The ISACA IT Audit Fundamentals Certificate costs US$175 for ISACA members and US$225 for non-members, takes two hours, and has no prerequisites. Whether that is worth it depends on what you need it for, so this guide lays out the real cost, what the exam covers, and the questions that decide it for you.
TL;DR
- Exam fee: US$175 for ISACA members, US$225 for non-members
- The exam is two hours, online and remotely proctored, and you need 65% or higher to pass
- There are no prerequisites, and your eligibility lasts six months from registration
- ISACA sells a study guide (US$75 member, US$85 non-member) and an online course (US$300 member, US$450 non-member) that earns 12 CPE
- The exam covers six domains, led by Performing an Audit at 35% and IT Environment and Components at 25%
What Does the IT Audit Fundamentals Certificate Cost in Total?
The exam fee is the floor. Here are ISACA's published prices, with the totals added up:
| Item | Member | Non-member |
|---|---|---|
| Exam | US$175 | US$225 |
| Study guide | US$75 | US$85 |
| Online course | US$300 | US$450 |
| Exam plus study guide | US$250 | US$310 |
| Exam plus online course | US$475 | US$675 |
| Exam, study guide, and online course | US$550 | US$760 |
The study guide comes as a digital or print edition. The online course covers all six domains with video, interactive modules, downloadable resources, and performance-based labs, and it earns 12 CPE when you complete it.
Membership changes the maths. It saves US$50 on the exam, US$10 on the study guide, and US$150 on the online course, which is US$210 across all three. ISACA sets the membership fee separately, so compare its current price with the savings for the items you actually plan to buy. If you only want the exam, the saving is US$50.
Remember that each retake needs a new registration. Plan for the exam to cost once, and treat a second attempt as a possible extra.
What Does the Exam Look Like?
The exam is two hours long, delivered online with remote proctoring, and you need 65% or higher to pass. It uses multiple-choice questions plus interactive, or "innovative," question types.
There are no prerequisites, so you can register at any time. Eligibility is established when you register and lasts six months. In that time you need to schedule and take the exam, so pick a registration date that matches when you can start studying, not a date far ahead.
What Does It Cover?
The exam has six domains, and the weights are very uneven:
| Domain | Weight |
|---|---|
| Performing an Audit | 35% |
| IT Environment and Components | 25% |
| Specific Audit Subjects | 15% |
| Overview of Newer Technologies | 12% |
| Controls, Risk and Audit | 8% |
| Audit Function | 5% |
The first two domains are 60% of the exam between them. If you are short on time, those are where your hours earn the most. The smaller domains still matter, but a quick pass through Controls, Risk and Audit and the Audit Function is a better use of time than a deep dive.
What Will You Actually Spend? Three Realistic Scenarios
The sticker price is the exam, but plenty of people spend somewhere between the exam alone and the full set of ISACA materials. Here are three ways to put the numbers together, using ISACA's published prices.
The lean route. You sit the exam and prepare with free or low-cost practice questions and your own notes. As a non-member that is US$225, as a member US$175. This suits you if you already know the subject area from work or study and mainly need to check your knowledge against the six domains.
The balanced route. You add ISACA's study guide, so the total is US$250 for a member and US$310 for a non-member. The study guide is the lower-cost official resource and suits you if you prefer reading and making your own notes.
The full route. You add the online course as well, for US$550 as a member or US$760 as a non-member. The course covers all six domains with video, interactive modules, downloadable resources, and performance-based labs, and it earns 12 CPE. It suits you if you learn best from guided material, or if the CPE has value for another credential you hold.
Whichever route you choose, add the cost of practice questions if you use a paid bank, and leave room in your budget for a second exam attempt if your first does not go to plan. Deciding the route before you buy anything stops the spend from creeping upward.
How Do the Study Guide, the Course and Practice Questions Differ?
They do different jobs, and you do not need all three.
The study guide is a prep aid for the exam. Use it as your reference: read a domain, then test yourself on it. It is sold in digital and print editions.
The online course is a guided route through the six domains. Its performance-based labs let you practise audit tasks rather than only read about them, and the 12 CPE it earns on completion can count towards other ISACA credentials you hold. Because ISACA's pages describe the access period differently in different places, check the access length on the page you buy from before you rely on it.
Practice questions are how you find your gaps. Reading tells you what the material says; questions show you whether you can apply it. Work in short sets by domain, read the explanation for every option, and keep a running list of what you missed. After each set, move the weakest topics to the top of your list.
A sensible mix for most people is one main source of learning, either the guide or the course, plus regular practice questions from week one rather than only at the end.
How Should I Split My Time Across the Six Domains?
The weights tell you where the marks are. Performing an Audit is 35% and IT Environment and Components is 25%, so together they are 60% of the exam. A sensible plan gives them the largest blocks of time, with the next biggest share going to Specific Audit Subjects at 15% and Overview of Newer Technologies at 12%.
Controls, Risk and Audit (8%) and the Audit Function (5%) are the smallest domains. Give them a focused pass rather than a deep dive, and come back to them in your final review.
A simple routine works well. For each domain, read or watch the material, write a short summary in your own words, answer a set of practice questions, and then review every explanation. Mark each topic as solid, shaky or unfamiliar. Shaky and unfamiliar topics get a second pass the following week, and anything still shaky in the last week gets targeted practice.
Because the exam includes interactive question types as well as multiple choice, spend a little time before test day getting used to answering questions that ask you to apply a process, not just recall a definition.
