ISACA Certified Information Systems Auditor (CISA) Practice Test

Candidates must submit verified evidence of a minimum of five years of professional work experience in information systems auditing, control, assurance, or security. Substitutions and waivers are available for up to three years: a maximum of one year can be waived for one year of non-IS auditing experience or one year of information systems/one year of university instructor experience. Additionally, a two-year substitution is granted for a master's degree in information security or information technology from an accredited university. All experience must be verified and gained within the 10-year period preceding the application date or within five years of passing the exam.

The CISA exam is a computer-based test comprising 150 multiple-choice questions, which must be completed within a 4-hour testing window. The questions are based on the five CISA job practice domains, with a weighted distribution. ISACA uses a scaled scoring model, where a score of 450 or higher on a scale of 200-800 represents a passing mark. This scaled score is a conversion of the raw score (number of questions answered correctly) to a standardized scale that accounts for slight variations in difficulty across different exam forms. The exact number of correct answers needed can therefore vary slightly.

CISA is specifically focused on the audit, control, and assurance of information systems. It is the premier credential for IT auditors. CISSP (Certified Information Systems Security Professional) has a broader focus on designing, implementing, and managing a cybersecurity program. The CIA (Certified Internal Auditor) covers general internal audit principles across all business areas (finance, operations, IT), with IT being one component. While there is overlap, CISA provides deep, specialized expertise in IT audit processes, making it the definitive choice for professionals in that specific career path.

To maintain your CISA certification, you must earn and report a minimum of 20 Continuing Professional Education (CPE) hours annually, and 120 CPE hours over a fixed three-year reporting period. These hours must be relevant to the CISA job practice areas or directly related to the profession. Activities include attending training courses, webinars, conferences, publishing relevant articles, teaching, and self-study. Compliance with the CPE policy and ISACA's Code of Professional Ethics is mandatory to keep the certification in good standing.

ISACA strongly recommends using its official preparation materials, which are aligned directly with the exam content. The core resources include: 1) The CISA Review Manual, which provides comprehensive coverage of the domains; 2) The CISA Question, Answer, and Explanation (QAE) Database, which offers an extensive bank of practice questions with detailed explanations; and 3) The CISA Review Course, available online or in-person. Many candidates also supplement with study guides from reputable publishers and participate in study groups or online forums dedicated to CISA preparation.