By N. Craig

1. Introduction to the CISA

The Certified Information Systems Auditor (CISA) is a globally recognized professional certification awarded by ISACA (Information Systems Audit and Control Association). First introduced in 1978, the CISA has grown to become one of the most prestigious and widely sought-after credentials in the fields of information systems auditing, assurance, control, and security governance.

The CISA is specifically designed for professionals who audit, monitor, assess, and control information technology and business systems. Unlike certifications that focus on offensive or technical security skills, the CISA is rooted in governance, risk management, compliance, and audit methodology thereby equipping professionals to evaluate and improve the integrity of enterprise IT environments.

As of 2024, more than 170,000 professionals worldwide hold the CISA designation. The credential is recognized by organizations in over 188 countries and is consistently listed among the highest-paying and most in-demand certifications in the information security landscape.

Background and Governing Body

ISACA, founded in 1969, is a global professional association focused on IT governance, risk, security, and assurance. Headquartered in Schaumburg, Illinois, ISACA serves more than 170,000 members in 188 countries and administers several globally respected certifications, including the CISA, CISM (Certified Information Security Manager), CRISC (Certified in Risk and Information Systems Control), and CGEIT (Certified in the Governance of Enterprise IT).

ISACA publishes the COBIT framework (Control Objectives for Information and Related Technologies), which serves as a foundational reference for IT governance and aligns closely with the knowledge domains tested in the CISA examination.

Why the CISA Stands Apart

• One of the oldest and most established cybersecurity certifications, with over 45 years of history
• Recognized and required by government agencies, financial institutions, and multinational corporations
• Directly aligned with international standards including ISO/IEC 27001, COBIT, and ITIL
• Bridges the gap between IT and business leadership, enabling effective communication of risk
• Required or preferred for many auditor, compliance, and governance roles in regulated industries
• Vendor-neutral: applicable across all industries and technology platforms

2. Exam Format and Structure

The CISA examination is a rigorous, multiple-choice assessment administered globally by ISACA. The exam is offered in computer-based testing (CBT) format at Pearson VUE testing centers worldwide, as well as remotely via online proctoring. It is offered in multiple languages, reflecting its global reach.

Exam At a Glance

Scoring and Results

ISACA uses a scaled scoring methodology to account for variations in question difficulty across different exam versions. The exam scoring system ranges from 200 to 800, and a minimum of 450 is required to pass. Candidates receive a score report immediately after completing the exam at a Pearson VUE center. The report includes a total scaled score and a performance breakdown by domain, which is particularly valuable for candidates who need to retake the exam.

Exam Domain Weighting

The CISA exam is structured around five job practice domains. Each domain is weighted based on its relative importance to the role of an IS auditor, as determined through ISACA’s periodic job practice analysis surveys conducted with practitioners worldwide.

3. The Five CISA Job Practice Domains

The CISA curriculum is organized around five job practice domains that represent the core competencies of an information systems auditor. Each domain reflects key activities, knowledge areas, and tasks that auditors perform in practice.

Domain 1: Information Systems Auditing Process (21%)

This domain forms the methodological foundation of the CISA certification. It covers the planning, execution, reporting, and follow-up of IS audits in accordance with professional standards. Candidates must understand how to develop risk-based audit plans, apply audit evidence standards, and document audit findings in a manner consistent with ISACA’s IT Audit and Assurance Standards.

Key Knowledge Areas

• ISACA IT Audit and Assurance Standards, Guidelines, and Codes of Professional Ethics
• Types of audits: compliance, operational, financial, integrated, and forensic
• Risk-based auditing concepts and audit universe development
• Audit evidence: types, sufficiency, reliability, and collection methods
• Sampling techniques: statistical and non-statistical sampling
• Control Self-Assessment (CSA) frameworks and facilitation techniques
• Audit documentation, working papers, and retention policies
• Audit reporting: findings, conclusions, recommendations, and management responses
• Follow-up procedures and auditee compliance monitoring

Domain 2: Governance and Management of IT (17%)

This domain addresses the structures, processes, and practices by which IT is directed, controlled, and aligned with organizational objectives. It evaluates a candidate’s ability to assess the effectiveness of IT governance frameworks, strategic planning processes, HR management, and IT performance measurement systems.

