What Is CISA? Eligibility, Exam Domains and Career Opportunities

The Certified Information Systems Auditor (CISA) certification is a professional credential offered by ISACA for people who audit, assess, monitor or help manage an organisation’s information systems and technology-related controls. It is particularly relevant to professionals working in information systems audit, IT governance, technology risk, information security assurance and related areas.

CISA is not simply a general IT or cybersecurity certificate. Its focus is on evaluating whether information systems are governed, acquired, operated and protected in a way that supports organisational objectives and manages risk. This guide explains the certification, the five exam domains, experience requirements, career relevance and practical steps for prospective candidates.

For auditors, accountants and IT professionals weighing up the investment, the details matter: the exam weightings shape how you study, the experience rules shape when you can apply, and the maintenance rules shape what you commit to after certification. Each of these is set out below, with references to ISACA’s official pages so you can verify current requirements before you register.

What Does CISA Stand For?

CISA stands for Certified Information Systems Auditor. ISACA awards the certification to eligible professionals who meet its examination, work-experience and other certification requirements. The credential is designed around auditing information systems and assessing related governance, controls, operations and security.

In practice, that means a CISA candidate is expected to understand how an organisation plans and conducts information systems audits, how IT is governed, how systems are acquired, developed and implemented, how operations and business resilience are managed, and how information assets are protected. These themes map directly onto the five exam domains described later in this guide. You can review the official ISACA CISA page for the credential’s current scope and requirements.

Who Should Consider the CISA Certification?

CISA may be relevant to professionals whose work involves:

• Information systems or IT auditing — planning, performing and reporting on audits of information systems.
• Internal audit assignments involving technology, systems or automated controls — including reliance on automated controls within financial and operational audits.
• IT governance, risk management and compliance — evaluating whether technology decisions and controls support organisational objectives.
• Information security control reviews and assurance — assessing access, monitoring and data protection arrangements.
• Technology risk consulting and control assessment — advising on the design and effectiveness of technology controls.
• Reviewing system acquisition, development, implementation and operations — from business cases through to post-implementation review.

It can also be worth exploring for accounting, finance and audit professionals who want to develop a specialisation in technology-related assurance. However, candidates should assess the actual work-experience requirements rather than assuming that an accounting qualification or general audit experience automatically satisfies ISACA’s criteria.

CISA Exam Pass Versus Full CISA Certification

Passing the CISA examination and becoming fully certified are not the same milestone. An individual may sit and pass the examination before completing the required professional experience, but must meet ISACA’s certification requirements before being awarded the full CISA credential.

ISACA’s published full-certification route requires a passing exam result and at least five years of professional information systems auditing, control or security work experience, as defined by ISACA. The qualifying experience must fall within the ten years preceding the application. An application must be submitted within five years of passing the exam. Experience is subject to verification, and applicants must also agree to ISACA’s Code of Professional Ethics, CPE policy and Information Systems Auditing Standards. The step-by-step route is set out on ISACA’s How to Get CISA Certified page.

ISACA may permit specified substitutions or waivers in defined circumstances. Candidates should assess these only against the latest official application rules; do not assume that a particular degree, qualification or job title automatically grants a waiver.

What Is the CISA Associate Designation?

ISACA also describes a separate CISA Associate designation for eligible examination passers who have not yet fulfilled the professional-experience requirement. It is not the same as full CISA certification and should not be presented as an automatic designation for every person who passes the exam.

ISACA’s published conditions include passing the CISA exam, participating through an ISACA partner programme, holding active ISACA membership at any level and submitting the required application and fee. The designation is time-limited (up to four years or until the experience requirement is met, as applicable). Candidates must confirm current eligibility and application conditions directly on ISACA’s CISA Associate page.

MAC Learning Hub is not an ISACA partner, and this article does not imply any ISACA endorsement or partnership. Because partner-programme participation is one of the published conditions, readers should verify the current Associate requirements on ISACA’s official page before relying on them.

CISA Exam Domains: What Does the Exam Cover?

The current ISACA CISA Exam Content Outline is organised into five domains. The percentages below represent the published weighting of each domain.

The same weightings at a glance:

Domains 4 and 5 — Information Systems Operations & Business Resilience and Protection of Information Assets — carry the largest individual weightings at 26% each. Candidates should give them appropriate study time while still preparing across all five domains. The domain weights are not a reason to ignore lower-weighted areas: together, Domains 1 to 3 still account for nearly half of the exam.

CISA Exam Format and Fees

ISACA’s CISA examination is a 150-question exam. It is delivered through the testing arrangements specified by ISACA, including computer-based testing options. Exam delivery availability, appointment procedures and examination duration should be checked in the current ISACA Candidate Guide before booking.

