Dec 16, 2025
CISA exam: structure and audit-focused preparation
Practise evidence, controls and the auditor's decision
How you'll prepare for CISA with Qualifico
You practise from the start rather than after the reading. Every answer is scored against the subtopic it came from, so your dashboard shows where the marks are actually going long before a mock does.
We take a data-driven approach to CISA and keep expanding the material behind it for this exam.
View CISA Plans
About the CISA exam
The Certified Information Systems Auditor exam is ISACA's test of information systems audit, control and assurance. It assumes you understand the technology, then asks what an auditor should do with it: plan the work, judge the evidence and reach a conclusion that would stand up to challenge.
If you are choosing between audit and IT risk, read CISA vs CRISC.
Exam at a glance
ISACA's 2026 candidate guide describes 150 multiple-choice questions in four hours, about 96 seconds each. Every question has four options and one best answer, and some scenarios support more than one question. You can sit at a test centre or with remote proctoring. Results are scaled scores, not percentages, so a practice percentage does not translate into a pass mark.
What does the CISA exam test?
ISACA's exam content outline has five domains:
Information system auditing process (18%): planning and running audits, evidence, sampling and reporting.
Governance and management of IT (18%): direction, accountability and oversight of technology.
Information systems acquisition, development and implementation (12%): controls over projects, testing and moving systems into production.
Information systems operations and business resilience (26%): day-to-day service, incident handling, backup, continuity and recovery.
Protection of information assets (26%): access, security controls and monitoring.
The last two domains make up just over half the exam, but they are examined through the auditor's eyes set out in the first.
What makes the CISA exam challenging?
Technical knowledge is necessary and not sufficient. A control can be well designed and never operate; a policy can exist and be ignored. Keep design, implementation and operation separate, and ask what evidence would show each one.
Read the qualifier. "What should the auditor do FIRST?", "What is the BEST evidence?" and "What is the MOST significant concern?" can sit on the same scenario and have different answers. Remember too that the auditor evaluates and recommends; management fixes. Options in which the auditor implements a control are usually weaker for that reason.
A worked example: emergency changes
A company allows emergency changes to production systems outside the normal change process, provided they are approved retrospectively within two working days. The auditor is told the arrangement works well.
An audit approach starts with the population: every emergency change in the period, taken from system logs rather than from the change team's own list. For a sample, the auditor checks that each one was genuinely an emergency, was approved within two days and was tested or reviewed after the event. Changes that appear in the logs but not in the change records matter most, because they bypassed the control entirely.
Compare that with "review the emergency change policy". The policy tells you how the control is designed. Only the logs and records tell you whether it operated. When options look similar, ask which of those two questions each one answers.
View CISA Plans
How to prepare for the CISA exam
Organise each topic as a chain: audit objective, risk, control, evidence and conclusion. If one link is weak, that is your next study task. Start with a short diagnostic across all five domains, because your background shapes your gaps: an audit career can leave systems development and resilience thin, and an IT or security career can leave audit sequence and reporting thin.
Use ISACA's CISA Review Manual for explanation and the CISA Questions, Answers & Explanations Database to learn how ISACA frames questions. Move to mixed sets once the core concepts hold, and keep an error log that separates technology gaps from audit-reasoning errors. How to study for CISA covers this in more detail.
How Qualifico supports the CISA exam
Qualifico provides CISA practice questions and flashcards across all five domains. The explanations focus on the auditor's choice of evidence and sequence. Qualifico scores are not ISACA scaled scores; use the official question database to judge readiness.
Certification requirements
You can sit the exam before you have the experience, but passing does not make you certified. ISACA's requirements include five years of information systems audit, control or security experience within the ten years before you apply, and you must apply within five years of passing. Certified members then need at least 120 hours of continuing professional education every three years, with at least 20 each year.
Official resources and next step
Keep the candidate guide and the content outline to hand while you study. If your work is more about owning and responding to IT risk than auditing it, the CRISC exam guide may fit better.
Search other articles