Key Knowledge Areas

• IT governance frameworks: COBIT, ISO/IEC 38500, ITIL, and their audit implications
• IT strategic planning and alignment with organizational goals
• IT organizational structures, roles, and responsibilities
• IT policies, standards, procedures, and guidelines
• IT resource management: human resources, budgeting, and vendor management
• IT performance measurement: KPIs, KRIs, dashboards, and balanced scorecards
• Outsourcing and third-party management: SLAs, contracts, and vendor risk
• IT investment and portfolio management processes
• Enterprise architecture frameworks: TOGAF, Zachman

Domain 3: Information Systems Acquisition, Development & Implementation (12%)

This domain tests knowledge of the processes used to acquire, develop, and implement information systems—and how auditors evaluate these processes for adequacy, control, and alignment with business requirements. It encompasses the entire system development life cycle (SDLC) and project management practices.

Key Knowledge Areas

• Business case development and project governance oversight
• Project management frameworks: PMBOK, PRINCE2, and Agile methodologies
• System Development Life Cycle (SDLC) methodologies and audit involvement at each phase
• Requirements definition, feasibility studies, and solution design evaluation
• Software development controls: coding standards, peer reviews, and version control
• Testing types: unit, integration, system, user acceptance, regression, and penetration testing
• Change management and release management controls
• Post-implementation review and benefits realization assessment
• Application controls: input, processing, and output controls
• Data conversion and migration controls during system transitions

Domain 4: Information Systems Operations and Business Resilience (23%)

This domain covers the ongoing operation, maintenance, and resilience of information systems. It includes IT service management, incident management, disaster recovery, and business continuity—all viewed through the lens of audit assurance. Auditors must assess whether operational controls are adequate to ensure continuity, availability, and recovery of critical systems.

Key Knowledge Areas

• IT service management (ITSM) processes aligned with ITIL: incident, problem, change, and configuration management
• Infrastructure components: servers, storage, networks, and cloud services
• IT operations controls: job scheduling, monitoring, and helpdesk management
• Capacity and availability management processes
• Business continuity planning (BCP): development, testing, and maintenance
• Disaster recovery planning (DRP): RTO, RPO, and recovery strategies
• Backup and media management controls
• Data center physical and environmental controls
• Cloud computing models (IaaS, PaaS, SaaS) and associated audit considerations
• Virtualization and container technologies from an audit perspective

Domain 5: Protection of Information Assets (27%)

The largest and most heavily weighted domain, Protection of Information Assets addresses the controls, policies, and technologies used to safeguard organizational information. This domain blends technical security knowledge with governance and risk management, requiring candidates to evaluate both the design and operating effectiveness of security controls.

Key Knowledge Areas

• Information security governance frameworks: ISO/IEC 27001/27002, NIST Cybersecurity Framework
• Data classification schemes and information asset inventory management
• Access control models: DAC, MAC, RBAC, and ABAC
• Identity and access management (IAM): authentication, authorization, and privileged access management
• Network security controls: firewalls, IDS/IPS, DMZ design, and VPNs
• Cryptography: encryption algorithms, PKI, digital signatures, and key management
• Endpoint security: antivirus, DLP, patch management, and mobile device management
• Oversight: Vulnerability management and penetration testing
• Security incident and event management (SIEM) and log review
• Social engineering and security awareness program evaluation
• Privacy regulations and data protection requirements: GDPR, CCPA, HIPAA

4. Eligibility Requirements and Experience

Unlike some certifications that can be earned purely through examination, the CISA requires candidates to meet specific professional experience requirements before the certification can be awarded. This ensures that CISA holders are not only knowledgeable but are also practitioners with demonstrated real-world exposure to IS auditing.

Work Experience Requirements

To become certified, candidates must have a minimum of five (5) years of professional work experience in IS auditing, control, assurance, or security. This experience must be verified and submitted to ISACA within five years of passing the examination.

