Certification guide
Certified Information Systems Auditor (CISA) is ISACA’s flagship credential for the people who provide assurance, the practitioners who plan and execute risk-based audits, evaluate whether IT governance actually aligns technology with business objectives, and render defensible conclusions about the state of an organization’s systems, controls, and resilience. In continuous use since 1978 and held by more than 200,000 professionals worldwide, it is the de facto entry ticket for IT audit, and a standing requirement in job postings across internal audit, Big Four assurance practices, compliance, and risk functions.
The exam content outline in force today took effect August 1, 2024, and the recalibration matters: the same five domains remain, but the weight shifted decisively toward the operational end of the job. Information Systems Operations and Business Resilience rose to 26% and Protection of Information Assets sits at 26%, together, 52% of your scored questions. ISACA also threaded disruptive-technology expectations through the outline: data analytics in the audit process, evaluating automated and AI-assisted decision-making systems, cloud operating models, and the audit implications of DevOps delivery. If your study materials still show the old 21/17/12/23/27 split, they predate the current exam.
Every question on the exam is multiple choice, and nearly every hard one turns on judgment rather than recall: not “what is a firewall” but “what should the auditor do FIRST,” “which finding is the GREATEST concern,” “what is the BEST evidence.” The five domains below are the map, and your study hours should follow the weights, not your comfort zone.
Information Systems Auditing Process
The professional core: audit charters, risk-based planning, standards and ethics, evidence and sampling (attribute, variable, discovery, stop-or-go), CAATs and data analytics, control self-assessment, reporting, follow-up, and quality assurance over the audit function itself. This domain teaches you to think the way the rest of the exam expects you to answer.
Governance and Management of IT
Whether leadership actually steers IT: governance frameworks and steering committees, policy hierarchies, risk appetite and response, maturity models and balanced scorecards, organizational structure and segregation of duties, HR controls, and the full third-party arc, vendor selection, SLAs, right-to-audit clauses, offshore and fourth-party risk, and data ownership roles.
Information Systems Acquisition, Development and Implementation
The lightest domain by weight, covering how systems come to exist: feasibility studies and business cases, project governance, SDLC methodologies from waterfall through agile and CI/CD pipelines, requirements traceability, testing tiers and UAT, data migration controls, cutover strategies, post-implementation reviews, and vendor protections like source-code escrow.
Information Systems Operations and Business Resilience
One of the two scoring heavyweights. Day-to-day operations, incident, problem, and change management, patching, job scheduling, interfaces, database integrity, end-user computing, capacity, monitoring, virtualization and cloud operations, flowing directly into resilience: the BIA, RPO and RTO, backup schemes and restore testing, alternate-site strategies, and the full ladder of BCP/DRP test types.
Protection of Information Assets
The security domain, equal in weight to Domain 4: identity and access management, MFA and biometrics, privileged account controls, physical and environmental protection, network security from firewalls and DMZs to segmentation and IDS/IPS, cryptography and PKI, data classification, DLP, media sanitization, security awareness, vulnerability management and penetration testing, and SIEM-driven monitoring.
Our practice exams mirror the real thing: 150 original questions per exam, stratified to the exact blueprint (27 questions each from Domains 1 and 2, 18 from Domain 3, and 39 each from Domains 4 and 5) on a 240-minute timer, with a full explanation behind every answer so each review pass teaches the reasoning ISACA rewards, not just the letter.
A note on the pass mark: ISACA scores CISA on a scaled range of 200-800 with 450 required to pass, and the scaled conversion does not map linearly to a raw percentage. The prep community’s long-standing working proxy is roughly 65% raw, so that is where we set the practice pass line. Treat it as a floor, not a target, candidates who consistently score in the mid-70s and above on realistic practice exams walk into the testing center with genuine margin.
ISACA Certified Information Systems Auditor - Practice Exam
CISA practice bank spanning ten industry-slanted sets (general, healthcare, retail, financial services, manufacturing/OT, higher education, federal contractor, energy/utilities, telecom, and professional services / SaaS). Each attempt…
Subscribe to startFrequently asked questions about CISA
What is the CISA certification?
