CISA
IT audit as a career: who the CISA is for and when it becomes essential
The CISA is ISACA's credential for people who audit information systems: who check whether the controls an organization says it has are designed properly and actually work, and who report what they find to the people who have to act on it. ISACA says it is designed for IT and IS auditors and for control, assurance and information security professionals. This guide is about those people, the events that turn IT audit from a nice-to-have into a legal duty, and what the CISA takes to earn and to keep.
The exam facts here come from ISACA's Certification Exams Candidate Guide, version 1.26, which carries the CISA Exam Content Outline effective August 2024, and from ISACA's CISA, Get CISA Certified and CPE 2027 pages, read on 20 October 2026. Labor figures come from O*NET OnLine, which publishes US Bureau of Labor Statistics data. Where this page and ISACA differ, ISACA's current documents win.
What does a CISA actually do?
ISACA's CISA page describes the credential as the standard of achievement "for auditing, monitoring, and assessing IT and business systems," and says it shows the ability to apply a risk-based approach to audit engagements. The exam content outline turns that into five domains, and ISACA publishes the share of the exam each one carries:
| Domain | Share | Subdomains |
|---|---|---|
| 1. Information System Auditing Process | 18% | Planning; Execution |
| 2. Governance and Management of IT | 18% | IT Governance; IT Management |
| 3. Information Systems Acquisition, Development, and Implementation | 12% | Acquisition and Development; Implementation |
| 4. Information Systems Operations and Business Resilience | 26% | Information Systems Operations; Business Resilience |
| 5. Protection of Information Assets | 26% | Information Asset Security and Control; Security Event Management |
Only the first domain is about audit as a method: planning an engagement, gathering evidence, sampling, reporting. The other four are the things an IT auditor audits. More than half the exam, domains 4 and 5 together, is operations, resilience and security. The weights say what the exam thinks the job is: mostly how systems are run and protected, then whether the evidence supports a conclusion about them.
Two features of the role run through every domain. The first is independence. An auditor reports and recommends; management decides and fixes. An audit function that designs the control it later tests has lost the thing that makes its opinion worth having. The second is evidence. A conclusion rests on what was verified, not on what was said in a meeting. The CISA exam page goes through each domain's tasks in detail.
Independence has a practical shape. Organizational independence is about the reporting line: an audit function that reports to the person whose systems it audits cannot report freely. The audit charter is the document that grants the function its authority to reach systems, records and people, and everything an auditor is allowed to do traces back to it. That is why the charter is one of the first things the exam asks about, and one of the first things a new audit lead should read.
Who sits the CISA?
ISACA's own description is the starting point: IT and IS auditors, and control, assurance and information security professionals. ISACA says more than 151,000 professionals hold the CISA. Read against the five domains, the people who sit it fall into a handful of jobs:
| Role | What the job involves | Domains that carry the day job | Pairs it with |
|---|---|---|---|
| Internal IT auditor | Risk-based audit plans, fieldwork, reports to the audit committee | 1, then 4 and 5 | The IIA's CIA, for the wider internal audit profession |
| External IT auditor | Testing IT general controls for a financial statement audit, or controls for a SOC report | 1, 4 and 5 | A public accounting qualification |
| Control or assurance specialist | Testing controls for compliance, second line reviews, control self-assessment support | 1 and 2 | CRISC |
| Information security professional | Running or reviewing security controls that auditors test | 5, then 4 | CISSP or CISM |
| IT manager or control owner | Owning the systems and processes under audit | 2, 3 and 4 | CISM or CGEIT |
| Consultant or adviser | Pre-audit readiness reviews, remediation, systems implementation reviews | 1 and 3 | CRISC or a project credential |
ISACA also says the exam is open to anyone with an interest, and that you can sit it before you meet the experience requirement. That opens the CISA to two more groups: people early in an audit or security career who want the structure, and people moving across from operations, development or accounting who want to prove they can look at systems the way an auditor does.
The pairings are our suggestion, not ISACA's. They follow one rule: pair the CISA with the credential for the profession you report into, whether that is internal audit, accounting, risk or security.