Experience Substitution and Waivers

ISACA recognizes that candidates may have relevant academic or professional backgrounds that substitute for some of the required experience. The following waivers are available:

Regardless of waivers applied, candidates must still demonstrate a minimum of one year of actual IS or IT experience. The total maximum substitution is three years, meaning at least two years of direct IS audit or related experience is always required.

Application and Certification Process

• Pass the CISA examination at an approved Pearson VUE testing center or via remote proctoring
• Submit the CISA certification application within 5 years of passing the exam
• Provide verified proof of qualifying work experience (minimum 5 years, with waivers applied)
• Agree to ISACA’s Code of Professional Ethics
• Agree to ISACA’s Continuing Professional Education (CPE) Policy
• Pay the applicable certification application fee

Maintaining the CISA Certification

The CISA is not a one-time achievement—it requires ongoing maintenance to remain valid. ISACA’s Continuing Professional Education program ensures that certified professionals stay current with evolving technologies, regulations, and audit practices.

• Minimum of 20 CPE hours per calendar year
• Minimum of 120 CPE hours over a 3-year rolling period
• Annual certification maintenance fee payment to ISACA
• Adherence to ISACA’s Code of Professional Ethics at all times
• Submission of CPE documentation upon request by ISACA

5. Examination Preparation Strategy

Candidates who approach the CISA exam without a structured preparation plan frequently underestimate its breadth. The exam tests not only technical IS knowledge but also audit methodology, risk concepts, governance frameworks, and professional judgment. A disciplined, multi-month preparation strategy is strongly recommended.

Recommended Study Timeline

Most candidates require three to six months of dedicated preparation, depending on their existing background in IS auditing and IT governance. Candidates with limited audit experience may require closer to six months, while experienced auditors may be prepared in three to four months.

Phase 1: Foundation Building (Weeks 1–4)

• Obtain the Official CISA Review Manual (current edition) from ISACA
• Read the full manual, focusing on understanding concepts rather than memorization
• Familiarize yourself with COBIT 2019 and ISO/IEC 27001 at a high level
• Complete the ISACA domain-by-domain self-assessments, to identify weak areas

Phase 2: Deep Study by Domain (Weeks 5–14)

• Study one domain per week, revisiting weak areas identified in Phase 1
• Use the ISACA CISA Question, Answer & Explanation (QAE) database for practice
• Attempt at least 30 practice questions per study session
• For incorrect answers, study the rationale carefully understanding why is critical
• Use supplementary materials such as the Hemang Doshi video series or Peter Gregory’s study guide

Phase 3: Exam Readiness (Weeks 15–18)

• Complete at least 1,000 practice questions total across all domains
• Take full-length timed practice exams (150 questions in 4 hours)
• Review all flagged questions and revisit weak domain areas
• Focus on ISACA’s preferred answer approach: auditor’s perspective, risk-based thinking

ISACA’s Thinking Framework

One of the most critical aspects of CISA exam preparation is understanding how ISACA expects you to think. The exam is not simply a knowledge test—it rewards a specific mindset aligned with audit best practices.

• An auditor reviews and evaluates; they do not implement or manage
• When in doubt, the answer involving risk assessment or control evaluation is usually correct
• Follow the SDLC and audit process in sequence; do not skip phases
• Management response to audit findings is always required before actions are taken
• The most conservative, risk-averse, process-oriented option is typically correct
• When two answers appear correct, choose the one that is most consistent with ISACA standards

Recommended Study Resources

6. Key Frameworks and Standards

A strong CISA candidate must be familiar with the major IT governance, security, and audit frameworks that underpin the exam’s knowledge base. These frameworks are not merely academic — they represent the standards by which IS auditors evaluate enterprise environments in practice.

