CISA prep
For IT auditors, assurance and control professionals who want to prove they can plan and run risk-based audits of information systems and report from an independent auditor's point of view.
The real exam
| Questions | 150 multiple choice, 4 options, one BEST answer (includes unscored pretest items) |
|---|---|
| Time | 4 hours (240 minutes), clock keeps running during the break |
| Pass mark | Scaled 450 on a 200 to 800 scale |
| Fee | US$575 ISACA members, US$760 non-members, plus US$50 application fee after passing |
| Delivery | PSI test centre or remote proctored, closed book, no calculator |
| Job practice | 2024 outline, 5 domains, 43 tasks (still current in 2026) |
| Experience | 5 years in IS audit, control, assurance or security (up to 3 years can be waived) |
| Retakes | Up to 4 attempts in a rolling 12 months, waits of 30, 90 and 90 days, full fee each time |
| Results | Preliminary pass or fail on screen, official score by email within 10 working days |
| Maintenance | 120 CPE hours per 3 years, at least 20 per year |
What you get
Mocks follow the real rules: 150 questions in 240 minutes, flag and review.
Syllabus
Audit standards and ethics, risk-based planning, controls, sampling, evidence, data analytics, reporting, follow-up and audit quality.
IT governance and strategy, laws and policies, enterprise architecture, ERM, privacy and data governance, vendors, performance and quality.
Project governance and business cases, development methodologies, application controls, testing, release, migration and post-implementation review.
IT operations, assets, service levels, incidents and problems, change and patching, logs, databases, BIA, backup, BCP and DRP.
Security frameworks, physical and logical access, network and endpoint security, encryption and PKI, cloud, awareness, attacks, testing, incident response and forensics.
Course outline
- Orientation and the auditor mindset · 2 lessons
- The IS audit process · 7 lessons
- IT governance · 4 lessons
- IT management · 3 lessons
- Acquisition, development and implementation · 5 lessons
- IS operations · 6 lessons
- Business resilience · 4 lessons
- Asset security and control · 6 lessons
- Security event management · 5 lessons
Try a question
An IS auditor previously worked as the project manager for a new payroll system that went live eight months ago. The audit manager now wants to assign this auditor to review the payroll system's application controls. Which of the following is the BEST course of action?A. Allow the assignment because the auditor knows the payroll system better than anyone elseB. Allow it if the auditor signs the annual independence declarationC. Assign another auditor, or disclose the impairment and add independent reviewD. Postpone the payroll audit for three yearsShow answer
An IS auditor discovers part way through an engagement that the agreed scope cannot be completed because the auditee has refused access to a key cloud environment. Which of the following is the MOST appropriate action?A. Complete the remaining tests and issue the report without mentioning the cloud environmentB. Report the scope limitation to audit management and the audit committee, and disclose itC. Rely on the auditee's verbal assurance that the cloud environment controls are effectiveD. Reduce the audit objective so that the cloud environment is no longer within the scopeShow answer
Passwell is an independent study tool and is not affiliated with, sponsored by or endorsed by ISACA. CISA and ISACA are trademarks of ISACA. All questions and lessons are original and are not taken from any ISACA exam or review material. Facts checked 2026-11-14.