CISA

Overview

Certified Information Systems Auditor (CISA) is a certification from ISACA for people who audit, monitor and assess information technology and business systems. It is open to candidates worldwide and is not tied to any one country. ISACA describes it as a standard of achievement for IT audit, with attention to newer areas such as AI and blockchain.

Passing the exam is only part of becoming certified. You must also show work experience, apply to ISACA, accept its Code of Professional Ethics and keep up your learning every year.

Who can apply

ISACA lists no experience requirement for registering for the exam. To be certified, it requires at least five years of professional work in information systems auditing, control or security. The experience must fall within the ten years before you apply. A supervisor or manager must verify it.

You have five years from the date you pass the exam to submit your certification application.

Exam pattern

The exam has 150 questions and is computer-based. You can take it at an authorised PSI testing centre or as a remotely proctored exam. Questions are spread over five domains.

ISACA also publishes its CISA terminology list translated into several languages, including Chinese (Simplified), French, German, Japanese, Korean and Spanish, as a study aid.

Syllabus

The five domains run from planning and carrying out an audit, through IT governance and management, building and acquiring systems, and keeping operations running and resilient, to protecting information assets. The last of these includes cybersecurity principles. The full content outline is on the ISACA site.

Important dates

Exam registration is continuous, so you can register at any time. After you pay, you get a six-month eligibility period to take the exam. You can book an appointment as early as 48 hours after payment. Rescheduling is free during your eligibility period if you do it at least 48 hours before your appointment.

Fees

As listed on the official site in 2026:

How to apply

1. Register for the exam through your ISACA account and pay the fee.

2. Schedule a testing appointment with PSI, at a centre or remotely proctored.

3. Pass the exam.

4. Within five years of passing, pay the application processing fee and submit the certification application online. Non-English forms are available in Italian, Spanish, German, Japanese, Korean and Simplified Chinese.

5. Have a supervisor or manager verify your work experience.

After the exam

To stay certified you must:

• Earn and report at least 120 continuing professional education (CPE) hours in each three-year reporting period, with at least 20 hours in every year.

• Follow ISACA's Code of Professional Ethics.

• Follow the Information Systems Auditing Standards that ISACA has adopted.

Preparation tips

• Weight your study by domain. Domains 4 and 5 together make up over half the questions.

• Use the official content outline as your checklist.

• ISACA offers group training, self-paced training and study resources. Check its site for current options.

• Book an appointment early in your six-month window so you can reschedule if needed.

FAQs