The Certified Information Systems Auditor (CISA) exam is 150 multiple-choice questions in four hours. Two domains, Information Systems Operations and Business Resilience, and Protection of Information Assets, carry 26% each, so more than half the exam sits in just two areas. This guide covers the fee, the format, the domains and their subtopics, the retake rules, and what you need besides a pass to become certified.
TL;DR
- Exam fee: US$575 for ISACA members, US$760 for non-members
- 150 multiple-choice questions in 4 hours (240 minutes), with a passing score of 450 on a scale of 200 to 800
- Domain weights: 18%, 18%, 12%, 26% and 26%
- You have six months from registration to take the exam, and you can buy one six-month extension for US$75
- To become certified you also need five years of qualifying work experience and the US$50 application fee, and you can take the exam before you meet the experience requirement
Quick Facts
| Item | Value |
|---|---|
| Exam fee | US$575 (ISACA member) / US$760 (non-member) |
| Application fee | US$50, paid after passing |
| Length | 4 hours (240 minutes) |
| Questions | 150 multiple-choice |
| Passing score | 450 on a scaled score of 200 to 800 |
| Languages | English, Spanish, Chinese (Simplified), French, German, Korean, Japanese |
| Eligibility window | 6 months from registration; one 6-month extension for US$75 |
| Retakes | Up to 4 attempts in a rolling 12 months: wait 30 days after attempt 1, then 90 days after each later attempt |
| Application | Within five years of passing the exam |
| Maintenance | At least 20 CPE hours a year and 120 over each three-year period |
| Annual maintenance fee | US$45 (member) / US$85 (non-member) |
How Much Does the CISA Exam Cost in Total?
The exam registration fee is US$575 for ISACA members and US$760 for non-members. It is nonrefundable and nontransferable.
Other costs depend on how your path goes:
| Cost | Amount | When |
|---|---|---|
| Exam registration | US$575 member / US$760 non-member | When you register |
| Eligibility extension | US$75 | Only if you need a second six-month period; one extension is allowed |
| Rescore request | US$75 | Optional, within 30 days of results if you do not pass |
| Application processing fee | US$50 | After you pass, when you apply for certification |
| Annual maintenance fee | US$45 member / US$85 non-member | Each year after you are certified, due by 1 January |
Membership saves US$185 on the exam fee alone. When you compare that to ISACA's current membership fee, you can decide whether joining before you register makes sense for you. A retake needs a new registration fee each time.
How Do I Register and Schedule the Exam?
Registration is continuous, so you can register whenever you are ready to start. From the day you register you have six months to take the exam. You pay the fee in full before you can schedule, and you can schedule an appointment as early as 48 hours after payment. Appointments are only available 90 days in advance.
If you need more time, you can buy one six-month extension for US$75. The option appears on your dashboard 30 days before and after your eligibility expires, and if you have an appointment scheduled you must cancel it at least 48 hours before to extend. You can reschedule at any time during the eligibility period without penalty if you give at least 48 hours notice. If you do not take the exam inside the eligibility period, miss your appointment, or arrive more than 15 minutes late, you forfeit the eligibility and the registration fee.
The exam is computer-based and is offered at authorized PSI testing centers or as a remotely proctored exam.
What Are the Five CISA Domains?
| Domain | Weight |
|---|---|
| 1. Information System Auditing Process | 18% |
| 2. Governance and Management of IT | 18% |
| 3. Information Systems Acquisition, Development and Implementation | 12% |
| 4. Information Systems Operations and Business Resilience | 26% |
| 5. Protection of Information Assets | 26% |
Each domain is split into two parts. Here are the subtopics ISACA lists, so that you can use them as a checklist.
