On this page
Intro
CISA, Certified Information Systems Auditor, is ISACA’s credential for people who audit, control, monitor and assess information technology and business systems. Questions are written from an auditor’s point of view, so the right answer often depends on independence, evidence and risk rather than on a specific product. CertMonk can help organize review alongside your own audit or assurance experience. The credential details come from ISACA’s CISA page.
Passing the exam is one part of certification. ISACA also requires an application showing work experience, adherence to the Code of Professional Ethics, the continuing professional education policy and the Information Systems Auditing Standards, submitted within five years of passing. Read the requirements on ISACA’s page before you schedule.
Exam at a glance
| Detail | CISA |
|---|---|
| Exam code | CISA |
| Questions | 150, as listed in ISACA’s exam content outline |
| Time | See the vendor’s exam page or candidate guide for the current time limit |
| Passing score | Scaled score; see ISACA’s exam candidate guide for the passing score |
| Question types | Computer-based, at a testing center or remotely proctored; ISACA’s pages reviewed do not detail the item formats |
| Price | Check the vendor’s site for current pricing |
| Retirement | Not applicable; ISACA updates the exam content outline periodically |
Sources: ISACA CISA page, exam content outline and candidate guide, reviewed November 7, 2026.
Version update. The pages reviewed do not state a date for the next content outline change. Because ISACA revises outlines from time to time, confirm the weights and domain wording on the current outline before you finalize your plan.
Exam domains and weights
| Domain | Weight | In plain English |
|---|---|---|
| Information Systems Auditing Process | 18% | Plan and carry out audits and report results. |
| Governance and Management of IT | 18% | Assess how IT is directed, organized and controlled. |
| Information Systems Acquisition, Development and Implementation | 12% | Review how systems are bought, built and put into use. |
| Information Systems Operations and Business Resilience | 26% | Review running systems, support, and recovery capability. |
| Protection of Information Assets | 26% | Review the controls that protect information. |
Operations and resilience together with asset protection hold just over half of the outline. Use ISACA’s current content outline as your checklist and confirm the weights there.
What each domain really tests
Information Systems Auditing Process
This domain covers the audit itself: planning, scoping, risk-based approach, evidence gathering, sampling, communication of results and follow-up. Learn the order of an engagement and the reason for each step. Auditor independence and objectivity run through every scenario.
A useful exercise is to take a simple process, such as granting access, and write an audit objective, the evidence you would request and the finding you would report if the evidence were missing. Practice distinguishing a finding, a risk and a recommendation.
Governance and Management of Information Technology
Governance questions ask how IT is aligned with business goals and who is accountable. Study frameworks and structures at a conceptual level: strategy, policies, roles, organizational structure, enterprise architecture, risk management and the management of IT resources and vendors.
When reviewing a scenario, identify what a good control would look like and what evidence would show it exists. An auditor is expected to assess the arrangement, not to run the function.
Information Systems Acquisition, Development and Implementation
This domain follows a system through its life: business case, requirements, acquisition or development, testing, implementation, migration and post-implementation review. Learn the common development approaches and what an auditor looks at in each.
Pay attention to project governance, change control and the controls around data conversion and cutover. For each stage, write one risk and one control. This turns a long list of phases into something you can reason about.
Information Systems Operations and Business Resilience
This is one of the two largest domains. Study how systems run day to day: operations management, service levels, incident and problem handling, change and release management, and the technology environment of hardware, networks and databases.
Business resilience covers backup, recovery and continuity. Learn the difference between planning, testing and executing a recovery, and what evidence shows that a plan can work. Auditors are expected to ask whether recovery targets match business needs.
Protection of Information Assets
The other largest domain covers the controls that protect information: security governance and policy, logical and physical access, network and endpoint protection, encryption, data classification and security event management. Study each control for its purpose, its typical weakness and how you would test it.
When a scenario describes a gap, ask what the exposure is and whether a compensating control exists. Keep separate notes for preventive, detective and corrective controls.
The topics above follow ISACA’s CISA outline; the exercises are our learning approach.
A realistic six-week study plan
This plan assumes some familiarity with IT or audit work. It is a suggested schedule, not a promise about readiness. Add time if audit vocabulary is new.
Week 1: read the outline and set a baseline
Read the whole outline and start a glossary in your own words. Take a short untimed practice set to see which domains need the most time.
Week 2: the audit process and governance
Cover engagement planning, evidence, sampling and reporting, then IT governance and management. Write an audit objective for one simple process.
Week 3: acquisition, development and implementation
Walk a system through its life and note one risk and one control at each stage. Add untimed practice and review every uncertain choice.
Week 4: operations and business resilience
Cover service management, change control, backup and recovery. Leave one session open for catch-up.
Week 5: protection of information assets
Study access control, network protection, encryption and monitoring. Then connect these topics to the earlier domains with a mixed practice set.
Week 6: mixed review under time pressure
Add timed practice and inspect your reasoning. Separate rushed reading from missing knowledge, and spend remaining sessions on recurring gaps.
Make a deliberate readiness decision. Finishing six weeks is an organizational milestone, not proof of readiness.
Common mistakes and how to avoid them
- Answering like an administrator. CISA scenarios usually reward the auditor’s response: assess, gather evidence and report, rather than fix.
- Ignoring independence. Many questions turn on whether the auditor remains objective.
- Memorizing frameworks without context. Practice explaining what each is for and what an auditor would check.
- Neglecting the two largest domains. Operations and asset protection together hold just over half of the outline.
- Skipping the experience requirement. Passing the exam does not complete certification.
- Rushing into timed practice. Build clear reasoning untimed first, then use the clock to check pacing.
