CISA (Certified Information Systems Auditor)
Demonstrate world-class mastery in information systems auditing, IT governance and management, systems acquisition and implementation, operations and business resilience, and protection of enterprise information assets.
Official Exam Specification & Quick Facts
Question Difficulty Breakdown
Exam Guidelines & Simulation Rules
Frequently Asked Questions (FAQ)
CISA is the globally accepted standard of achievement for professionals who audit, control, monitor, and assess an organization's information technology and business systems, administered by ISACA.
The CISA exam consists of 150 multiple-choice questions to be completed within 4 hours (240 minutes) administered online or at PSI testing centers.
The passing score is 450 on a scaled score range of 200 to 800 (approximately 75%).
Domains include: (1) Information System Auditing Process (21%), (2) Governance and Management of IT (17%), (3) Information Systems Acquisition, Development and Implementation (12%), (4) Information Systems Operations and Business Resilience (23%), and (5) Protection of Information Assets (27%).
An IS auditor provides independent, objective assurance that IT systems, security controls, and processes align with business goals, safeguard assets, maintain data integrity, and comply with laws.
Audit Risk is the risk that information may contain a material error that goes undetected. It comprises Inherent Risk (susceptibility to error), Control Risk (controls failing to prevent error), and Detection Risk (auditor failing to detect error).
Compliance testing verifies whether internal controls are functioning as designed. Substantive testing inspects the actual data, transactions, and balances to detect material misstatements.
Independence requires auditors to be free from organizational or personal bias, having no operational responsibility for the systems they audit to ensure impartial evaluations.
Auditors use Statistical Sampling (mathematically sound sample sizes evaluating error rates) and Non-Statistical (judgmental) Sampling to assess populations without reviewing 100% of transactions.
Auditors review Business Impact Analyses (BIA), verify recovery time/point objectives (RTO/RPO), inspect offsite backup configurations, and evaluate the documentation and results of regular DR testing.
Candidates must possess a minimum of 5 years of professional work experience in information systems auditing, control, or security (substitutions available for university degrees).
IT auditors, internal/external auditors, compliance officers, risk managers, security consultants, and IT governance specialists.