How to Pass the CISA Exam: A Complete Study Guide
The Certified Information Systems Auditor (CISA) credential is the gold standard for IT audit, control, and assurance — and it's the cert that opens the door to senior audit, GRC, and risk-advisory roles that pay better than most technical security positions. Global pass rate sits around the mid-60s, which sounds friendly until you discover that the candidates who fail are rarely the ones who didn't read the material. They're the ones who underestimated how different ISACA's question style is from the multiple-choice exams they've passed before. This guide walks you through what's actually on the CISA, the concepts that win the most marks per study hour, a twelve-week plan that fits around a full-time audit job, and the exam-day tactics that decode ISACA's signature "BEST" and "PRIMARY" phrasing.
Exam quick facts
The CISA is a single 150-question, four-hour exam delivered at PSI test centres or via remote proctoring. The scoring is scaled — you're not graded on the raw number you get right, you're graded on a 200-800 scale where 450 is the pass mark. That maps to roughly 65-70 percent raw, but ISACA never publishes the exact conversion. The cost is USD 575 for ISACA members and USD 760 for non-members; joining ISACA before booking almost always pays for itself. To hold the full credential after you pass, you need five years of professional IS audit, control or security experience, with waivers available for up to three years based on relevant degrees and other ISACA certifications. There is no penalty for guessing.
What's actually on the exam
ISACA's current blueprint splits the exam into five domains with deliberately uneven weighting. Domain 1, Information Systems Auditing Process, is 18 percent. Domain 2, Governance and Management of IT, is also 18 percent. Domain 3, Information Systems Acquisition, Development and Implementation, is 12 percent. Domain 4, Information Systems Operations and Business Resilience, is 26 percent. Domain 5, Protection of Information Assets, is 26 percent. The pattern is obvious once you see it: more than half the exam lives in Domains 4 and 5. A candidate who's strong on governance and weak on operations or protection will struggle to find the marks they need elsewhere. Plan your study time accordingly.
The high-leverage concepts to master
CISA rewards depth in a small number of concept clusters that ISACA returns to question after question. Get fluent in these and the rest of the syllabus becomes navigable.
The audit process and the audit risk model
You need to be able to walk an audit from planning to reporting without consulting a checklist: scoping, control identification, walkthroughs, test design, evidence collection, sampling, exception evaluation, and reporting. The audit risk model — inherent risk times control risk times detection risk equals audit risk — appears in some form on roughly one in eight exam questions. Know the components, know what reducing each one costs the auditor, and know which of the three is under the auditor's direct control. ISACA loves to ask which risk component you'd address with more substantive testing rather than additional control testing; the answer is detection risk.
Sampling: attribute, variable, judgmental, statistical
Sampling questions are conceptually small but procedurally specific. Attribute sampling tests yes-or-no control effectiveness; variable sampling tests dollar-value accuracy of an account; statistical sampling lets you project the population error rate from the sample; judgmental sampling does not. Know which one you'd reach for in each scenario, and know that statistical sampling is the only path to a defensible quantitative conclusion about the population.
IT governance frameworks and where they fit
COBIT for governance, ITIL for service management, ISO 27001 for the security management system, NIST and ISO 31000 for risk frameworks. You will not be asked to recite control objectives, but you will be asked which framework a particular governance gap should be addressed by. Be precise on COBIT: it covers governance and management, it ties IT goals to enterprise goals, and it is the framework ISACA references most often in the exam.
SDLC and change management controls
Know the standard waterfall phases, where agile and DevOps deviate from them, and the specific controls that should exist in each phase. Separation of duties between developers and operations, the difference between unit, integration, user acceptance and parallel testing, the concept of post-implementation review, and the controls around emergency changes. ISACA will give you a one-paragraph scenario describing a change that bypassed normal channels and ask which control failed — usually it's the lack of separation of duties or the absence of a post-implementation review.
Business continuity, disaster recovery, RTO and RPO
The single most testable distinction in CISA is Recovery Time Objective versus Recovery Point Objective. RTO is the maximum tolerable outage duration; RPO is the maximum tolerable data loss measured in time. Know that a tighter RPO drives backup frequency, while a tighter RTO drives the recovery strategy choice (hot site, warm site, cold site, mirrored, reciprocal). Know the order of recovery: critical, vital, sensitive, non-critical. Expect at least one BIA scenario and one recovery-strategy scenario.
Access control, encryption, and data classification
Domain 5 is 26 percent of the exam and most of it lives here. Know the four access control models — mandatory, discretionary, role-based, attribute-based — and which scenarios call for each. Know that symmetric encryption is fast and scales poorly; asymmetric is slow and scales well; in practice you use asymmetric to exchange a symmetric key, then encrypt the bulk traffic symmetrically. Know data classification (public, internal, confidential, restricted), data-at-rest versus data-in-transit, and the high-level mechanics of digital signatures and hashing. The depth required is what the policy says, not what the engineer codes.
A twelve-week study plan
Weeks 1 to 2 — Audit process and risk. Read Domain 1 of the official ISACA review manual or an equivalent. Drill audit-process and audit-risk-model questions until the components are reflexive. End week two with a 40-question Domain 1 mock.