At the time this article was checked, ISACA’s published exam registration prices were US$575 for members and US$760 for non-members. ISACA’s published full-certification application processing fee was US$50.

Fees are time-sensitive. Fees, taxes, membership costs, regional charges and payment terms can change; candidates should confirm the final amount on ISACA’s official registration and certification pages before making payment.

How to Prepare for the CISA Examination

There is no single correct way to study, but a disciplined, domain-led approach gives candidates the best understanding of what the exam rewards. A practical sequence looks like this:

1. Read the official exam content outline — start with the current official CISA Exam Content Outline and understand the five domains and their weightings before anything else.
2. Review ISACA’s candidate guidance — go through official ISACA candidate guidance, exam policies and registration conditions before booking.
3. Build a domain-by-domain study plan — cover every domain, allocating additional time to Information Systems Operations & Business Resilience and Protection of Information Assets.
4. Practise with reliable study materials — use reliable study materials and practice questions to identify weak areas; understand why an answer is correct rather than memorising responses.
5. Relate concepts to real audit situations — connect concepts to practical audit situations, including risk assessment, evidence, control design, system implementation, operations and security.
6. Track progress and revise — review progress regularly and revise weaker topics before scheduling the exam.

Preparation time varies with prior experience, familiarity with IT controls and available study hours. A plan built around the official domains — rather than a fixed, promised timeline — gives you the flexibility to strengthen weak areas before you book the exam. Structured preparation, such as guided CISA classes, can help candidates work through the domains systematically, though no preparer can guarantee a pass.

Career Opportunities After CISA

CISA can support professional development in roles involving information systems audit, technology risk, governance, controls and assurance. Depending on a candidate’s experience and wider qualifications, relevant roles may include:

• IT Auditor or Information Systems Auditor — auditing applications, infrastructure and technology controls across the organisation.
• Internal Auditor – IT — covering technology and automated controls within internal audit assignments.
• IT Risk Analyst or Technology Risk Consultant — identifying, assessing and advising on technology-related risk.
• IT Governance, Risk and Compliance (GRC) Analyst — aligning technology controls with policies, standards and regulatory expectations.
• Information Security Auditor — reviewing access, monitoring, data protection and incident response arrangements.
• IT Audit Manager or Technology Assurance Manager — leading audit and assurance engagements and teams, typically with experience.

The certification does not guarantee employment, promotion or a particular salary. Career outcomes depend on practical experience, technical knowledge, communication skills, local market demand and individual employer requirements.

Is CISA Useful for Chartered Accountants and Accounting Professionals?

Accounting and audit professionals increasingly encounter enterprise systems, automated controls, access management, data flows and technology-dependent financial processes. CISA can help professionals build a structured understanding of how to assess these areas from an information systems audit and control perspective.

It is best viewed as a complementary specialisation rather than a replacement for an accounting qualification or statutory audit authorisation. Its relevance will be strongest where a professional’s responsibilities include IT audit, systems assurance, technology risk or internal controls over information systems.

For accountants already working on audit engagements, the overlap is practical rather than theoretical: understanding how automated controls are designed, how system changes are tested and how access is granted can directly improve the quality of technology-related audit work. As with any candidate, however, the five-year qualifying experience rule still applies to full certification.

CISA Versus a Cybersecurity Certification

CISA focuses on auditing and evaluating information systems, governance, controls, operations and protection of information assets. Cybersecurity certifications can have different emphases, including security operations, technical implementation, penetration testing, incident response or security management. There is overlap, particularly in security controls and risk, but the credentials are not interchangeable. Candidates should choose based on the work they intend to perform.

A useful way to frame the difference: cybersecurity credentials typically centre on building, operating or defending security capabilities, while CISA centres on independently assessing whether those capabilities — and the wider systems around them — are governed, controlled and operating effectively. Professionals who plan to move between the two fields should compare the syllabus of each credential against the job content they expect to handle.

Final Takeaway

CISA is ISACA’s professional certification for information systems audit, control and security work. The credential is structured around five exam domains — with the heaviest weight on Information Systems Operations & Business Resilience and Protection of Information Assets at 26% each — and it is complete only when a passing exam result is combined with verified professional experience and the published application requirements.

Before registering, read the current official exam content outline, check the experience rules and fees on ISACA’s own pages, and build a study plan around the domains rather than around promises. Once certified, professionals maintain the credential through continuing professional education — ISACA’s published requirement is 120 CPE hours over each three-year reporting cycle, with at least 20 hours each year — alongside the other obligations set out in ISACA’s maintenance policy.

When you are ready to plan the next step, you can find more professional certification guidance in the MAC Learning Hub Knowledge Center.

Frequently Asked Questions