What the job looks like in numbers
No US occupation code covers IT audit alone. The two closest are Accountants and Auditors, which includes internal auditors, and Information Security Analysts. O*NET gives these figures from Bureau of Labor Statistics data:
| Measure | Accountants and Auditors (13-2011) | Information Security Analysts (15-1212) |
|---|---|---|
| Employment | 1,595,200 (2025) | 192,900 |
| Median annual wage, 2025 | $83,680 | $129,180 |
| Projected growth, 2025 to 2035 | Faster than average (5% to 6%) | Much faster than average (7% or higher) |
| Projected job openings, 2025 to 2035 | 115,300 | 14,100 |
| Sample job titles include | Auditor, Internal Auditor, Financial Auditor, Audit Partner | Information Security Officer, Information Systems Security Analyst, IT Security Analyst |
Neither occupation is IT audit, and the first is dominated by accountants. The table brackets the job rather than measuring it: IT auditors sit between the audit profession and the security profession, and draw on both. ISACA publishes its own salary figure for CISA holders on its CISA page, but it does not say how it was measured, so we have not repeated it.
When does the CISA become essential?
For many auditors the CISA is a career choice. For some organizations, IT audit is a legal duty, and that is when the people who do it are expected to prove they can.
A company lists its shares in the US
Section 404 of the Sarbanes-Oxley Act of 2002 requires each annual report to contain an internal control report: a statement of management's responsibility for internal control over financial reporting, and an assessment of how effective it is. The registered public accounting firm that audits the company then attests to and reports on that assessment. Financial reporting runs on systems, so the controls over those systems, such as who has access and how changes are made, come into scope for both.
A financial entity in the EU falls under DORA
The Digital Operational Resilience Act, Regulation (EU) 2022/2554, has applied since 17 January 2025. Article 6(6) says the ICT risk management framework of financial entities, other than microenterprises, "shall be subject to internal audit by auditors on a regular basis in line with the financial entities' audit plan," and that those auditors "shall possess sufficient knowledge, skills and expertise in ICT risk, as well as appropriate independence." Article 5(2)(f) makes the management body approve and periodically review the ICT internal audit plans. DORA names no credential. It does require the kind of knowledge and independence the CISA examines, and a recognized credential is one plain way for an auditor to show both.
A customer asks for a SOC 2 report
A service organization's customers can ask for independent assurance over its controls. A SOC 2 Type 2 report, one of the AICPA's System and Organization Controls services, details the provider's security controls and tests their operating effectiveness over a period of time. Somebody has to prepare the organization for that examination, and the CPA firm that performs it needs people who can test IT controls.
A big system goes in, or a big system goes down
Domain 3 is about acquisition, development and implementation, which is where audit can add value before the money is spent: reviewing the business case, the project controls and the readiness to go live. Domain 4 covers operations and business resilience. After a serious outage, the board will want to know whether the recovery plans were tested and whether they worked, and that is an audit question.
You move from running systems to checking them
A move from operations or security into an assurance role changes the question you answer every day, from "does it work?" to "can we prove it works?" ISACA counts information systems control and security work toward the five years, so experience in the job you are leaving can still count. The CISA is the structured way across, because it teaches the audit method that the old job did not.
What each trigger makes you produce
Here is the same ground turned into the work it creates. For each trigger, the second column is what the auditor has to produce, and the third is where the CISA teaches it.
| Trigger | What the auditor has to produce | CISA domain | Rule behind it |
|---|---|---|---|
| The annual audit plan | A risk-based plan, an engagement program, and an audit charter that grants the authority | 1. Auditing process (Planning) | The audit function's charter; ISACA's IS Audit and Assurance Standards |
| SOX 404 year end | Tests of IT general controls over financial reporting systems, with evidence for each | 1 (Execution), 4 and 5 | Sarbanes-Oxley Act, Section 404(a) and (b) |
| DORA internal audit | A regular audit of the ICT risk management framework, by auditors with ICT risk expertise and independence | 2 (Governance), 4 and 5 | DORA Article 6(6); Article 5(2)(f) for the audit plan |
| A customer asks for assurance | Readiness review, then controls tested over a period for a SOC 2 Type 2 report | 5 (Asset security and control) | AICPA SOC services; the contract |
| A new system | Pre-implementation and post-implementation reviews of project and application controls | 3 (Acquisition, development, implementation) | The organization's own governance; SOX 404 if it touches financial reporting |
| A major outage | A review of business continuity and disaster recovery plans and their test results | 4 (Business resilience) | DORA's response and recovery duties for EU financial entities |
| A security incident | A review of event monitoring, incident response and evidence handling, with a chain of custody | 5 (Security event management) | Sector rules and contracts |
We have turned the CISA's own rules, from booking to renewal, into a planner you can copy or download below.