COBIT (Control Objectives for Information and Related Technologies)

Developed and maintained by ISACA, COBIT is the primary IT governance and management framework referenced throughout the CISA curriculum. COBIT 2019 provides a comprehensive set of governance and management objectives, design factors, and performance management approaches. For the CISA, understanding COBIT’s structure — governance versus management domains, governance and management objectives, and performance indicators — is essential for Domain 2 and beyond.

• Governance Domain: Evaluate, Direct, Monitor (EDM)
• Management Domains: Align, Plan and Organize (APO); Build, Acquire and Implement (BAI); Deliver, Service and Support (DSS); Monitor, Evaluate and Assess (MEA)
• Design Factors: Enterprise strategy, risk profile, compliance requirements, and organizational size

ISO/IEC 27001 and 27002

ISO/IEC 27001 is the international standard for information security management systems (ISMS). It specifies requirements for establishing, implementing, maintaining, and continually improving an ISMS. ISO/IEC 27002 provides guidance on the selection and implementation of information security controls referenced in Annex A of ISO/IEC 27001. CISA candidates must understand how to audit an organization’s compliance with these standards, including the risk assessment process, statement of applicability, and control implementation.

NIST Cybersecurity Framework (CSF)

The NIST Cybersecurity Framework provides a voluntary, risk-based approach to managing cybersecurity risk. Its five core functions — Identify, Protect, Detect, Respond, and Recover, provide a structured language for discussing and evaluating cybersecurity posture. CISA auditors frequently reference the CSF when assessing an organization’s cybersecurity governance and control environment, particularly in Domain 5.

ITIL (Information Technology Infrastructure Library)

ITIL is a globally recognized framework for IT service management. For the CISA, ITIL concepts are most relevant to Domain 4, particularly around incident management, problem management, change management, and service continuity. Auditors evaluate whether ITSM processes are adequately designed and operate effectively to support business objectives.

PMBOK and Agile Methodologies

The Project Management Body of Knowledge (PMBOK), published by PMI, provides a comprehensive framework for project governance. CISA candidates must understand project management life cycles, governance structures, and the auditor’s role in reviewing project controls. Increasingly, organizations use Agile methodologies (Scrum, SAFe), and CISA candidates must understand how audit activities adapt to iterative development environments.

Risk Frameworks

Risk management is a thread that runs through all five CISA domains. Key risk frameworks include:

• ISACA Risk IT Framework — Aligns IT risk management with enterprise risk management
• ISO 31000 — International standard for risk management principles and guidelines
• NIST SP 800-30 — Guide for conducting risk assessments for federal information systems
• FAIR (Factor Analysis of Information Risk) — Quantitative risk analysis methodology

7. The Information System Audit Process in Practice

Understanding the IS audit process from end to end is fundamental to both passing the CISA examination and performing effectively as a practicing auditor. The audit process follows a structured life cycle from planning through follow-up, each phase with defined objectives, activities, and outputs.

Audit Planning

Audit planning is the most critical phase of the audit process. Inadequate planning leads to scope gaps, resource inefficiencies, and audit findings that lack supporting evidence. Effective IS audit planning includes:

• Developing a risk-based audit universe and annual audit plan
• Defining audit objectives, scope, and criteria for each engagement
• Assessing inherent risk and control risk for the audit subject
• Identifying applicable laws, regulations, and internal policies
• Allocating resources and establishing an audit timeline
• Developing an audit program (specific steps and procedures to be performed)

Fieldwork and Evidence Collection

During fieldwork, auditors execute the audit program, collecting evidence that is sufficient to support their findings and conclusions. Evidence quality is paramount — the CISA exam extensively tests candidates’ understanding of evidence standards.

Audit Reporting

The audit report is the primary deliverable of any IS audit engagement. CISA candidates must understand the components of a well-structured audit report and the importance of balancing factual findings with actionable recommendations. A quality audit report includes:

• Executive summary for senior management and the audit committee
• Statement of audit objectives, scope, and methodology
• Findings ranked by risk (critical, high, medium, low)
• Root cause analysis for each significant finding
• Management responses and agreed-upon remediation actions with timelines
• Auditor’s overall opinion or conclusion on the control environment

Follow-Up and Continuous Auditing

Audit follow-up ensures that management has implemented the agreed-upon corrective actions within the established timeframe. ISACA standards require auditors to perform follow-up procedures and report on the status of open audit findings. Continuous auditing and continuous monitoring represent the evolution of traditional periodic auditing, leveraging automated tools to provide near-real-time assurance over high-risk controls.

