ISACA CISA Certification: Exam, Cost, Requirements & Online Training

The ISACA CISA Certification is a professional credential for auditing, controlling, monitoring, and assessing information systems. The exam contains 150 multiple-choice questions, lasts four hours, and covers five domains: auditing, IT governance, acquisition and implementation, operations and business resilience, and information-asset protection. To become certified, candidates must pass the exam, meet ISACA’s experience requirement, submit the application, follow professional ethics, and maintain the credential through annual and three-year CPE requirements. It suits IT auditors, GRC specialists, security professionals, and reviewers.

Professionals comparing an ISACA CISA Certification, an online CISA certification course, or a structured exam plan can review the CISA Certification program. CISA is issued by ISACA for professionals who evaluate whether technology, controls, governance, and business processes support organizational objectives.

What Is the ISACA CISA Certification?

CISA stands for Certified Information Systems Auditor. The certification validates professional knowledge in information systems auditing, control, assurance, governance, risk, security, and operational resilience. ISACA describes CISA as a standard for auditing, monitoring, and assessing IT and business systems, with attention to emerging technologies such as AI and blockchain.

It supports careers in IT audit, internal audit, cybersecurity assurance, GRC, compliance, risk management, privacy, control testing, and technology consulting. Security professionals can use CISA to strengthen assurance skills, while auditors can improve their understanding of cloud, applications, infrastructure, data, and security controls.

Its practical value is judgment: assessing design, operation, evidence, policy alignment, and risk reduction.

CISA Certification Requirements and Eligibility

You may take the CISA exam before completing the required work experience, but the experience must be satisfied before certification is awarded.

The main requirements are:

• Pass the CISA exam.

• Demonstrate at least five years of professional information systems auditing, control, or security experience in the relevant job-practice areas.

• Apply for certification within five years of passing the exam.

• Ensure the qualifying experience was earned within the 10-year period before the application date.

• Agree to ISACA’s Code of Professional Ethics and applicable information systems auditing standards.

ISACA allows certain experience substitutions or waivers, with a maximum reduction of three years in eligible circumstances. Read the current application form carefully: general system administration, help desk, software development, or security work may qualify only when duties match approved experience areas.

CISA Exam Format and Passing Score

The CISA exam contains 150 multiple-choice questions and gives candidates four hours to complete it. The exam is computer-based and available through authorized PSI testing centers or remote proctoring. ISACA uses a scaled score from 200 to 800, and a score of 450 or higher is required to pass.

Questions are designed around job practices rather than isolated textbook definitions. Read qualifiers such as MOST appropriate, BEST, PRIMARY, or NEXT carefully. Several options may appear technically reasonable, but the correct answer usually reflects the auditor’s responsibility, risk priority, evidence quality, governance position, or proper sequence of action.

CISA domain

Weight

Main preparation focus

Information Systems Auditing Process

18%

Audit planning, risk assessment, evidence, sampling, testing, reporting, and quality assurance

Governance and Management of IT

18%

IT strategy, policies, enterprise risk, privacy, resource management, vendors, and performance

Information Systems Acquisition, Development and Implementation

12%

Business cases, feasibility, project governance, controls, testing, migration, and post-implementation review

Information Systems Operations and Business Resilience

26%

IT operations, assets, availability, incidents, changes, logs, continuity, and recovery

Protection of Information Assets

26%

Security governance, access, data protection, monitoring, vulnerabilities, threats, and incident response

The two largest areas are Operations and Business Resilience and Protection of Information Assets, together representing 52% of the exam. That does not justify ignoring the other domains. Audit methodology and governance determine how you frame findings, evaluate accountability, and communicate recommendations.

CISA Certification Cost and Registration

The current CISA exam registration fee is US$575 for ISACA members and US$760 for non-members. ISACA also lists a one-time US$50 certification application processing fee after the candidate passes and is ready to apply. Exam fees are nonrefundable and nontransferable.

Your complete CISA certification cost may include:

1. ISACA membership, if you choose member pricing and benefits.

2. The CISA exam registration fee.

3. The US$50 certification application processing fee.

4. A CISA exam prep course, review manual, question database, or mock test.

5. Annual maintenance fees after certification.

Registration gives candidates a six-month eligibility period. A six-month extension may be purchased for US$75 under the candidate-guide conditions. Check before payment because policies can change.

