Most people fail the CISA on the first attempt for one reason: they study it like an engineer. They memorize control names, encryption acronyms, and framework diagrams, then walk into the exam and get punished for picking the "technically correct" answer instead of the "auditor's answer." ISACA's Certified Information Systems Auditor is not a security-engineering test. It is an audit test. Every question is quietly asking, "What would a disciplined, independent auditor do here?" — and that is a very different question from "What is the best technical fix?"
Before we walk the five domains, the logistics: 150 questions, 4 hours, scaled score of 450 out of 800 to pass, exam fee roughly $575 for members and $760 for non-members, plus a five-year IS audit experience requirement to earn the actual credential. You can sit the exam before you have the experience, but the cert isn't granted until you do. If you want to feel how the question logic works before spending that fee, run a free CISA practice test and pay attention to why the "obvious" answer is often the wrong one.
Now, domain by domain — what each one really tests.
Domain 1: Information Systems Auditing Process (18%)
The outline calls this "planning and execution of audits." What it actually tests is whether you understand independence and evidence. This is the domain where CISA decides if you think like an auditor at all.
Expect a wall of questions on risk-based audit planning, sampling (statistical vs. judgmental), and the hierarchy of evidence. The exam loves to ask which evidence is most reliable — and the answer is almost always the one obtained directly by the auditor from an independent source, not something management handed you. You'll see scenarios where you must choose between "re-perform the control yourself" and "ask the control owner if it works." The auditor re-performs. Always favor corroboration over inquiry.
The other trap here is scope creep and independence. If a question describes an auditor who helped design the control they're now auditing, the answer is that independence is impaired — full stop. Memorize the difference between a finding, a criterion, and a recommendation, because the exam tests whether you can structure an observation correctly, not just spot a problem.
Domain 2: Governance and Management of IT (18%)
Officially this is about "IT governance frameworks." Practically, it tests whether you can tell the difference between governance (the board sets direction) and management (execution) — and whether you keep escalating problems to the right level.
The recurring question pattern: something is broken, and you must pick who is ultimately accountable. The answer is usually senior management or the board, never the IT team, because CISA hammers the idea that accountability cannot be delegated. You'll see COBIT referenced, along with IT strategy alignment, steering committees, and policies-versus-procedures distinctions.
Watch for the "policy first" reflex. When a scenario shows chaos — no standards, inconsistent controls — the root cause the exam wants is almost always a missing or unenforced policy at the governance level, not a missing tool. Also nail the vocabulary: a policy is a high-level intent, a standard is mandatory, a procedure is step-by-step, and a guideline is optional. The exam will deliberately swap these to see if you flinch.
Domain 3: Information Systems Acquisition, Development and Implementation (12%)
The outline says "SDLC and project management." What it tests is whether you know where auditors insert controls into a project without becoming part of the project team.
This is the domain of the SDLC, feasibility studies, and — the exam's favorite topic — testing types. Know cold the difference between unit, integration, system, UAT, and regression testing, and specifically who signs off on each (users own UAT acceptance, not IT). Change management and post-implementation reviews show up constantly. When a question describes a migration or go-live, the auditor's concern is nearly always data integrity during conversion and whether a fallback/rollback plan exists.
The classic trap: a question implies the auditor should approve the project or fix the code. Wrong. The auditor evaluates whether controls exist and whether management approved the phase gates. If you catch yourself picking the answer where the auditor makes a business decision, stop and reread it.
Domain 4: Information Systems Operations and Business Resilience (26%)
This is the biggest domain, and it rewards operational discipline. It covers day-to-day IT operations, service management, backups, and — heavily — business continuity and disaster recovery.
You must own the metrics: RTO (how fast you must recover) versus RPO (how much data you can afford to lose), and how each drives backup frequency and site strategy (hot, warm, cold, and mirrored sites). The exam will hand you a scenario with a tight RPO and expect you to reject an infrequent backup schedule. Know that the first step after any disaster is protecting human life and safety — CISA slips this in and people miss it while reasoning about servers.
BCP/DRP testing is a guaranteed topic. Understand the ladder from checklist review to walk-through to simulation to parallel to full-interruption testing, and which ones actually prove recovery works versus merely reviewing the plan. When asked how to validate a DR plan, the answer is almost never "read the document" — it's the test that exercises it.
Domain 5: Protection of Information Assets (26%)
Tied for largest, this is the closest CISA gets to "security" — but still through an auditor's lens. It spans logical and physical access controls, encryption concepts, network security, and data classification.
The dominant theme is least privilege and segregation of duties. Expect many scenarios where one person can both initiate and approve a transaction; the answer is that SoD is violated and a compensating control (like independent review or logging) is needed. Identity and access management shows up everywhere: provisioning, deprovisioning (terminated employees whose access lingers is a favorite finding), and periodic access recertification.
On the technical side, understand encryption conceptually — symmetric vs. asymmetric, what a digital signature proves (integrity and non-repudiation, not confidentiality) — but don't expect to configure anything. The exam wants you to assess whether a control is adequate for the risk, not to build it.
The mindset that ties it together
Across all five domains, the winning instinct is the same: identify the risk, verify independently, escalate to the right level of accountability, and never let the auditor make a management decision. Drill that pattern with real questions until it's automatic. The AI simulator that explains every answer instantly at ai.examcert.app is built exactly for that — it tells you not just which option is right, but why the tempting engineer's answer is wrong, which is the entire game with CISA.
Study the reasoning, not the acronyms. That's how you pass.
Top comments (0)