Domain 1: Information System Auditing Process (18%)18%
- Planning: IS audit standards, guidelines, and codes of ethics; types of audits, assessments, and reviews; risk-based audit planning; types of controls and considerations
- Execution: audit project management; audit testing and sampling methodology; audit evidence collection techniques; audit data analytics; reporting and communication techniques; and quality assurance and improvement of the audit process
Domain 2: Governance and Management of IT (18%)18%
- IT governance: laws, regulations, and industry standards; organizational structure, IT governance, and IT strategy; IT policies, standards, procedures, and practices; enterprise architecture; enterprise risk management; privacy program and principles; and data governance and classification
- IT management: IT resource management, IT vendor management, IT performance monitoring and reporting, and quality assurance and quality management of IT
Domain 3: Information Systems Acquisition, Development and Implementation (12%)12%
- Acquisition and development: project governance and management, business case and feasibility analysis, system development methodologies, and control identification and design
- Implementation: system readiness and implementation testing, configuration and release management, system migration and data conversion, and post-implementation review
Domain 4: Information Systems Operations and Business Resilience (26%)26%
- Operations: IT components, IT asset management, job scheduling and production process automation, system interfaces, shadow IT and end-user computing, systems availability and capacity management, problem and incident management, IT change, configuration, and patch management, operational log management, IT service level management, and database management
- Business resilience: business impact analysis, system and operational resilience, data backup, storage, and restoration, the business continuity plan, and disaster recovery plans
Domain 5: Protection of Information Assets (26%)26%
- Information asset security and control: security frameworks, standards, and guidelines; physical and environmental controls; identity and access management; network and end-point security; data loss prevention; data encryption; public key infrastructure; cloud and virtualized environments; and mobile, wireless, and Internet-of-Things devices
- Security event management: security awareness training and programs, attack methods and techniques, security testing tools and techniques, security monitoring tools and techniques, security incident response management, and evidence collection and forensics
Domains 4 and 5 together are 52% of the exam, more than Domains 1, 2, and 3 combined. Weight your study time accordingly, but do not neglect Domain 3: at 12% it is smaller, yet it can still decide a close result.
How Are CISA Questions Written?
ISACA's candidate guide says every question has a stem and four answer options, and every question has one best answer. The stem can be a question or an incomplete statement. Some questions turn on a qualifier such as MOST likely or BEST, so read the stem for that word before you look at the options.
The guide's tips are simple. Eliminate the options you know are wrong, then pick the best of what remains. There is no penalty for a wrong answer, and your grade is based only on the number of questions you answer correctly, so answer every question. The exam also includes unscored pretest items, which do not count toward your score.
Practise in the same shape. Read the stem, find the qualifier, rule out the options that do not fit, and choose the best remaining answer. Then read why each of the other options is wrong.
How Is the CISA Scored?
Scores are reported on a scale of 200 to 800. A score of 800 is a perfect score, 200 is the lowest possible score, and you need 450 or higher to pass, which ISACA describes as the minimum standard of knowledge. You see your preliminary pass or fail status on screen right after the exam. Domain-level results are informational only, because your score is based on the total number of items you answered correctly, regardless of domain.
If you do not pass, you can request a rescore in writing through ISACA's support page within 30 days of the results. It costs US$75 per request, and rescores are performed by PSI.
What Happens If I Fail?
You have four attempts within a rolling 12-month period. After a failed first attempt you wait 30 days from that attempt, and after each later failed attempt you wait 90 days. You pay the registration fee in full for every attempt. If you pass, you cannot take the same exam again within the five-year application period.
Plan your first attempt as if it were your only one, and use the domain feedback to shape your next study plan if it is not.
Passing the Exam Is Not the Same as Earning the CISA
To become certified you need more than a passing score:
- Pass the exam
- Pay the US$50 application processing fee
- Submit an application showing at least five years of professional information systems auditing, control, or security work within the ten years before your application date, verified by a supervisor or manager
- Follow ISACA's Code of Professional Ethics and the Information Systems Auditing Standards
- Follow ISACA's Continuing Professional Education policy
You can take the exam before you meet the experience requirement, but you must meet it before you are certified. You have five years from the date you pass to apply.