So Is It Worth It? Four Questions That Decide It
1. What do you need it for? The certificate is aimed at people starting out in IT audit, and ISACA positions its online course as covering the six domains from the beginning. If you want a structured introduction to the field and a recognised ISACA credential to show you completed it, the cost is modest. If you already work in audit and know the domains, a beginner exam is less likely to add much.
2. What can you spend? The exam alone is US$175 to US$225. Adding the study guide brings you to US$250 to US$310, and adding the course takes you to US$475 to US$675. The study guide is the lower-cost preparation route; the course is worth considering if you want video, interactive modules and labs, or you need the 12 CPE for another credential you hold.
3. How much time do you have? The six-month eligibility window gives you a clear deadline. Decide up front how many evenings per week you can study, count back from the exam date, and book only when your timeline is realistic.
4. Are you comfortable with a proctored online exam? The exam is remotely proctored, so you need a suitable computer, a quiet room, and a stable connection. Run ISACA's system compatibility check before you register so that technical problems do not cost you an attempt.
If your answers are a clear need, a modest budget, enough time, and a suitable setup, the certificate is a reasonable investment. If any of them is a no, fix that first.
How Should I Prepare?
Start with the six domains and weight your time by their share of the exam: Performing an Audit and IT Environment and Components first, then Specific Audit Subjects and Overview of Newer Technologies, then the two smallest.
For each domain, make a list of the topics you can explain and the ones you cannot. Use the study guide or the online course as your main source, then switch to practice questions to find the gaps. Read the explanation for every option, not just the right one, and re-check your gap list after each set.
CertCompanion's IT Audit Fundamentals practice questions give you scenario-based practice with explanations for every option. Start with the 30 free questions to see which domains need work, then drill the bank by domain.
| IT-Audit-Fund question bank | |
|---|---|
| Questions | 627 |
| Single-answer | 591 |
| Select-all-that-apply | 36 (6%) |
| Median explanation length | 103 words |
For a walk through each domain and the question types, the IT Audit Fundamentals exam guide goes into more detail, and the ISACA certification practice exams page lists the other credentials if you are planning a path.
How Does a Realistic Question Work?
An auditor is reviewing controls over the organization's PKI infrastructure used for digital signatures and encryption. The audit reveals that private keys are stored in software keystores protected only by default passwords that have not been changed since installation. What is the GREATEST risk? (Select one!)
- A. Public key certificates may expire without renewal causing service disruptions
- B. The certificate revocation list may not be updated regularly
- C. Key escrow procedures may not comply with regulatory requirements
- D. Private keys may be compromised allowing attackers to decrypt sensitive data and forge digital signatures
Show the answer and the reasoning
Correct answer: D. Private keys may be compromised allowing attackers to decrypt sensitive data and forge digital signatures
Private key compromise allowing decryption and forgery represents the greatest risk because private keys are the foundation of PKI security. If attackers obtain private keys through weak default passwords, they can decrypt all data encrypted with corresponding public keys, forge digital signatures to impersonate legitimate users, and completely undermine non-repudiation controls. This is a critical security failure with immediate severe consequences including data breaches, fraudulent transactions, and total loss of cryptographic protection. Key management controls are fundamental ITGCs where failure has pervasive impact. Certificate expiration causes availability issues but not confidentiality breaches. CRL update delays may allow use of revoked certificates temporarily. Escrow compliance is important but does not have the immediate catastrophic impact of key compromise through weak passwords.
What Happens After You Pass?
ISACA's materials describe the certificate as an entry point to IT audit, and the online course earns 12 CPE, which suggests it is meant to sit alongside other ISACA learning. How you use the credential is up to you: add it to your profile, use the six domains as a map of the field, and decide which area of audit you want to go deeper in.
Before you pay, write down what you want the certificate to do for you in the next twelve months, for example completing a structured introduction to the field, giving you the vocabulary for an interview, or filling a gap in your knowledge before you move into an audit role. If you can name the outcome and the spend fits it, go ahead. If you cannot, spend a week with the free practice questions and the domain list first, and see whether the material holds your interest before you commit to the exam fee.
It also helps to treat the exam as one step in a longer plan rather than a finish line. The six domains give you a ready-made list of subjects to keep learning, and the ISACA practice exams for other credentials show where you could go next.
What Should I Know About Exam Day?
The exam is remotely proctored, so check your computer and connection with ISACA's compatibility check beforehand. Schedule only after you have paid, and note that rescheduling and cancelling have notice requirements, so read the rules when you book. Treat two hours as a budget, make a first pass through the questions, and flag any you are unsure of to return to.
After the exam, you see your result against the 65% pass mark. If you do not pass, you register again for the next attempt, so use the domain feedback you remember to build your next study plan.
Frequently Asked Questions
How much does the IT Audit Fundamentals exam cost? US$175 for ISACA members and US$225 for non-members.
What is the passing score? 65% or higher.
How long is the exam? Two hours, delivered online with remote proctoring.
Do I need experience or a prerequisite certification? No. There are no prerequisites.
How long do I have to take the exam after registering? Eligibility lasts six months from the date you register.
What are the exam domains? Performing an Audit (35%), IT Environment and Components (25%), Specific Audit Subjects (15%), Overview of Newer Technologies (12%), Controls, Risk and Audit (8%), and Audit Function (5%).
Does ISACA sell preparation materials? Yes: a study guide (US$75 member, US$85 non-member) and an online course (US$300 member, US$450 non-member) that covers all six domains and earns 12 CPE.
Ready to find your gaps before you pay? Start with free IT Audit Fundamentals practice questions at CertCompanion.
Checked against official ISACA IT-Audit-Fund exam documentation and current candidate reports. Last verified 2026-10-30.