Learn mode
Learn as you go
Choose an answer, reveal the key, and review available explanations, citations and candidate context.
25 questions free
Start guided practiceThe benchmark IT audit credential: the audit process itself, IT governance and management, systems acquisition and development, operations and resilience, and protection of information assets.
ISACA does not publish numeric exam codes — CISA is the common abbreviation.
Certified Information Systems Auditor is ISACA's professional-level governance, risk & compliance certification, referred to across the industry by the shorthand CISA. The exam runs for 4 hours and presents up to 150 questions, with a pass mark of 450 / 800 (scaled). It costs US$760 at the standard rate.
ISACA publishes the syllabus as 5 weighted domains. Information Systems Operations and Business Resilience carries the most weight at 26%, and the three largest domains together account for roughly 70% of the scored content — worth knowing before you decide where study time goes.
CISA questions are written from the auditor’s chair. The correct answer is usually the one that establishes evidence or independence, even when a more operationally convenient option is available.
Confirm these details on the official ISACA page before booking — vendors adjust format and pricing without notice.
Some forms include unscored trial questions
Standard rate, before local taxes
The published exam guide for CISA, in the vendor's own order.
01Information System Auditing Process
18%02Governance and Management of IT
18%03Information Systems Acquisition, Development and Implementation
12%04Information Systems Operations and Business Resilience
26%05Protection of Information Assets
26%Five years of information systems audit, control or security experience, with limited substitutions available.
Professional level — Advanced credentials covering design, scale and trade-off decisions.
Preview 25 supported questions before unlocking the 1,459-question CISA bank.
Community-contributedCompiled from publicly posted community exam discussions. Contributed by third parties rather than written here, so accuracy varies and most items carry no explanation. Progress and bookmarks stay in this browser.
Answer support: 816 explanations, 1,387 questions with candidate context and 3 questions with direct citations. Bank updated .
Choose an answer, reveal the key, and review available explanations, citations and candidate context.
25 questions free
Start guided practiceKeep answers hidden on the clock and review every miss only after you finish the public sample.
Free sample mock
Open timed mockWant the complete 1,459-question bank?
One Exam Pass unlocks this selected bank for 12 months with no renewal.
Compiled from exam discussions posted publicly by other people on ExamTopics. Copyright in each contribution rests with its original author; it is reproduced here for study. Not verified by us — most items carry no explanation. To request removal, see our content policy.
ISACA lists up to 150 questions, to be completed in 4 hours. Question counts can vary slightly between exam forms, and unscored trial questions are sometimes included.
450 / 800 (scaled). Confirm the current figure on the official exam page before booking, as vendors adjust cut scores when an exam form is refreshed.
The standard price is US$760. Local pricing, taxes and any retake policy vary by region, so check the official page for the figure that applies to you.
Five years of information systems audit, control or security experience, with limited substitutions available.
The exam guide covers Information System Auditing Process, Governance and Management of IT, Information Systems Acquisition, Development and Implementation, Information Systems Operations and Business Resilience and Protection of Information Assets. The full weighted breakdown is listed above.
Yes — this exam has 1459 practice questions available here, each with the correct answer marked. They are community-contributed, compiled from exam discussions posted publicly by other people rather than written here, and most do not carry an explanation.