CISA, the Certified Information Systems Auditor credential from ISACA, is for people who audit, control or secure information systems. ISACA requires five years of relevant work experience within the ten years before you apply, and the exam has 150 questions across five domains. You can take the exam before you have the experience, but you must meet it before you are certified.
Last reviewed: 17 October 2026. Facts checked. We opened two ISACA pages: the "Get CISA certified" page and the CISA exam content outline. We did not find the exam duration, fees or waiver amounts on those pages, so we do not state them. ISACA's application form and support pages, seen only in search summaries, describe experience waivers, and amounts differ by form version. Confirm everything on isaca.org before you plan. We give no salary figures.
What CISA is
CISA is ISACA's credential for information systems auditing, control and assurance. It is used by internal auditors, IT auditors, risk and compliance staff, and chartered accountants who review IT controls.
Eligibility, from ISACA
| Item | What ISACA's page says |
|---|---|
| Work experience | Minimum 5 years of professional information systems auditing, control or security experience, as described in the CISA job practice areas |
| Time window | The experience must be gained within the 10 years before the application date |
| Exam first, experience later | You can take the exam before meeting the experience requirement, but must meet it before certification |
| Passing window | You must pass the exam within the last five years of applying |
| Application window | You have five years from your passing date to apply for certification |
Search summaries of ISACA's application form say experience may be reduced through waivers, and that work experience must be independently verified. The waiver amounts differ between versions of the form, so read the current one.
Exam structure
ISACA's content outline shows 150 questions across five domains:
| Domain | Weight |
|---|---|
| 1. Information System Auditing Process | 18% |
| 2. Governance and Management of IT | 18% |
| 3. Information Systems Acquisition, Development and Implementation | 12% |
| 4. Information Systems Operations and Business Resilience | 26% |
| 5. Protection of Information Assets | 26% |
The outline page does not state the exam length. Check the candidate guide.
Who it suits
CISA tends to suit:
- Internal and IT auditors reviewing ERP, access and change controls.
- Chartered accountants who handle the IT portion of statutory or internal audits. Our guide to ICAI information systems audit standards shows the Indian side of this work.
- Risk, compliance and security staff who need to speak the language of auditors.
It suits less well if your work is entirely tax or accounting with no systems exposure, or if you have not yet worked in audit, control or security. Domain 5, on protecting information assets, carries a quarter of the exam, so it rewards hands-on security awareness.
How to decide
Ask three questions:
- Do my current or planned roles include IT audit or IT general controls testing?
- Can I document five years of relevant experience, with waivers only if ISACA allows them?
- Will clients, my firm or employers value the credential?
If the answer to all three is yes, CISA is a reasonable next step. If you want a wider internal audit credential, read our internal audit career path guide.
Practical preparation
- Start with the exam content outline and map your experience to each domain.
- Practise on systems you audit: access reviews, change tickets, backups and recovery tests.
- Use real checklists. Our cybersecurity audit checklist and ISO 27001 internal audit guide are worked examples of the kind of work the domains describe.
Common mistakes to avoid
- Counting experience that does not map to the five domains. ISACA says the experience must be in information systems auditing, control or security as described in the job practice areas, so general accounting work may not qualify.
- Assuming the exam clock on your application is open-ended. ISACA gives five-year windows on both sides: pass within five years of applying, and apply within five years of passing.
- Treating the outline weights as a study plan. Domains 4 and 5 together carry 52 percent of the exam, but a weak area can still cost you.
- Skipping the verification step. ISACA's form, as summarised in search results, requires your experience to be independently verified, so line up referees early.
Frequently Asked Questions
What is the CISA eligibility requirement?
ISACA's page says a minimum of five years of professional information systems auditing, control or security experience, gained within the ten years before you apply.
Can I take the CISA exam before I have the experience?
Yes. ISACA says you can take the exam first but must meet the experience requirement before you are certified.
How many questions are on the CISA exam?
ISACA's content outline lists 150 questions across five domains. It did not state the exam length on the page we opened.
Is CISA useful for chartered accountants in India?
It can be, if your work touches IT audit or controls. It is an IT-focused credential, not a replacement for CA.
How much does CISA cost?
We did not find fees on the pages we opened, so we do not give a figure. Check ISACA's current fee page.
Related Articles
Statutory facts on this page are checked against their sources, and the page says where it relied on secondary reporting. How we verify · Report an error