The CISA exam — ISACA’s Certified Information Systems Auditor credential — has a reputation for being genuinely difficult, and that reputation is earned: it tests auditing judgment and governance knowledge as much as technical recall, which makes it harder to cram for than a straightforward technical certification. This guide covers what the CISA exam actually tests, the real eligibility requirements, and a study approach that reflects how the exam is actually structured rather than generic “study hard” advice.
For working professionals already juggling a full-time job alongside exam preparation, the difference between a study plan built around the CISA exam’s real structure and one built around generic test-prep habits tends to show up directly in the result — not just in whether you pass, but in how efficiently you get there without burning through months of study time on the wrong material.
What the CISA Exam Actually Covers
The CISA exam is built around five domains, each weighted differently in the actual exam content:
- Information Systems Auditing Process — 18%
- Governance and Management of IT — 18%
- IS Acquisition, Development and Implementation — 12%
- IS Operations and Business Resilience — 26%
- Protection of Information Assets — 26%
Notice that domains 4 and 5 together make up 52% of the exam — just over half. That’s a genuinely useful planning number: a study schedule that treats all five domains as roughly equal is misallocating time relative to how the actual exam is weighted. Operations, resilience, and asset protection deserve proportionally more study time than acquisition and development, even though all five domains are tested.
The exam itself consists of 150 multiple-choice questions, delivered by computer, with a 4-hour time limit. Scoring uses a scaled range, and the passing standard is a scaled score of 450. Because the scoring is scaled rather than a simple percentage, there’s no exact “number of questions right” threshold to target — the practical takeaway is to treat practice-test scores as directional guidance rather than a precise predictor of pass/fail.
Eligibility: What You Actually Need Before You’re Certified
This is a detail that trips up a lot of candidates: you can take and pass the CISA exam before you meet the full certification requirements. The exam itself has no prerequisite — anyone can register and sit for it. Certification, however, requires five years of professional work experience in information systems auditing, control, or security, completed within a set window around your exam date.
That experience requirement isn’t completely rigid — ISACA allows specific waivers that can reduce it:
- Up to one year can be waived for general (non-IS-specific) auditing experience.
- A two-year college degree can substitute for one year of the experience requirement.
- A four-year (bachelor’s) degree can substitute for two years.
- A relevant master’s degree in information security or information technology from an accredited university can substitute for one year.
These substitutions can be combined up to the maximums ISACA sets, which means candidates with relevant formal education often need meaningfully less hands-on audit experience than the full five years to qualify for certification — worth factoring in before assuming you’re not eligible to pursue CISA yet.
A Study Plan That Matches How the Exam Is Actually Weighted
Rather than generic advice to “study hard,” here’s a planning approach built around the exam’s real structure:
- Start with the ISACA CISA Review Manual as your primary reference, since it’s built directly around the same five domains and weighting the actual exam uses — study material that isn’t aligned to the current exam content outline risks covering the wrong proportions or outdated domain structure.
- Allocate study time proportionally to domain weighting, not equally. Given that domains 4 (IS Operations and Business Resilience) and 5 (Protection of Information Assets) together account for just over half the exam, they should receive a correspondingly larger share of your study calendar — not simply “equal time per domain.”
- Use practice questions diagnostically, not just for repetition. The value of practice tests isn’t primarily the repetition — it’s identifying which specific domains you’re weakest in, so remaining study time gets redirected toward your actual gaps rather than topics you’ve already mastered.
- Think like an IS auditor, not just a memorizer. CISA questions frequently present scenarios requiring judgment about what an auditor should recommend or prioritize, rather than pure factual recall — practicing with scenario-based questions specifically, not just flashcard-style review, builds the judgment the exam actually tests.
- Build in review courses or study groups if self-study alone isn’t working. ISACA and numerous training providers offer structured CISA review courses; if you’re finding self-study isn’t sticking, a structured course with a set schedule and peer accountability can meaningfully improve consistency, particularly for the governance and audit-process domains that reward discussion and case-based learning over solo memorization.
Why CISA Is Considered Harder Than Many IT Certifications
It’s worth being specific about why CISA has the reputation it does, since understanding the actual difficulty helps target study time correctly. Unlike certifications built primarily around technical recall — knowing a specific protocol’s behavior, a tool’s command syntax, or a product’s configuration options — CISA questions frequently present a scenario and ask what an auditor should conclude, recommend, or prioritize given incomplete or competing information. That format rewards judgment built through practice with similar scenarios far more than it rewards memorizing definitions, which is part of why candidates who treat CISA prep like a vocabulary test tend to underperform relative to their actual knowledge.
The exam also spans governance, technical controls, audit methodology, and business continuity in a single certification — a genuinely wide scope compared to certifications that go deep on one narrow technical domain. That breadth is exactly why the domain-weighted study approach above matters: trying to master every domain with equal depth and equal time is a reasonable-sounding strategy that doesn’t actually match how the exam itself is constructed.
