CISA Compared With Its Nearest Alternatives

One caution: ISACA's CISM outline changes on 3 November 2026. That does not touch CISA, and the CISA outline in force is still the August 2024 version, but the two are easy to confuse in blog posts. Beyond these, ISACA also lists AAIA (Advanced in AI Audit) as a step for auditors who want to build on their audit foundation. Many people pair CISA with CISM or CRISC over a career. That is a common pattern, not a requirement.

Prepation Timeline

Treat this as informed guidance, not an official statement. With an audit or IT-controls background, eight to twelve weeks at roughly eight to ten hours a week is common. If audit vocabulary is new to you, plan sixteen weeks or more.

A sequence that works for many candidates:

1. Read Domain 1 first and take ISACA's free 10-question practice quiz to see how the question style feels.

2. Put the heaviest effort into Domains 4 and 5, then cover 2 and 3.

3. Start answering practice questions early. Do not save them for the last fortnight. The skill you are building is choosing between two plausible options, and only repetition builds it.

4. In the final two weeks, sit full 150-question timed runs and review every miss by asking why the best answer beat your answer.

ISACA's own resources are the safest anchor: the CISA Review Manual (the 28th edition is what its CISA page lists), its Questions, Answers and Explanations database (a 1,070-question pool on a six-month subscription), and its self-paced online review. Avoid leaked or memorized exam content. ISACA's rules forbid retaining or sharing exam content, and violations can lead to score nullification or revocation.