CISA eligibility and upkeep planner
CISA eligibility and upkeep planner
Use this to plan the CISA from exam booking to renewal. Every rule below is ISACA's, from its Exam Candidate Guide version 1.26 and its CISA, Get CISA Certified and CPE pages, read on 20 October 2026. Check your MyISACA account before you rely on any date.
Booking the exam
- Date you register and pay: ____________ (you then have six months to sit the exam)
- Six months from registration: ____________ (an extension of six months costs US$75)
- Appointment booked: ____________ (appointments open only 90 days ahead; book from 48 hours after paying)
- Test center or remote proctoring chosen (remote proctors chat in English only)
If you need a retake
- Attempt 2 no sooner than 30 days after attempt 1: ____________
- Attempt 3 no sooner than 90 days after attempt 2: ____________
- Attempt 4 no sooner than 90 days after attempt 3, and within 12 months of attempt 1: ____________
Your experience
- Five years of professional information systems auditing, control or security work, as described in
the CISA job practice areas
- All of it within the 10 years before the date you apply
- Any waiver you will claim (ISACA allows up to three years of waivers; check its current waiver list):
____________
- A supervisor or manager who will verify each role: ____________
After you pass
- Date you passed: ____________ (you have five years from this date to apply)
- US$50 application processing fee paid after your official score is released
- Application submitted with your verified experience
- Agreement to ISACA's Code of Professional Ethics and its Information Systems Auditing Standards
Keeping it
- At least 20 CPE hours every year: ____________
- At least 120 CPE hours across each three-year cycle: ____________
- From 1 January 2027: at least 90 of the 120 aligned to the CISA exam content outline, and no more
than 30 from other professional development
- Annual maintenance fee paid, at the member or non-member rate
Where does the credential apply?
The CISA is global. ISACA runs the exam at PSI test centers and by online remote proctoring, and offers it in English, Spanish, Simplified Chinese, French, German, Korean and Japanese. Remote proctors communicate in English only. The rules an IT auditor works under are not global, and these are the ones the CISA most often meets:
| Instrument | From | What it asks of IT audit |
|---|---|---|
| IS Audit and Assurance Standards | ISACA | CISA holders agree to comply with ISACA's Information Systems Auditing Standards |
| Global Internal Audit Standards | The Institute of Internal Auditors | The professional standards for internal audit functions, including how engagements are planned and performed |
| Sarbanes-Oxley Act, Section 404 | United States | Management's internal control report, and the external auditor's attestation on it |
| DORA, Regulation (EU) 2022/2554 | European Union | Regular internal audit of the ICT risk management framework by expert, independent auditors |
| SOC suite, including SOC 2 | AICPA | Independent reports on a service organization's controls |
The CISA exam does not test any one country's law. It tests the audit method and the controls, which is why it travels. Your jurisdiction's rules decide what you audit and how often, and those you learn on the job.
What the CISA is not
It is not a license to sign audit opinions. The CISA is a professional certification from ISACA. In many jurisdictions, signing a statutory financial statement audit opinion is reserved for licensed or registered accountants, which is a separate qualification route.
It is not only for auditors. ISACA's description includes control, assurance and information security professionals, and the experience requirement counts security work as well as audit work.
It is not a percentage. The pass mark is 450 on a scale of 200 to 800. ISACA publishes no percentage pass mark, and the domain results it reports are for information only. Your score comes from the total number of scored items answered correctly.
It is not finished when you pass. Passing the exam is the first of five steps. You still apply, prove five years of experience, agree to the code of ethics and the auditing standards, and keep up your CPE hours every year.
From exam to certification: ISACA's rules
| Step | ISACA's rule |
|---|---|
| Register | Continuous registration; US$575 for members, US$760 for non-members; six months to sit the exam, extendable once by six months for US$75 |
| Schedule | From 48 hours after paying; appointments open 90 days ahead; reschedule without penalty up to 48 hours before |
| Sit the exam | 150 multiple-choice questions in 4 hours, at a PSI test center or remotely proctored |
| Results | Preliminary pass status on screen at the end; the official score by email and online within 10 working days; no question-level results |
| Retakes | Four attempts in a rolling 12 months; wait 30 days, then 90, then 90; full fee each time; a rescore request costs US$75 within 30 days of results |
| Apply | Within five years of passing; US$50 application processing fee |
| Experience | Five years of IS auditing, control or security work within the 10 years before applying; waivers for up to three years; verified by a supervisor or manager |
| Keep it | At least 20 CPE hours a year and 120 per three-year cycle; from 1 January 2027, at least 90 of the 120 aligned to the exam content outline and at most 30 from other development |
The experience rule catches people out. You can sit the exam early, before you have five years. But the clock to apply starts the day you pass, and the experience must sit inside the 10 years before your application. If you are early in your career, check that the two windows will meet before you book. The CISA study plan covers the preparation side.
