CISA
Certified Information Systems Auditor

Overview

The Certified Information Systems Auditor (CISA) shows that a person can plan and carry out audits of information systems, judge whether controls work, and report findings to management. ISACA's exam follows the audit process itself and then covers IT governance, systems acquisition and development, operations and business resilience, and the protection of information assets. Holders often work as IT auditors, internal auditors, assurance and compliance analysts, or consultants at audit and advisory firms. Its exam has 150 questions.

Candidates need 5 years of experience in information systems audit, control, assurance, or security, gained within the 10 years before they apply, and ISACA's candidate guide allows waivers of up to 3 years. Holders also follow ISACA's auditing standards. ISACA's CISM and CRISC sit close by, with CISM aimed at people who manage a security program and CRISC at people who manage IT risk and controls. CISA isn't tied to a single standard, which sets it apart from ISO/IEC 27001 lead auditor credentials that focus on audits against that standard. Holders report CPE hours every year and renew on a 3-year cycle.

What the exam covers

The CISA exam content outline organizes the exam into 5 job practice domains, each with a published weight.

Requirements

At least 5 years of professional information systems audit, control, assurance, or security experience, gained within the 10 years before the application. ISACA's candidate guide allows experience waivers of up to 3 years, and candidates have 5 years after passing the exam to apply.

Format

Computer-based, multiple choice, offered in English and several other languages

Questions

150

Time

4 hours

Passing score

450 on a scaled score of 200 to 800

Delivery

PSI test centres or online remote proctoring

Certification also requires a USD 50 application processing fee, work experience verified by a supervisor or manager, agreement to ISACA's Code of Professional Ethics and CPE policy, and compliance with ISACA's Information Systems Auditing Standards.

Cost

Exam fee: USD 575 for ISACA members, USD 760 for non-members. Prices from ISACA's CISA page and exam candidate guide, checked October 12, 2026, plus a USD 50 application processing fee. ISACA lists fees in US dollars, and prices change, so confirm with ISACA before registering.

Keeping it current

Cycle

3 years

Continuing education

120 CPE hours per 3-year period, with at least 20 each year

Fees

USD 45 a year for ISACA members, USD 85 for non-members (lower rates apply from a third ISACA certification), due January 1

How to verify that someone holds it

Employers can use ISACA's verification tool by selecting the certification, entering the certificate number the holder provides, and entering the holder's last name. ISACA also issues CISA as a Credly badge. Use the issuer’s verification page.

On InfoSecHub, a CISA listed on a profile shows Verified by Credly only when a current Credly badge issued to that person confirms it.

In Canada

ISACA has chapters across Canada, including Toronto, Montréal, Ottawa Valley, Calgary, and Vancouver.

Typical roles

• IT auditor
• Internal auditor
• Assurance analyst
• Compliance analyst
• Audit manager
• Risk and controls consultant

Related frameworks

• SOC 2
• ISO 27001
• NIST CSF
• NIST 800-53
• OSFI B-13

References

1. Earn a CISA certification, ISACA
2. Maintain CISA certification, ISACA
3. CISA exam content outline, ISACA
4. Exam candidate guides, ISACA

Reviewed 2026-10-12. Exam details, prices, and renewal rules change. Confirm them on the ISACA website before you register. InfoSecHub is not affiliated with ISACA.