CISA Exam Preparation: What Actually Works

A strong CISA exam prep course should follow the current ISACA Exam Content Outline and use realistic scenarios. Look for:

• Domain-by-domain lessons mapped to the official job practices.

• Explanations that show why one option is best and why the others are weaker.

• Practice questions covering audit, governance, implementation, operations, resilience, and security.

• Timed mock exams that build four-hour pacing.

• Review of judgment, evidence, risk, controls, and audit reporting.

• Updated study material rather than recycled questions from an older outline.

ISACA provides official preparation resources, including an online review course, a Questions, Answers & Explanations database, a review manual, and a free practice quiz. Its CISA practice quiz is useful for checking familiarity with the question style, but a short quiz cannot replace structured preparation.

Avoid relying on unauthorized CISA. Memorized or leaked questions do not develop the reasoning required for unfamiliar scenarios, and using improper exam content can create ethical, security, and certification risks. Legitimate preparation should help you understand the ISACA way of thinking: protect organizational value, establish reliable evidence, assess risk, and recommend actions within the correct responsibility.

A Practical CISA Study Plan

Use a four-stage plan:

1. Build the framework. Learn the purpose of audit, governance, controls, risk, assurance, and evidence before memorizing details.

2. Study the domains. Give extra time to Domains 4 and 5, while continuing to review Domains 1 and 2 because they shape audit judgment.

3. Practice decision-making. For each question, identify the objective, risk, responsible party, evidence, and sequence before looking at the options.

4. Measure readiness. Complete timed mixed-domain exams and maintain an error log. Record whether each mistake came from weak knowledge, misreading, poor prioritization, or time pressure.

The best answer is often the one that addresses the root control or governance issue without exceeding the auditor’s authority. Do not automatically choose the most technical response. CISA questions frequently test whether you understand independence, management responsibility, risk-based planning, and appropriate escalation.

CISA Online Training and Career Opportunities

CISA online training suits working professionals who need flexible study, recorded lessons, instructor guidance, and digital practice. A live CISA class may be better for candidates who need accountability. The format matters less than official-outline alignment, explanation quality, and study discipline.

CISA can support roles such as:

• IT Auditor

• Information Systems Auditor

• Internal Auditor

• IT Risk Analyst

• GRC Analyst

• Compliance Analyst

• Security Assurance Specialist

• Technology Risk Consultant

• Audit or Security Manager, when experience supports the role

The certification does not guarantee a job, salary increase, or promotion. Its value is strongest when paired with practical evidence such as audit workpapers, risk assessments, control matrices, findings, remediation tracking, or security assurance reports.

How to Get CISA Certified

Use this sequence:

1. Review the official CISA Exam Content Outline and confirm the five domains.

2. Choose a CISA certification training course or self-study path.

3. Register with ISACA and pay the exam fee.

4. Schedule the exam within the six-month eligibility period.

5. Complete the 150-question exam and obtain a passing scaled score.

6. Gather supervisor-verified experience records.

7. Pay the application processing fee and submit the certification application within five years of passing.

8. Maintain the credential through CPE, ethics, standards, and annual fee requirements.

Maintaining the CISA Certification

CISA holders must earn and report at least 20 CPE hours annually and 120 CPE hours over a three-year reporting period. They must also pay an annual maintenance fee of US$45 for ISACA members or US$85 for non-members, comply with the Code of Professional Ethics, follow ISACA’s IT Auditing Standards, and respond to a CPE audit if selected.

CPE can come from webinars, conferences, online training, on-demand learning, skills-based labs, volunteering, teaching, and other qualifying professional activities. Keep certificates and attendance records because ISACA may request supporting documentation.

Choose a Preparation Path That Matches Your Goal

The ISACA CISA Certification is a strong choice for professionals who want to formalize expertise in IT audit, governance, control, risk, compliance, and security assurance. Begin by checking your experience, reviewing the domain weights, and selecting preparation that teaches judgment instead of only memorization. For online training, updated study material, sample questions, mock tests, and exam guidance, review the CISA Certification page before setting your exam plan.