Last updated:
CISA preparation guide
How should you study CISA Domain 4, operations and business resilience?
Domain 4, Information Systems Operations and Business Resilience, is 26% of the CISA exam. It has two parts: 4A, how IT runs day to day (changes, incidents, logs, service levels, databases), and 4B, whether the business can recover (impact analysis, backups, continuity and recovery plans). Most questions ask what the auditor should check. The answer is usually evidence that a control operated, such as a tested restore or an approved change record, not a document that says it should.
Domain 4 shares the top weight with Domain 5, so a weak spot here costs more than one in Domain 3. The objectives look technical, but the questions rarely ask how to run a backup or patch a server. They ask whether the organisation can show that these things happen as intended, and what the auditor does when it can’t.
This is independent CertArc teaching material. Use ISACA’s outline for what is tested and the CISA Review Manual for depth.
Start CISA baselineKey Domain 4 objectives: what the auditor checks
| Objective (outline) | What the auditor checks | Strongest evidence | Tempting wrong move |
|---|---|---|---|
| IT Change, Configuration, and Patch Management (4A) | Every production change was approved, tested and moved by someone other than its developer | Changes sampled from the production system’s own log, traced back to approvals | Sampling from the change tickets, which misses unrecorded changes |
| Problem and Incident Management (4A) | Incidents restore service; problems find and remove the root cause | Recurring incidents linked to a problem record with a fix | Counting closed incident tickets |
| Operational Log Management (4A) | Logs are complete, retained and protected from the people whose actions they record | Log settings, and who can alter or delete them | Confirming that logging is switched on |
| IT Service Level Management (4A) | Service is measured against agreed levels, and shortfalls are acted on | Independent or system-generated performance data, or the provider’s assurance report | The provider’s own monthly summary |
| Shadow IT and End-User Computing (EUC) (4A) | Business-built tools that feed important decisions are known and controlled | An inventory of end-user tools, ranked by risk, with access and version control on the critical ones | Banning spreadsheets |
| Business Impact Analysis (BIA) (4B) | Recovery priorities come from the business, not IT | A BIA signed off by process owners, with recovery time and data loss limits per process | An IT asset list ranked by IT |
| Data Backup, Storage, and Restoration (4B) | Backups can actually be restored within the agreed limits | Results of restore tests | A backup job success report |
| Business Continuity Plan (BCP) and Disaster Recovery Plans (DRP) (4B) | The plans are current and have been tested, and the test findings were fixed | A test report with gaps and their remediation | The plan document itself |
Original teaching example
A bank’s disaster recovery plan was updated last month and approved by the CIO. The plan says the payments system will be restored within four hours. The question asks what the IS auditor should do FIRST to assess whether the plan is adequate.
Two checks come before trusting the four hours. Is four hours what the business needs? That comes from the business impact analysis, so compare the plan’s recovery time with the one the payments owner agreed. Has anyone shown it can be done? That comes from test results. A recently approved document answers neither question. Options that start with rewriting the plan, or with running a full failover yourself, put the auditor in management’s role.
4A: operations questions turn on control over change
Most 4A questions have the same shape: something changed in production, and the question is whether the organisation controlled it. Look for three things in the scenario: approval before the change, testing, and separation between the person who wrote the change and the person who moved it. Emergency changes may take a faster route, but they still need emergency authorisation, with formal approval, documentation and review afterwards. An option that accepts an emergency change with no later review is usually the wrong one.
For logs, the issue is integrity. A log that the administrator can edit does not prove what the administrator did.
4B: resilience questions turn on tested, current plans
The business impact analysis comes first, because it sets the recovery time objective (how long a process can be down) and the recovery point objective (how much data can be lost, measured in time). Backups, continuity plans and recovery plans are then judged against those numbers.
A question that offers “review the plan” and “review the results of the last test” is usually testing whether you know that only the test shows the plan works. If the last test found gaps, the next question is whether those gaps were closed.
How to study Domain 4
Learn the objectives as questions an auditor asks, not as technology topics: “who approved this?”, “how do we know it worked?”, “what happens if it fails?”. When you miss a Domain 4 question, check whether you chose the option that fixes the problem rather than the one that gathers evidence about it. That is a common reason technical candidates lose points here.
Frequently asked questions
How much of the CISA exam is Domain 4?
Domains 4 and 5 carry 26% each, Domains 1 and 2 carry 18% each and Domain 3 carries 12%.
Is Domain 4 about running IT operations?
No. It covers operations and resilience from the auditor’s side: whether controls over changes, incidents, logs, service levels and recovery exist, operate and are evidenced.
What is the difference between RTO and RPO?
The recovery time objective is how long a process can be unavailable. The recovery point objective is how much data, measured in time, the business can afford to lose. Both come from the business impact analysis.
Sources and limits
Exam scope and weights: ISACA CISA exam content outline. Certification eligibility: ISACA certification requirements. Checked 27 October 2026.
Study methods and examples are independent CertArc teaching guidance. Practice results do not convert to an official score or guarantee a pass. CertArc is not affiliated with or endorsed by ISACA.