8. Career Value and Industry Recognition

The CISA is consistently ranked among the most valuable and highest-paying certifications in the information technology and cybersecurity sectors. Its emphasis on governance, risk, and audit makes it particularly valuable in regulated industries where oversight, accountability, and compliance are paramount.

Roles That Benefit from the CISA

Industry Demand and Salary

Demand for CISA-certified professionals is particularly strong in financial services, healthcare, government, and technology sectors, all of which face significant regulatory scrutiny and rely on IS auditors to provide independent assurance over their control environments.

• United States: CISA holders typically earn between $95,000 and $160,000+ annually, depending on role, seniority, and location
• Big 4 accounting firms (Deloitte, PwC, EY, KPMG) actively recruit CISA-certified IT auditors
• Federal government roles (DoD, FISMA-regulated agencies) frequently list CISA as required or preferred
• Financial institutions regulated by the OCC, FDIC, and Federal Reserve value the CISA for their internal audit functions

The ISACA Certification Family

The CISA sits within ISACA’s broader portfolio of professional certifications. Many professionals hold multiple ISACA certifications to demonstrate expertise across the full GRC landscape:

• CISA – Certified Information Systems Auditor (IS audit, assurance, and control)
• CISM – Certified Information Security Manager (information security management and strategy)
• CRISC – Certified in Risk and Information Systems Control (IT risk and control)
• CGEIT – Certified in the Governance of Enterprise IT (IT governance at the executive level)
• CDPSE – Certified Data Privacy Solutions Engineer (privacy technology implementation)
• CSX-P – Cybersecurity Practitioner Certification (hands-on cybersecurity skills)

Complementary Certifications

• CPA (Certified Public Accountant) – Highly complementary for external audit roles; combined CPA + CISA is extremely marketable
• CIA (Certified Internal Auditor) – IIA credential for internal auditors; pairs naturally with CISA
• CISSP (Certified Information Systems Security Professional) – Broad security management credential; combined CISSP + CISA is highly sought-after
• CISM – Fellow ISACA credential; natural next step after CISA for those moving into security management
• PMP (Project Management Professional) – Valuable complement for Domain 3 project audit knowledge
• ISO/IEC 27001 Lead Auditor – Directly applicable for organizations pursuing ISO certification

9. Exam Day Tips and Common Pitfalls

Even well-prepared candidates can struggle with the CISA exam if they are not familiar with ISACA’s specific testing approach. The exam rewards a particular style of analytical thinking that must be practiced and internalized before exam day.

Before the Exam

• Schedule the exam in your peak cognitive hours — the 4-hour duration demands sustained concentration
• Review your weakest domain one final time the evening before, without cramming new material
• Bring a valid, government-issued photo ID — names must match exactly on all documents
• Arrive at the Pearson VUE center 30 minutes early; late arrivals may not be admitted
• Ensure your testing environment is quiet and free from distractions for remote proctoring

During the Exam

• Read every question twice before selecting an answer — answer distractor options are expertly crafted
• Eliminate clearly wrong answers first; then select the best remaining option
• Think from the auditor’s perspective: your role is to evaluate and report, not to fix
• When two answers seem correct, select the one that is most aligned with ISACA standards and most risk-averse
• Flag difficult questions and return to them — do not spend more than 90 seconds on any single question
• Manage your time: 150 questions in 240 minutes allows approximately 96 seconds per question
• Do not change answers unless you have a specific, logical reason to do so

Common Failure Patterns

• Thinking like an IT manager or security practitioner instead of an IS auditor
• Insufficient practice questions — knowledge alone without question practice is insufficient
• Underestimating Domain 5 (Protection of Information Assets) given its 27% weight
• Neglecting Domain 1 methodology — many questions embed audit process concepts
• Over-reliance on prior IT experience without studying ISACA’s specific frameworks and terminology
• Not reading the CISA Review Manual in full — attempting to rely solely on third-party summaries