Certified Information Systems Auditor is ISACA’s flagship credential for practitioners who provide assurance, planning and executing risk-based audits, evaluating whether IT governance aligns technology with business objectives, and rendering defensible conclusions about an organization’s systems, controls, and resilience. In continuous use since 1978 and held by more than 200,000 professionals worldwide, it is the de facto entry ticket for IT audit.
How many questions are on the CISA exam and how long is it?
150 questions in 240 minutes. Every question is multiple choice, and there is no penalty for wrong answers, so there is never a reason to leave one blank.
What is the passing score for CISA?
ISACA scores CISA on a scaled range of 200-800, with 450 required to pass. The scaled conversion does not map linearly to a raw percentage; the prep community’s long-standing working proxy is roughly 65% raw, which is where Certifym sets the practice pass line.
What are the CISA prerequisites?
Five years of experience, with waivers available. The exam itself assumes that background: the hard questions turn on professional judgment rather than recall.
How is the CISA exam delivered?
At a PSI test center or through remote proctoring, so you can sit the exam in person or from your own location.
What domains does CISA cover, and how are they weighted?
Five domains under the exam content outline effective August 1, 2024: Information Systems Auditing Process (18%), Governance and Management of IT (18%), Information Systems Acquisition, Development and Implementation (12%), Information Systems Operations and Business Resilience (26%), and Protection of Information Assets (26%). The last two are the scoring heavyweights, together they account for 52% of your scored questions.
My study guide shows different domain weights. Which is right?
If your materials still show the old 21/17/12/23/27 split, they predate the current exam. The outline in force today took effect August 1, 2024 and rebalanced the weights decisively toward the operational end of the job, while also threading disruptive-technology expectations through the content, data analytics in the audit process, evaluating automated and AI-assisted decision-making systems, cloud operating models, and the audit implications of DevOps delivery.
How hard is the CISA exam?
Hard in a specific way: nearly every difficult question turns on judgment rather than recall. Not “what is a firewall,” but “what should the auditor do FIRST,” “which finding is the GREATEST concern,” “what is the BEST evidence.” Recognising the mode of the question is most of the battle.
How do I keep the CISA credential current?
Through continuing professional education: 120 CPE hours per three-year cycle.
How should I prepare for CISA?
Let the weights drive your study hours rather than your comfort zone, and drill judgment-style questions until the FIRST / GREATEST / BEST framing stops surprising you. Certifym’s practice exams mirror the real thing: 150 original questions per exam, stratified to the exact blueprint (27 questions each from Domains 1 and 2, 18 from Domain 3, and 39 each from Domains 4 and 5) on a 240-minute timer, with a full explanation behind every answer. Aim for the mid-70s and above before you schedule.
Should I take CISA or CISM?
CISA is the assurance credential, it certifies that you can audit systems, controls, and governance and render a defensible conclusion. CISM, ISACA’s information security management certification, sits on the other side of that table, with the manager who builds and runs the security programme an auditor would assess. Many practitioners eventually hold both; which comes first depends on whether your job is to evaluate controls or to own them.
Trademark notice & independence
Certifym.net is operated by Certifym Exam Services, LLC and is not affiliated with, endorsed by, or sponsored by ISACA. CISA® and ISACA® are registered trademarks of ISACA (Information Systems Audit and Control Association). Use of these marks is solely to identify the certification for which these study materials are intended. The CISA Exam Content Outline and its domain structure are the property of ISACA; candidates should download the official, current exam content outline directly from isaca.org.
All questions, answers, and explanations on Certifym are original content created for practice purposes. They are not actual ISACA examination questions and are not represented as such. Practicing with these materials does not guarantee a passing result on any live certification exam. Exam requirements, format, domain weights, and eligibility criteria are set by ISACA and may change; always verify current details at isaca.org before scheduling your exam.