What Does Maintaining the CISA Involve?
Once certified, you report at least 20 CPE hours each year and at least 120 CPE hours over each three-year reporting period. The annual maintenance fee is US$45 for ISACA members and US$85 for non-members, and it is due by 1 January each year.
Where Can I Practise with Realistic CISA Questions?
ISACA publishes the content outline and the candidate guide on its CISA pages. Use the outline above as your checklist and the guide for the rules.
CertCompanion's CISA practice questions give you scenario-based practice with explanations for every option. Start with the 30 free questions to see which domains need work.
| CISA question bank | |
|---|---|
| Questions | 895 |
| Single-answer | 804 |
| Select-all-that-apply | 91 (10%) |
| Median explanation length | 93 words |
For the other ISACA credentials, see the ISACA certification practice exams page, and the IT Audit Fundamentals exam guide if you are earlier in your audit career.
A Worked CISA Question
Adatum Technologies is implementing cutover from its legacy inventory system to a new ERP system. The implementation is considered high-risk because the inventory system supports real-time manufacturing operations. Senior management has minimal tolerance for operational disruption. Which cutover strategy should the IS auditor recommend? (Select one!)
- A. Parallel cutover to run both systems simultaneously until the new system is validated
- B. Big bang cutover to minimize the duration of transition activities
- C. Phased cutover to implement the system incrementally by business unit
- D. Pilot cutover to implement in a single location before enterprise rollout
Show the answer and the reasoning
Correct answer: A. Parallel cutover to run both systems simultaneously until the new system is validated
Parallel cutover provides the lowest risk approach by operating both the legacy and new systems simultaneously. This allows the organization to verify the new system produces accurate results while maintaining the ability to fall back to the legacy system if critical issues arise. For high-risk implementations supporting real-time manufacturing operations where management has minimal tolerance for disruption, parallel operation provides maximum protection against data integrity issues or system failures. Big bang cutover represents the highest risk with immediate full transition. Phased cutover still requires committing portions of the business to the new system. Pilot cutover helps validate the system but eventually requires a full commitment.
How Should I Prepare, and What Should I Do on Exam Day?
Turn the subtopic lists above into a checklist and rate yourself on each: can you explain it, and could you apply it to a scenario? Anything you cannot go to the top of your plan, weighted by domain. Domains 4 and 5 get the largest share of your time, followed by Domains 1 and 2, then Domain 3.
Practise in timed sets. 150 questions in 240 minutes is about 96 seconds per question, so practise at that pace. Review the explanation for every option, and re-check your gap list after each set.
On exam day, plan to arrive at least 30 minutes early if you test at a center. One break of no more than ten minutes is allowed with your proctor's permission, but the exam timer does not stop, so a break costs you exam time. Make a first pass, flag the questions you are unsure of, and return to them at the end.
Frequently Asked Questions
How much does the CISA exam cost? US$575 for ISACA members and US$760 for non-members, plus a US$50 application processing fee after you pass.
How many questions are on the CISA exam, and how long is it? 150 multiple-choice questions in four hours (240 minutes).
What is the passing score? 450 on a scaled score of 200 to 800.
Do I need five years of experience before I can take the exam? No. You can take the exam first, but you need at least five years of qualifying experience before you are certified, and you must apply within five years of passing.
How many times can I retake the exam? Four attempts within a rolling 12-month period, with a 30-day wait after the first attempt and 90 days after each later one.
How long do I have to take the exam after I register? Six months. You can buy one six-month extension for US$75.
What does it cost to keep the certification? US$45 a year for members and US$85 for non-members, plus at least 20 CPE hours a year and 120 over three years.
Ready to find your gaps before exam day? Start with free CISA practice questions at CertCompanion.
Checked against official ISACA CISA exam documentation and current candidate reports. Last verified 2026-10-30.