How does it compare with ISACA's other credentials?
| CISA | CISM | CRISC | |
|---|---|---|---|
| ISACA says it is designed for | IT/IS auditors and control, assurance and information security professionals | Those who manage, design, oversee and assess an enterprise's information security function | Those experienced in IT risk management and the design, implementation, monitoring and maintenance of IS controls |
| Experience | 5 years in IS/IT audit, control, assurance or security; waivers up to 3 years | 5 years in information security management; waivers up to 2 years | 3 years in IT risk management and IS control; no waivers |
| Largest domains | Operations and resilience; protection of information assets (26% each) | Information security program (33%) | Risk response and reporting (32%) |
| Exam | 150 multiple-choice questions, 4 hours, 450 on a 200 to 800 scale | ||
The three share a format, and they differ in the job they describe. The CISA looks at systems from outside, as the person who tests and reports. The CISM looks from inside the security function, as the person who runs it. The CRISC sits on the risk side, as the person who identifies IT risk and makes sure the controls answer it. Our CISA or CISM comparison goes deeper on the first pair, and the CISM exam and CRISC exam pages have the full outlines.
What will the exam expect of you?
The CISA has 150 multiple-choice questions in four hours, which is 1 minute 36 seconds a question on average. Each has one best answer. Some items are pretest items that do not count, and ISACA does not say how many or which. You see your preliminary result on screen at the end.
Your score depends on the total number of scored items you answer correctly, regardless of domain. ISACA reports domain-level results, but only for information. In practice that means a weak domain does not fail you on its own, and a strong one does not carry you. The weights still decide where most of the marks are, which is why domains 4 and 5 deserve more than half your time. If you fail, you can ask for a rescore within 30 days of the results for US$75.
The exam is written from the auditor's chair, and many wrong answers are things a capable engineer or manager would do. Stems often carry a qualifier in capital letters, MOST, BEST, FIRST or GREATEST, and several options will be true; only one answers the qualifier. One trap is the option where audit fixes the problem: an auditor who designs or repairs a control has given up independence, so the right answer usually reports, recommends or verifies instead. Another is the technically excellent option that ignores the business, when governance questions want the answer that aligns IT with business requirements. If a question asks how to report IT risk to a board, look for the high-level, aggregated answer, not the detailed one.
Test yourself with the CISA quiz, see the whole outline on the CISA mind map, and if the credential is part of a job move, the CISA interview questions page covers what employers ask.
How to prepare
ISACA publishes its own CISA Review Manual, an online review course, and a members-only study community, and offers 10 free practice questions on its CISA page. Whatever you use, start from the exam content outline in the Candidate Guide, which is free, and size your time to the domain weights rather than to the subjects you already know.
ISACA does not publish a recommended number of study hours for the CISA. If you set yourself 100 hours, the weights split them into 18 hours each for the auditing process and for governance and management of IT, 12 for acquisition, development and implementation, and 26 each for operations and resilience and for protection of information assets. Then move hours toward the domains your job does not touch. An auditor from a financial background will need more time on domains 4 and 5; a security engineer will need more on domains 1 and 2.
The CISA Exam Guide (Wikidata) has 12 chapters across 381 pages. Every chapter maps to a published domain, and each domain gets the pages its weight earns: domains 4 and 5, at 26% each, have three chapters apiece. It prints each domain's share at the head of the domain, names every source at the back with the date it was read, and was written from ISACA's Candidate Guide version 1.26. It does not quote ISACA's Review Manual, its question database or any real exam item.
The CISA Practice Questions (Wikidata) has 200 questions weighted to the published domain shares, so your score by domain means something. The rationales are the point of the book: each explains why the best answer is best and why the others are not, and the answer letters are spread on purpose so that pattern-guessing does not help.
Is it current? Both books follow the CISA Exam Content Outline effective August 2024, as published in Candidate Guide version 1.26. ISACA revises outlines from time to time, so check its site for a newer one before you book. The CPE changes from 1 January 2027 affect how you keep the credential, not what the exam covers.
