Last updated:
CISA preparation guide
CISA cheat sheet: the decision rules behind audit questions
This cheat sheet holds the decisions CISA questions test, not the definitions. Four rules come up again and again: the auditor evaluates and recommends but does not implement; stronger evidence is independent, documented and obtained directly; the audit follows a sequence, so the first step is usually to understand or verify; and the best answer serves the stated objective, not the most impressive control.
Definitions are easy to look up and rarely decide a question. What decides it is knowing which of four reasonable actions fits the auditor’s role at that moment. Use the rules below to check your reasoning after a practice question, not as a list to memorise.
This is independent CertArc teaching material. Use ISACA’s outline for what is tested and the CISA Review Manual for depth.
Start CISA baselineThe auditor’s move in each domain
| Domain (weight) | When the question says … | The auditor’s move | The tempting wrong move |
|---|---|---|---|
| 1. Auditing process (18%) | Planning an audit with limited time | Scope by risk to the audit objective | Testing everything equally |
| 2. Governance and management of IT (18%) | IT strategy does not match business goals | Evaluate the governance process that should align them | Rewriting the strategy |
| 3. Acquisition, development and implementation (12%) | A project is about to go live | Confirm testing and sign-off evidence before go-live | Joining the project team to fix defects |
| 4. Operations and business resilience (26%) | A recovery plan exists | Ask for evidence it was tested and the results | Accepting the document as proof |
| 5. Protection of information assets (26%) | Access looks excessive | Compare access with approved roles and review evidence | Removing the accounts |
Original teaching example
Management tells the auditor that all user access was reviewed last quarter and shows a signed memo. The question asks for the BEST evidence that the review took place.
The memo is management’s assertion. Better evidence is the review itself: the list that was reviewed, the reviewer’s decisions and the tickets that removed access. Stronger still is evidence the auditor draws directly from the system, such as the log of access changes made during the review period.
Evidence strength in one line each
Independent sources beat the auditee’s own records. Documented beats oral. Obtained directly by the auditor (observation, reperformance, confirmation) beats evidence handed over. Evidence from the system of record beats a summary of it.
Sampling and testing
Compliance tests check whether a control works and use attribute sampling: did it happen or not. Substantive tests check the data itself and use variable sampling: how large is the misstatement. Statistical sampling lets you state confidence objectively; judgmental sampling depends on the auditor’s choice.
If a compliance test shows the control is not working, expand substantive testing. If the control works, you can rely on it and reduce substantive work.
Controls and sequence
Preventive controls stop the event, detective controls find it, corrective controls limit the damage. A question about the BEST control usually wants preventive, unless prevention is impossible or the risk is already realised.
The audit runs: understand the business and assess risk, plan the scope, test controls, test substance, report, follow up. When an option skips a step, it is usually wrong for a FIRST question and right for a later one.
Frequently asked questions
Is a cheat sheet enough to pass CISA?
No. It is a revision aid for decisions you have already studied. Use it to check your reasoning on practice questions across all five domains.
What should a CISA cheat sheet include?
The decision rules questions test: the auditor’s role, evidence strength, sampling and testing, control types and the audit sequence. Definitions belong in your notes, not on one page.
Can I take notes into the CISA exam?
No. The exam is closed book, at a test centre or remotely proctored. Use the cheat sheet while studying, not on the day.
Does the auditor ever fix a problem?
The auditor recommends; management decides and implements. An auditor who designs or operates a control would then be auditing their own work.
Which domains matter most?
Domains 4 and 5 carry 26% each, Domains 1 and 2 carry 18% each and Domain 3 carries 12%. Every domain is tested: use the weights to plan time, not to skip a domain.
Sources and limits
Exam scope and weights: ISACA CISA exam content outline. Certification eligibility: ISACA certification requirements. Other sources: candidate guide v1.26 (closed book). Checked 26 October 2026.
Study methods and examples are independent CertArc teaching guidance. Practice results do not convert to an official score or guarantee a pass. CertArc is not affiliated with or endorsed by ISACA.
