CISA Exam Guide: Format, Domains, and How to Pass
A complete CISA exam guide — the fixed-form format, all 5 job practice domains and their weights, the 450/800 passing score, experience requirements, and how to prepare.
The CISA (Certified Information Systems Auditor) is ISACA’s credential for professionals who audit, control, and assess information systems. It is the recognized standard for IS audit work and is widely required for audit, assurance, and IT governance roles.
This guide covers what the exam is, how it is scored, what it tests, and how to prepare for it. ISACA updates the exam content and policies periodically, so confirm the current details on the official ISACA site before you book.
The CISA exam format: fixed-form, not adaptive
Unlike the CISSP CAT, the CISA exam is a fixed-form, linear test. Every candidate answers the same number of questions, and the exam does not change difficulty based on your performance. There are 150 multiple-choice questions, and you have a four-hour window to complete them.
Because the form is fixed, you can move freely through the exam — review your answers, flag questions, and come back to them. This rewards a deliberate strategy: answer what you know first, mark the rest, and use your remaining time on the harder items.
Fixed-form means you control the clock
With 150 questions in four hours you have roughly 90 seconds per question. Do not burn five minutes on a single scenario — flag it, keep moving, and return once you have banked the easy points.
The 5 CISA domains
The CISA job practice is organized into 5 domains, each carrying a different weight on the exam. Allocate your study time to match those weights rather than studying everything evenly.
- Information Systems Auditing Process — planning and executing audits, evidence, and reporting; the foundation of the credential.
- Governance and Management of IT — IT strategy, policies, organizational structure, and how IT aligns with the business.
- Information Systems Acquisition, Development and Implementation — project management, development practices, and controls over new systems.
- Information Systems Operations and Business Resilience — operations management, continuity, backup, and disaster recovery.
- Protection of Information Assets — security controls, access management, and physical and logical safeguards.
What the questions are really like
CISA questions are written from the auditor’s chair. They rarely ask you to recall a fact in isolation; instead they describe a situation and ask what an auditor should do, conclude, or recommend. The expected answer reflects independence, objectivity, and evidence — not the answer an engineer or administrator would give.
A common trap is choosing the technically "correct" fix when the question is really asking what an auditor reports or verifies. Train yourself to ask: what would best support an objective, evidence-based opinion? That mindset separates passing candidates from those who know the material but answer like a practitioner instead of an auditor.
Scoring and the passing standard
CISA is reported on a scaled score that ranges from 200 to 800, and the passing standard is 450. The scaled score is not a raw percentage — ISACA converts your performance to the common scale so results are comparable across exam forms.
The practical takeaway: do not chase a percentage on practice tests. Build consistent competence across all 5 domains, because a single weak domain can drag a scaled score below the line even when your overall accuracy looks healthy.
Experience requirements and certification
Passing the exam is one part of becoming certified. CISA requires a minimum of five years of professional experience in information systems auditing, control, assurance, or security. ISACA allows substitutions and waivers — for example, certain degrees or related experience can offset part of the requirement, typically up to a defined maximum.
You can sit and pass the exam before you have the full experience; you then have a window to apply for certification once you meet the requirement. Confirm the current waiver rules and application window on the ISACA site, as they are periodically adjusted.
A study plan that tells you when you are ready
CISA rewards steady, structured study over cramming. The candidates who pass practice questions in the auditor mindset, review what they miss on a schedule, and measure readiness rather than hours. A plan that works looks like this:
- Start with a diagnostic to find your weakest of the 5 domains on day one.
- Study 20–40 focused minutes daily — weakest domain first, due reviews always.
- Use spaced repetition so missed concepts return at the right interval.
- Drill scenario questions and explain why the auditor answer beats the technician answer.
- Book your real exam when your readiness score clears the passing zone and a full practice exam confirms it.
Know your number
CramKit gives you a readiness score that blends accuracy, domain coverage, and consistency, so you can book the exam when the data says you are ready — not when you have simply run out of time to study.
Frequently asked questions
How many questions is the CISA exam?+
The CISA exam has 150 multiple-choice questions delivered in a fixed-form (non-adaptive) format, with a four-hour time limit. Confirm the current question count and timing on the official ISACA site.
What is the CISA passing score?+
CISA is reported on a scaled score from 200 to 800, and you need 450 to pass. The scaled score is not a raw percentage correct — ISACA converts your performance onto a common scale.
Is the CISA exam adaptive like the CISSP?+
No. CISA is a fixed-form, linear exam — every candidate gets the same number of questions and you can move back and forth to review and change answers, unlike the adaptive CISSP CAT.
How much experience do I need for CISA?+
CISA requires five years of professional experience in IS audit, control, assurance, or security. ISACA allows substitutions and waivers (such as relevant degrees) up to a defined maximum, and you can pass the exam before completing the full requirement.
Find out if you're actually ready.
Take a real adaptive exam and get a readiness score that means something — free.
Start free