CISA Certification: Requirements, Exam Domains, Experience Waivers and CPE

The Certified Information Systems Auditor (CISA) is ISACA's credential for people who audit, control, assure or secure information systems. It is not a license and no state board regulates it. Its value is as evidence that an IT auditor has passed a standard exam and has verified work experience, which is why it shows up in postings for IT audit, SOX IT testing, and technology risk roles. For a CPA firm, it is one of the more practical ways to staff the IT portion of an audit.

This guide reflects ISACA's published rules as of November 2026. ISACA updates its exam content outline and policies, so read its candidate guide and application before you register.

Who is CISA for?

CISA fits auditors who assess technology controls: IT general controls, application controls, access management, change management, operations and resilience. CPAs often reach it from financial audit teams that rely on IT general controls and application controls, or from SOC and SOX work. See the IT audit guide for how those procedures look in an engagement.

What are the CISA requirements?

ISACA requires three things: pass the exam, have the experience, and apply for certification. The order is flexible. You can take the exam before you meet the experience requirement, but you must meet it before ISACA certifies you.

• Experience. Five or more years of professional information systems auditing, control, assurance or security work in at least one of the CISA job practice domains. The experience must fall within the 10 years before your application date. ISACA's application form says Section A, the direct experience, must total a minimum of two years even after waivers.
• Exam. You must have passed the CISA exam within the five years before you apply. Candidates have five years from the passing date to apply.
• Application. After scores are released, you submit the application with a one-time US$50 processing fee. A supervisor or manager must verify your experience.
• Code and standards. You agree to ISACA's Code of Professional Ethics and to abide by its information systems auditing standards.

How do CISA experience waivers work?

ISACA lets some education and work substitute for part of the five years, up to a maximum of three years in total. The waiver options on ISACA's CISA application are:

Education waivers need a copy of the degree, a transcript or a letter from the school. CIMA and ACCA waivers need a copy of the certificate. The total of direct experience plus waivers must reach five years, and the waivers cannot exceed three.

Worked example: how much direct experience do you need?

Illustrative. Three candidates with different backgrounds:

1. Bachelor's in accounting, no other waiver. The degree waives 2 years. Direct experience needed: 5 - 2 = 3 years.
2. Bachelor's in accounting plus one year of general audit work that is separate from the IS audit work she is claiming. The degree waives 2 years and the general work waives 1 year, for 3 years total, which equals the cap. Direct experience needed: 5 - 3 = 2 years.
3. Master's in information systems plus one year of general audit work. The degree alone waives 3 years, which already equals the cap, so the general work waiver adds nothing. Direct experience needed: 5 - 3 = 2 years.

Notice that the cap makes the minimum direct experience two years in every case. A candidate with a bachelor's degree and a master's degree does not stack 2 + 3 years; the combined waivers stop at 3.

Older articles describe a different scheme for degree waivers, with one to three years by degree level. ISACA's application form is the document to use, and the table above follows it.

What are the five CISA exam domains?

The exam has 150 questions, and candidates have four hours. ISACA's content outline sets the weights:

The question counts are the weights applied to 150 questions; ISACA's page gives the percentages. Together, Domains 4 and 5 account for just over half the exam. They cover how systems run day to day, how organizations recover from disruption, and how access, data and networks are protected. Domain 1 covers the audit process itself: planning, standards, risk-based approach, evidence and reporting, so it will feel familiar to a financial auditor. Domain 2 covers IT governance and management, and Domain 3 covers how systems are acquired, developed and changed. Pair it with control concepts such as change management and user access review.

How is the CISA exam scored and scheduled?

• Format. Computer-based and closed book. You can test at an authorized PSI testing center or take it remotely proctored.
• Scoring. ISACA reports a scaled score from 200 to 800. A score of 450 or higher passes. Domain-level results are informational; the pass decision rests on the total.
• Eligibility window. After you register, you have six months to take the exam. A six-month extension is available for a fee listed in ISACA's candidate guide.
• Retakes. You get four attempts in a rolling 12-month period. The second attempt must wait 30 days after the first, and the third and fourth attempts must each wait 90 days after the previous attempt. You pay the registration fee for each attempt.
• After you pass. You cannot retake the same exam while you hold the certification.

How do you maintain CISA?

CISA holders must earn and report at least 120 hours of CPE in each three-year reporting period, with a minimum of 20 hours per year. The hours must relate to CISA. ISACA also charges an annual maintenance fee, which differs for members and nonmembers and is due by 1 January. It audits a sample of CPE reports each year, and holders must keep documentation for 12 months after each three-year cycle ends. Failing to meet the requirements leads to revocation.

The 120-hour, three-year shape matches how many CPAs already track professional education, but the two systems are separate. A CPA board accepts courses by its own sponsor and subject rules, and ISACA requires the hours to relate to CISA. A course on IT controls often serves both, but each body decides what counts. See CPE.

Does CISA matter for CPAs?

For many audit teams, yes. A CPA who tests ITGCs, reads SOC reports or runs data analytics benefits from CISA content because the exam tests how technology controls are designed and evaluated. It does not give attest authority. A CPA license and a CPA firm's PCAOB registration, where applicable, are what govern signing audit reports. See the comparison of CPA, CIA, CISA and CFE. For the reports an IT auditor reads in practice, see SOC 1 vs SOC 2 vs SOC 3.

Common mistakes

• Waiting more than five years from the exam pass date to apply, which lapses the pass.
• Claiming experience older than 10 years before the application date.
• Claiming general work waiver time that overlaps the direct experience dates.
• Stacking education waivers beyond the three-year maximum.
• Scheduling retakes without counting the 30-day and 90-day waits.
• Treating CISA CPE as automatically satisfied by CPA CPE.

Frequently asked questions

How many years of experience does CISA require?

Five years of information systems audit, control, assurance or security work, within the 10 years before you apply. Waivers can reduce this by up to three years.

Can you take the CISA exam without experience?

Yes. You can sit for the exam first, but you must meet the experience requirement before certification, and you must apply within five years of passing.

How many questions are on the CISA exam?

150 questions in four hours, scored on a 200 to 800 scale with 450 as the passing score.

Does a bachelor's degree count toward the CISA experience requirement?

Yes. A bachelor's, master's or doctorate in any field waives two years, and a master's in information systems or a related field waives three years, up to a combined maximum of three years.

How many CPE hours does CISA require?

At least 120 hours in each three-year period, with a minimum of 20 hours each year.

Do CISA requirements vary by state?

No. ISACA sets them for every candidate in the same way. State rules matter for the CPA license, which varies by board of accountancy for education, experience and CPE. Each state board of accountancy publishes its own rules; start from the state hub.

Sources

• ISACA, Get CISA Certified, isaca.org/credentialing/cisa/get-cisa-certified
• ISACA, CISA Exam Content Outline, isaca.org/credentialing/cisa/cisa-exam-content-outline
• ISACA, CISA Certification Application (experience waiver table), isaca.org/credentialing/cisa
• ISACA, Certification Exam Candidate Guide (2026), isaca.org
• ISACA, CISA Maintenance Requirements, isaca.org/credentialing/cisa/maintain-cisa-certification

AU-C references are to AICPA Professional Standards, paraphrased here; read the standard itself before relying on a requirement. This page is guidance, not professional advice. Report an error