Weeks 3 to 4 — Governance and management. Domain 2. COBIT in detail, IT strategy, performance metrics, policies versus standards versus procedures, and the role of the steering committee. Do not skip the management-of-the-IT-function topics — they show up as soft-question scenarios where the answer hinges on a governance distinction.
Week 5 — Acquisition, development and implementation. Domain 3. SDLC variants, change management, project risk, post-implementation review. Smallest domain on the exam so don't over-invest, but the questions that do appear are detail-heavy.
Weeks 6 to 8 — Operations and business resilience. Domain 4. This is 26 percent of the exam and deserves the most time. IT operations, monitoring, problem management, BCP, DRP, BIA, RTO, RPO, recovery strategies, and incident response. End each week with a Domain 4-weighted 60-question mock.
Weeks 9 to 10 — Protection of information assets. Domain 5. Another 26 percent. Access control models, identity and authentication, encryption, network security controls, classification, privacy. Most candidates underestimate the depth of privacy and data lifecycle questions — give them deliberate time.
Weeks 11 to 12 — Full-length mocks and weak-area drilling. Three full 150-question mocks under timed conditions, spaced three to four days apart, with a same-day review of every wrong answer. Your final mock should land within four days of the real exam, and you should be hitting 75 percent or higher consistently before booking.
ISACA's question style decoded
Three patterns appear in nearly every CISA exam, and recognising them on the day is worth ten or more marks.
"BEST" versus "PRIMARY" versus "MOST IMPORTANT". ISACA loves four-answer questions where two answers are correct and one is more correct than the other. "BEST" usually means most effective. "PRIMARY" usually means earliest in the process or most fundamental. "MOST IMPORTANT" usually means highest impact on the audit objective. Reading the qualifier word twice before scoring the answers is the single biggest source of avoidable marks.
Scenario length is not a difficulty signal. CISA questions can run to three paragraphs of scenario before the actual question appears. Read the scenario once for context, then read the question, then read the scenario a second time looking only for facts that bear on the question. Candidates who try to absorb the scenario in a single read miss key details and waste minutes.
The auditor's perspective wins. When two answers both sound defensible, the one that matches what an independent auditor (not the IT operator, not the business owner, not the CISO) would do is almost always correct. CISA tests audit reasoning, not engineering judgement.
Exam-day tactics
First, never leave a question blank — there is no penalty for guessing and a guess at minute 235 is strictly better than a skip. Second, use a two-pass strategy: answer everything you're confident on in the first two hours and flag everything else. The remaining two hours are for the flagged questions and you'll be amazed how often a later question's scenario clarifies an earlier one. Third, set hard time-per-question budgets: at 150 questions in 240 minutes you have about 96 seconds per question on average. Anything over three minutes on a single item and you flag and move on. Fourth, when stuck between two answers in a scenario question, re-read the qualifier word — it's almost always "BEST" or "PRIMARY" and the answer you're stuck on is the one that doesn't match the qualifier.
How IT Exam Certs helps you pass CISA
Reading the review manual is necessary but not sufficient. The only reliable way to lock in 450 on the scaled score is to drill hundreds of ISACA-style questions and review the explanations until ISACA's qualifier patterns stop costing you marks. Our CISA question bank is the largest single-cert bank on the platform — 1,823 questions, sorted into the five official ISACA domains so weak-area drilling is one click. The breakdown maps to the blueprint exactly:
- Information Systems Auditing Process — audit planning, evidence, sampling, the audit risk model
- Governance and Management of IT — COBIT, IT strategy, steering committees, the governance-versus-management distinction
- Information Systems Acquisition, Development and Implementation — SDLC, change management, project risk, post-implementation review
- Information Systems Operations and Business Resilience — the largest single domain; BCP, DRP, RTO/RPO, incident response, recovery strategies
- Protection of Information Assets — access control, encryption, classification, privacy, network security
Full-length timed exam simulations. 150 questions, 240 minutes, the same domain mix as the real paper.
Running three of these in your final two weeks is the closest you can get to the real conditions without paying for a retake. The simulator scores you per domain, so your final revision can target the exact area where you're still leaking marks.
Explanations that teach the concept, not just the answer. Every question is paired with a written explanation that walks through why the correct answer is correct, why each distractor is wrong, and which ISACA concept the question is really testing. You learn the framework while you drill, which is far more efficient than re-reading the review manual after each mistake.
If you're at the start of your prep, go to the CISA cert page, pick the heaviest-weighted domain you're weakest on (Operations or Protection, almost certainly) and drill 20 questions there before doing anything else. You'll know within an afternoon whether your study plan needs to lean harder on operations, protection, or the audit-process fundamentals — and that single decision is worth more than another week of passive reading.
Final word
CISA is a fluency exam, not a memory test. The candidates who fail almost always do so because they tried to brute-force the control objectives, misread the qualifier word under exam-day pressure, or never built the audit-reasoning intuition the exam actually rewards. Spend the twelve weeks on the high-leverage concepts above, drill consistently against the question bank, and treat your last three mocks as the real exam. Do that, and 450 stops being a target and becomes a floor.
Photos from Pexels: cover by RDNE Stock project, data analysis by Lukas Blazek, focused review by Karolina Grabowska / kaboompics, studying with documents by Michael Burrows.