ISACA’s Own Materials vs. Third-Party Prep Resources
A reasonable question many candidates face: should you rely primarily on ISACA’s own CISA Review Manual and official question database, or supplement heavily with third-party courses and practice tests? The practical answer is usually both, used for different purposes. ISACA’s own materials are built directly from the current exam content outline, which makes them the most reliable source for what’s actually in scope and how heavily each domain is weighted — that alignment is hard to guarantee with a third-party resource that may lag behind outline updates.
Third-party courses and practice question banks add value in a different way: varied question phrasing and scenario framing that exposes you to more styles of the scenario-based reasoning the exam tests than a single official source typically provides. The mistake to avoid is treating a single resource — official or third-party — as sufficient on its own. A combination of ISACA’s own content outline and review manual as your structural backbone, supplemented by varied third-party practice questions for additional scenario exposure, tends to produce more reliable results than either approach alone.
Maintaining the Certification After You Pass
Passing the CISA exam and meeting the experience requirement isn’t the end of the process — maintaining the credential requires ongoing continuing professional education (CPE): a minimum of 20 CPE hours per year, totaling 120 hours over a three-year reporting cycle. This is worth planning for from the start rather than scrambling near a renewal deadline, since CPE activities (training, conferences, relevant coursework) can often be worked into ongoing professional development rather than treated as a separate obligation.
Common Mistakes Worth Avoiding
A few recurring mistakes show up often enough among CISA candidates to call out directly:
- Treating all five domains as equally important in study time allocation, when the real exam weighting clearly favors operations, resilience, and asset protection.
- Studying only from memory-based flashcard tools without practicing scenario-based judgment questions, which make up a meaningful portion of the actual exam style.
- Assuming the experience requirement blocks taking the exam. It doesn’t — the exam has no prerequisite, and many candidates sit for it well before completing their full experience requirement.
- Underestimating the governance and audit-process domains because they feel less “technical” than operations or asset protection — these domains test judgment and process knowledge that’s just as rigorously assessed as the more technical material.
Who CISA Is Actually Worth Pursuing For
CISA tends to make the most sense for professionals already working in or moving toward IS audit, governance, risk, or compliance roles — positions where the exam’s scenario-based, judgment-heavy style reflects the actual day-to-day work more closely than a purely technical certification would. It’s a somewhat different credential than something like CISSP (broader security management) or a vendor-specific technical certification, and candidates sometimes pursue CISA without fully understanding that distinction, which can lead to frustration when the exam’s style doesn’t match what they expected from their prior certification experience.
For IT professionals coming from a more technical, hands-on background and considering CISA as a next step, it’s worth specifically practicing the shift from “what is the correct technical answer” to “what should an auditor recommend given this scenario,” since that shift in thinking is often the single biggest adjustment technical candidates need to make when preparing for the CISA exam specifically.
The Bottom Line
Passing the CISA exam comes down to studying in proportion to how the exam is actually weighted, using ISACA’s own current exam content outline as your source of truth rather than generic exam-prep advice, and practicing the scenario-based judgment the exam specifically tests rather than just memorizing facts. The experience and education requirements are more flexible than many candidates assume, thanks to ISACA’s waiver system — worth checking your own eligibility carefully rather than assuming you need the full five years before you can even begin.
Frequently Asked Questions
How many questions are on the CISA exam, and how long do I have?
150 multiple-choice questions, with a 4-hour time limit, delivered by computer. The passing standard is a scaled score of 450.
Can I take the CISA exam before I have five years of experience?
Yes — the exam itself has no prerequisite, and many candidates pass it before completing their full work experience requirement. Certification is awarded once the experience requirement (with any applicable waivers) is also satisfied.
Can my degree count toward the CISA work experience requirement?
Yes, within limits. A two-year degree can substitute for one year of experience, a four-year bachelor’s degree for two years, and a relevant master’s degree for one year — these can be combined up to ISACA’s set maximums.
Which CISA domains should I prioritize when studying?
Domains 4 (IS Operations and Business Resilience, 26%) and 5 (Protection of Information Assets, 26%) together account for just over half the exam, so they deserve proportionally more study time than the other three domains, even though all five are tested.
What’s required to maintain CISA certification after passing?
A minimum of 20 continuing professional education (CPE) hours per year, totaling 120 hours over each three-year reporting cycle.
Is CISA harder than other IT certifications?
Many candidates find it more difficult than purely technical certifications, largely because of its format: CISA questions frequently test audit judgment through scenarios rather than straightforward factual recall, and the exam spans governance, technical controls, audit methodology, and business continuity in a single certification rather than going deep on one narrow area.
Should I use ISACA’s official study materials or third-party prep courses?
Both, for different purposes. ISACA’s own CISA Review Manual stays aligned with the current exam content outline and domain weighting, making it the most reliable structural reference, while third-party courses and practice questions add varied scenario exposure that a single official source may not fully provide.