If you already hold the CISA, the change to plan for is the CPE policy from 1 January 2027. The total stays at 120 hours over three years, but at least 90 must be aligned to the exam content outline or domains, and at most 30 can come from other professional development such as leadership, soft skills, volunteering or mentoring. ISACA says holders of several ISACA certifications do not need a separate set of hours for each.
So, do you need the CISA?
Take it if IT audit is your job, or the job you want, whether in an internal audit function, an external audit firm or an assurance team. ISACA calls it the standard of achievement for auditing IT and business systems, and under DORA an EU financial entity's ICT auditors must have the expertise and independence the exam tests. Take it too if you are a security or control professional whose work is audited constantly: learning how auditors think helps you prepare for every audit you face.
Look elsewhere first if the job is running security rather than auditing it, where the CISM fits better, or if your work is mainly IT risk, where the CRISC does. And if you are very early in your career, think about timing: the exam can wait until your five years of experience will fall inside the 10-year window when you apply.
Questions people ask about the CISA
Who is the CISA certification for?
ISACA says the CISA is designed for IT and IS auditors and for control, assurance and information security professionals. In practice that means internal and external IT auditors, people who test or report on controls, and security staff whose work is audited or who audit others.
Can I take the CISA exam without five years of experience?
Yes. ISACA says the exam is open to anyone with an interest, and you can sit it before you meet the experience requirement. You then have five years from passing to apply for certification, and the experience must fall within the 10 years before your application.
What experience counts for the CISA?
Five or more years of professional information systems auditing, control or security work, as described in the CISA job practice areas, verified by a supervisor or manager. ISACA allows experience waivers for up to three of the five years.
What is the CISA passing score?
450 on ISACA's scale of 200 to 800. ISACA publishes no percentage pass mark and no raw-score pass mark. Scores are based on the total number of scored items answered correctly, not on any one domain.
How long is the CISA exam?
Four hours for 150 multiple-choice questions, at a PSI test center or by remote proctoring. Some items are unscored pretest items, and ISACA does not say how many.
How much does the CISA cost?
ISACA lists the exam at US$575 for members and US$760 for non-members, plus a one-time US$50 application processing fee after you pass. Keeping it needs an annual maintenance fee and CPE hours.
How many times can I retake the CISA?
Four attempts within a rolling 12 months. After a first failed attempt you wait 30 days, then 90 days before each of the third and fourth attempts, and you pay the full registration fee each time.
How do I keep the CISA?
Earn at least 20 CPE hours a year and 120 over each three-year cycle, pay the annual maintenance fee, and follow ISACA's Code of Professional Ethics and its Information Systems Auditing Standards. From 1 January 2027, at least 90 of the 120 hours must be aligned to the exam content outline.
CISA or CISM: which comes first?
It depends on the job. The CISA is about auditing systems and controls; the CISM is about managing an information security program. People who audit take the CISA; people who run security take the CISM. Some hold both.
Is the CISA current in 2026?
The exam follows the CISA Exam Content Outline effective August 2024, published in ISACA's Candidate Guide. Check ISACA's site for a newer outline before you book.
CISA: test yourself in five minutes
Which books prepare you for the CISA exam?
Certified Information Systems Auditor. 12 chapters, 381 pages.
Practice questions with full rationales, sized to the published domain weights. 214 pages.
How to credit this page
Using a figure or a passage from this page in an article, a course, a forum answer or AI-generated text? Please credit Credential Press and link to this page, so your readers can check the source and the date it was reviewed. Copy a ready-made citation:
Plain text
Markdown
HTML
Sources
- ISACA, Certification Exams Candidate Guide, version 1.26, with the CISA Exam Content Outline effective August 2024
- ISACA, CISA Certification: exam fees, registration, holder count
- ISACA, Get CISA Certified: experience, application and CPE requirements
- ISACA, CPE Policy Changes for 2027
- O*NET OnLine, 13-2011.00 Accountants and Auditors (BLS data)
- O*NET OnLine, 15-1212.00 Information Security Analysts (BLS data)
- Sarbanes-Oxley Act of 2002, Public Law 107-204, Section 404
- Regulation (EU) 2022/2554 (DORA), OJ L 333, 27 December 2022, Articles 5, 6 and 64
- The IIA, Global Internal Audit Standards
- AICPA and CIMA, System and Organization Controls: SOC Suite of Services
Credential Press is not affiliated with, endorsed by or authorized by ISACA, the IIA or the AICPA. CISA, CISM, CRISC and CGEIT are trademarks of ISACA.