How to use practice questions well
After each practice item, explain why the chosen answer fits the auditor’s role and why each alternative falls short. Review wrong-answer explanations for the assumption that led you astray, and add that concept to your next session.
CertMonk includes explanations for every answer choice, randomized practice tests, timed and untimed modes, flip-card flashcards, study games and progress by exam domain. Use the domain view to choose follow-up work, and flashcards for brief review between longer sessions.
Keep a separate list of correct guesses and revisit them later without the answer choices in front of you. When you add timed practice, use the result to investigate your preparation rather than to predict an exam outcome.
Free practice questions
Use the free CISA samples below to explore the explanations and spot areas to review without a purchase.
Which tool is designed to track and analyze logs?
- AAn uninterruptible power supply.
- BA compiler.
- CA hypervisor.
- DA log analyzer.
Show the answer and explanation
Answer: D. A log analyzer.
Correct. A log analyzer is a tool used to track and analyze logs.
Why not the others
- A. A UPS provides backup power.
- B. A compiler translates source code into object code.
- C. A hypervisor runs virtual machines.
Takeaway: Log analyzers track and analyze logs to support monitoring and investigation.
Source: ISACA Glossary
Which of the following does SP 800-53 IR-3 list as a way to test incident response capability?
- AA staff satisfaction survey about the service desk.
- BWalk-through or tabletop exercises.
- CAn annual financial statement audit.
- DA weekly vulnerability scan of the internet-facing servers in the DMZ.
Show the answer and explanation
Answer: B. Walk-through or tabletop exercises.
Correct. IR-3 notes that incident response testing includes checklists, walk-through or tabletop exercises and simulations.
Why not the others
- A. Surveys do not test response capability.
- C. Financial audits do not test incident response capability.
- D. Scans find vulnerabilities; they do not exercise the response capability.
Takeaway: Incident response capability is tested with checklists, tabletop exercises and simulations.
Source: NIST SP 800-53 Rev. 5: Security and Privacy Controls for Information Systems and Organizations
An IS auditor tests the 15 largest wire transfers of the year for dual approval and finds all approved. The auditor then concludes that all 40,000 transfers were approved. What is wrong with this conclusion?
- ATesting chosen items is not sampling, so the result cannot be projected.
- BLarge transfers are routinely approved, so they are the least informative items to test.
- CFifteen items is below the minimum sample size of 25 for any conclusion.
- DWire transfers cannot be tested by selection and need 100 percent examination.
Show the answer and explanation
Answer: A. Testing chosen items is not sampling, so the result cannot be projected.
Correct. Selecting specific items, such as the largest, is not audit sampling; results from them do not support conclusions about the remaining items.
Why not the others
- B. Large items are often good targets; the error is in projecting the result, not in selecting them.
- C. The flaw is not an arbitrary minimum; it is projecting results from items that were not selected by sampling.
- D. Selection approaches are valid for wire transfers; the problem is the conclusion drawn.
Takeaway: Selecting specific items (for example the largest) is not audit sampling; conclusions cannot be projected to the rest of the population.
Source: PCAOB AS 1105: Audit Evidence
The IT leadership team plans a data center consolidation, builds the migration, runs the new environment and tracks its performance, all within direction set by the board. Which term describes these activities?
- AAssurance, because performance is being tracked against targets by the team.
- BGovernance, because they concern the whole enterprise’s technology estate.
- CCompliance, since consolidation must follow the regulator’s outsourcing rules for data centers.
- DManagement.
Show the answer and explanation
Answer: D. Management.
Correct. Management is the planning, building, running and monitoring of activities in alignment with the direction set by the governance body to achieve enterprise objectives.
Why not the others
- A. Tracking one’s own performance is a management activity, not independent assurance.
- B. Governance sets direction and monitors; planning, building, running and monitoring within that direction is management.
- C. Compliance concerns adherence to requirements, not the plan-build-run-monitor cycle.
Takeaway: Management plans, builds, runs and monitors activities within the direction set by the governance body.
Source: ISACA Glossary
A new server fleet is going live with each server configured by hand, and no documented configuration against which later changes can be compared. What should be established before go-live?
- AA full backup of one server, used as a model for the rest.
- BThe vendor’s default settings, left unchanged.
- CA checklist of manual steps that administrators complete from memory.
- DA documented baseline configuration maintained under configuration control.
Show the answer and explanation
Answer: D. A documented baseline configuration maintained under configuration control.
Correct. Organizations develop, document and maintain under configuration control a current baseline configuration of the system, reviewing and updating it when components are installed or upgraded.
Why not the others
- A. A backup is not a documented, controlled configuration standard.
- B. Vendor defaults are often insecure and are not the organization’s approved baseline.
- C. An undocumented, memory-based process does not create a controlled baseline.
Takeaway: Systems need a documented baseline configuration, maintained under configuration control, before and after go-live.
Source: NIST SP 800-53 Rev. 5: Security and Privacy Controls for Information Systems and Organizations
FAQ
What is CISA?
It is ISACA’s Certified Information Systems Auditor credential, for audit, control and assurance professionals. See ISACA’s CISA page.
How many domains are there?
ISACA’s content outline lists five domains. The weights are in the table above and on the outline page.
How many questions are on the exam?
ISACA’s content outline lists 150 questions. Check the candidate guide for the current time limit and format details.
Does passing the exam make me certified?
Not by itself. ISACA also requires an application showing work experience, adherence to its ethics code, continuing education and auditing standards, within five years of passing.
Do I need to be a technical expert?
You need a solid understanding of IT concepts, but questions are written from an auditor’s perspective: risk, controls, evidence and reporting.
How long should I study?
Use six weeks as a starting framework if you already work in audit or IT assurance. Add time where your notes show gaps.
Next step
Try free practice questions → https://app.certmonk.app/samples
