How to study for CISA: audit evidence and resources

CISA questions rarely ask what a control is. They ask what an auditor should do, check or conclude, and the hard part is telling evidence that a control exists from evidence that it worked. Study that is organised around the auditor's reasoning prepares you far better than study organised around technology topics.

Start with the outline and a diagnostic

ISACA's CISA exam content outline puts 52% of the exam in two domains: information systems operations and business resilience, and protection of information assets. The information system auditing process domain is only 18%, but every other domain is examined through it, so it deserves early attention.

Before planning, answer a short mixed set from all five domains. Your role shapes your blind spots. An audit background can leave systems development and resilience thin; a security or IT background can leave audit planning, sampling and reporting thin. Plan the first month around what the diagnostic shows.

Learn through an evidence chain

For each topic, write four lines: the objective, the risk to that objective, the control meant to address it and the evidence that would show whether the control works. A policy shows intent. A manager's assurance shows belief. Records of the control operating over the period show operation. Many CISA options turn on exactly that difference.

A worked example: leavers' access

An auditor needs assurance that access is removed promptly when people leave. The policy says accounts are disabled within one working day, and the IT manager says the process works.

Neither of those shows that it worked. Stronger evidence starts from the population of leavers in the period, taken from HR records rather than from IT, and compares each leaving date with the date access was actually removed, following up any exceptions. Taking the leaver list from HR matters: a list supplied by the team that performs the control could leave out the very cases you are looking for.

Compare "review the access policy" with "for a sample of leavers from the HR system, compare leaving dates with the dates access was removed". The first helps you understand the design. Only the second tests operation. When an option looks plausible, ask which of those two questions it answers.

Read the question as an auditor

Watch the qualifiers ISACA uses, such as BEST, MOST and FIRST. "What should the auditor do FIRST?" and "What is the BEST evidence?" can share a scenario and have different answers.

Keep the auditor's role in view. An auditor evaluates and recommends; management designs and implements controls. Options in which the auditor fixes the problem directly are usually weaker for that reason. Do not add facts the scenario does not give you to make an option work.

Use ISACA's resources for different jobs

ISACA publishes the CISA Review Manual, the CISA Questions, Answers & Explanations Database, an online review course and a free practice quiz. The manual explains the content; the question database shows how ISACA phrases questions and explains its answers. Add other resources only when one of those jobs is not being done. Two overlapping question banks will usually repeat the same gaps faster.

Keep the error log short

For each miss, record the cause and the next action. Five causes are worth tracking: misunderstood technology, wrong audit sequence, weak evidence, confused responsibility and misread wording. If you knew the control but chose the wrong evidence, the repair is an evidence comparison like the one above. If you misunderstood the system, go back to the explanation before attempting more questions. Treat a correct guess as a miss.

Build up to the full exam

The exam is 150 questions in four hours, about 96 seconds each. Move to mixed sets once you can explain the core concepts in each domain, because a chapter heading gives away too much. Before booking, read ISACA's candidate guide for test-centre and remote-proctoring rules.

Plan certification alongside study. You need five years of relevant experience within the ten years before applying, and you must apply within five years of passing. If your work is closer to risk ownership than audit, CISA vs CRISC may help you choose before you start.

Qualifico's CISA practice and flashcards support recall and the evidence reasoning above. Its scores are not ISACA's scaled scores; use the official question database to judge readiness.