After the Exam

• If you pass: begin gathering and verifying your work experience documentation immediately
• Submit your CISA certification application within 5 years of your exam pass date
• If you do not pass, review the domain performance breakdown on your score report
• ISACA permits re-examination after a 30-day waiting period; maximum 3 attempts per 12 months
• Targeted review of weak domains and additional practice questions are the most effective remediation

10. Professional Ethics and Governance Obligations

The CISA designation carries significant professional and ethical obligations. IS auditors occupy a position of trust — they have access to sensitive organizational data, systems, and findings that, if misused or mishandled, could cause significant harm to organizations, stakeholders, and the public interest.

ISACA Code of Professional Ethics

All CISA holders are bound by ISACA’s Code of Professional Ethics. This code establishes the fundamental principles that govern professional conduct. Key obligations include:

• Supporting the implementation of, and encouraging compliance with, appropriate standards, procedures, and controls for information systems
• Performing duties with objectivity, due diligence, and professional care, in accordance with professional standards
• Serving in the interest of stakeholders in a lawful manner, while maintaining high standards of conduct and character
• Maintaining the privacy and confidentiality of information obtained during professional activities unless required by law or professional obligation to disclose such information
• Maintaining competency in one’s respective fields and agreeing to undertake only those activities which one can reasonably expect to complete with the necessary skills, knowledge, and competence
• Informing appropriate parties of the results of work performed, revealing all material facts known that, if not disclosed, may distort the reporting of the results
• Supporting the professional education of stakeholders in enhancing their understanding of IS security and control

Auditor Independence

Independence is the cornerstone of audit credibility. Information System (IS) auditors must be free — both in fact and in appearance — from conditions that could impair their objectivity. The two dimensions of auditor independence are:

• Independence in Fact: The auditor has no actual bias or conflict of interest with respect to the audit subject
• Independence in Appearance: The auditor has no relationships or circumstances that a reasonable third party would perceive as compromising their objectivity

CISA candidates must understand how to identify independence threats (self-review threats, familiarity threats, advocacy threats) and the safeguards available to mitigate them, including disclosure, rotation, and engagement of a different audit team.

Regulatory and Legal Context

IS auditors operate within a complex regulatory environment. Key laws and regulations frequently tested in the CISA exam and relevant to practice include:

• Sarbanes-Oxley Act (SOX) – Section 404 mandates management assessment and external auditor attestation of internal controls over financial reporting
• Health Insurance Portability and Accountability Act (HIPAA) – Governs the security and privacy of protected health information (PHI)
• General Data Protection Regulation (GDPR) – EU regulation governing personal data processing with global reach
• Gramm-Leach-Bliley Act (GLBA) – Requires financial institutions to safeguard customer financial information
• Payment Card Industry Data Security Standard (PCI DSS) – Industry standard for organizations that handle cardholder data
• Federal Information Security Management Act (FISMA) – Mandates security program requirements for U.S. federal agencies

11. Conclusion

The Certified Information Systems Auditor (CISA) represents the gold standard for professionals who audit, govern, and control information systems. With more than four decades of history and recognition spanning 188 countries, the CISA is far more than an examination credential — it is a mark of professional commitment to the highest standards of IS audit practice, ethical conduct, and continuous learning.

For organizations, CISA-certified auditors provide independent assurance that IT systems and controls are operating effectively, risks are being managed appropriately, and business objectives are being supported by reliable, secure technology. For individual professionals, the CISA certification opens doors to some of the most strategically important and financially rewarding roles in the information technology field.

The path to CISA certification demands intellectual discipline, practical experience, and a genuine commitment to understanding the governance and risk frameworks that underpin modern enterprise IT. Candidates who invest in this preparation do not merely pass an examination — they develop a professional lens through which they will evaluate and improve IT environments throughout their careers.