CISA Cram Sheet & Last-Minute Review
Updated 16 November 2026 · Fixed form, 150 questions, 4 hours, pass 450/800 · 5 domains, 2024 outline
CISA questions are written for an IS auditor, so cramming is about two things: the audit process (risk, evidence, sampling, reporting) and recognising which control matters in a scenario. This sheet covers both, weighted to the five domains of the current outline.
The CISA mindset
- You are the auditor: you assess, report and recommend. You do not implement fixes or own the control.
- Evidence and independence decide most answers: what evidence is most reliable, and is the auditor still independent?
- Risk-based audit planning: start with what matters most to the business.
- Preventive controls beat detective, and detective beat corrective, unless the scenario says otherwise.
CISA cram sheet by domain
Ordered by exam weight, so the top of the page is where most of the marks are.
Information Systems Operations and Business Resilience
26% of the exam- Change, configuration, patch and problem management; emergency changes reviewed after the fact
- BIA sets RTO and RPO; recovery strategy follows the BIA
- Backups: full, incremental, differential; test restores, not just backups
- Plan tests: checklist, walkthrough, simulation, parallel, full interruption
- Incident and problem management; service level agreements and monitoring
- Database and job scheduling controls; capacity management
Protection of Information Assets
26% of the exam- Logical access: least privilege, access reviews, segregation of duties, privileged account controls
- Identification and authentication; MFA; single sign-on risks
- Encryption and PKI for confidentiality and integrity; key management
- Network controls: firewalls, segmentation, IDS and IPS, VPNs
- Physical and environmental controls; data classification and disposal
Information Systems Auditing Process
18% of the exam- Audit risk = inherent risk × control risk × detection risk; the auditor controls only detection risk
- Risk-based audit planning; audit charter from those charged with governance
- Evidence reliability: independent and external sources and auditor-obtained evidence rank highest
- Statistical vs judgmental sampling; attribute sampling (compliance tests) vs variable sampling (substantive tests)
- Compliance testing checks that controls operate; substantive testing checks the data itself
- Report findings to the right level; follow up on agreed actions
Governance and Management of IT
18% of the exam- IT strategy aligned to business strategy; IT steering committee vs strategy committee
- Frameworks: COBIT for governance, ITIL for service management, ISO/IEC 27001 for the ISMS
- Policies approved by senior management; roles, segregation of duties
- Outsourcing: accountability stays with the organisation; right to audit in contracts
- IT performance measured with KPIs and balanced scorecards
Information Systems Acquisition, Development and Implementation
12% of the exam- Business case and feasibility first; requirements signed off by users
- SDLC vs agile; the auditor checks controls are built in at each phase
- Testing: unit, integration, system, user acceptance; separate test and production
- Changeover: parallel (safest), phased, pilot, direct (riskiest)
- Post-implementation review against the business case
Formulas and numbers to memorise
| Audit risk | Inherent × control × detection |
|---|---|
| Confidence and sample size | Higher confidence or lower tolerable error means a larger sample |
| RPO / RTO | Maximum data loss / maximum time to restore; both come from the BIA |
| Exam | Fixed form, 150 questions, 4 hours, pass 450 on a 200–800 scale |
Common CISA traps
- Choosing to fix the problem: the auditor reports and recommends
- Accepting management’s statement as sufficient evidence
- Testing a control before understanding the risk it addresses
- Forgetting that outsourcing never transfers accountability
- Confusing compliance tests (does the control work?) with substantive tests (is the data right?)
14-day CISA cram plan
- Days 1–3Diagnostic across all 5 domains; note the two weakest
- Days 4–7Domains 4 and 5 (52% of the exam) plus your weakest; 60 questions a day
- Days 8–10Audit process: risk, evidence, sampling and reporting until they are automatic
- Days 11–12A timed 150-question mock; review every miss and why the best answer is best
- Day 13Miss log and this sheet only
- Day 14Rest
Exam-day tactics
- About 1 minute 36 seconds per question; flag and move on, you can come back.
- Read as an auditor: “What should the IS auditor do FIRST?” is about evidence and risk, not fixes.
- When two answers look right, pick the one that addresses the root cause or the higher risk.
CISA cram FAQ
Can you cram for the CISA exam?
You can sharpen it in the final two weeks if you have studied all five domains once. Cramming the audit process and drilling scenario questions gives the best return.
Which CISA domains should I cram first?
Domains 4 (IS Operations and Business Resilience) and 5 (Protection of Information Assets) carry 26% each, so they deserve the most time, followed by your weakest domain.
What is the CISA passing score?
450 on a scaled range of 200–800. It is a scaled score, not a percentage of correct answers.
Keep going
Turn this sheet into a score
Practise CISA questions by weakest domain and see a readiness score that tells you when to book.
Start free