CISA Exam Study Guide (ISACA Certified Information Systems Auditor)

This free guide from the ExamCert Team is for IT auditors, risk and compliance professionals preparing for the ISACA CISA certification. CISA rewards an auditor's way of thinking: the right answer is usually the one that gives management reasonable assurance, follows audit standards and addresses risk first, not the most technical fix.

What the CISA exam covers

The exam has 150 multiple-choice questions in four hours and five job practice domains: (1) Information System Auditing Process, (2) Governance and Management of IT, (3) Information Systems Acquisition, Development and Implementation, (4) Information Systems Operations and Business Resilience, and (5) Protection of Information Assets. Domains 4 and 5 together carry the largest weight, so business continuity, incident response, access control and encryption deserve extra time.

An eight-week study plan

• Weeks 1-2: the audit process - risk-based audit planning, sampling, evidence, reporting and follow-up.
• Weeks 3-4: IT governance - frameworks, policies, roles, outsourcing, and IT performance monitoring.
• Week 5: acquisition and development - project controls, SDLC, testing, change and configuration management.
• Week 6: operations and resilience - backup strategies, BCP/DRP, RPO and RTO, problem and incident management.
• Week 7: protection of information assets - logical and physical access, network security, data classification.
• Week 8: full timed practice exams and a review of every wrong answer.

Free CISA practice resources

CISA exam overview, domain weights and tips:
https://www.examcert.app/exams/cisa/

Free CISA practice test with explanations:
https://www.examcert.app/exams/cisa/free-practice-test/

More IT audit, security and cloud certification guides:
https://www.examcert.app/

Exam-day tips

Read each question from the IS auditor's point of view and look for keywords such as FIRST, BEST and MOST. When two answers look correct, prefer the one that identifies or evaluates risk before recommending a control. Pace yourself at about 90 seconds per question and leave time to review flagged items.

Good luck with your exam - ExamCert Team