Last updated:
CISA preparation guide
CISA exam tips: format, pacing and reading audit questions
The CISA exam is 150 multiple-choice questions in 4 hours, about 96 seconds each, across five domains. Many questions ask what the IS auditor should do first, best or most, so the tips that matter are about reading: identify the actor, the stage of the audit and the evidence on hand before you look at the options.
ISACA offers the exam at PSI test centres and as a remotely proctored exam. Registration is open all year and gives you six months to sit; you can book a slot as early as 48 hours after paying. Your ISACA account name must match the government ID you bring on the day.
ISACA reports a scaled score from 200 to 800. Domain results on the score report are for information only; the score comes from all scored items, whatever their domain.
Start CISA baselineWhat CISA question wording usually tests
| The question asks | What it usually tests | Watch for |
|---|---|---|
| What should the IS auditor do FIRST? | Audit sequence: understand and plan before testing, test before concluding | An option that jumps to a conclusion or a fix |
| Which is the BEST evidence? | Reliability: independent, documented and obtained directly by the auditor | Management’s statement offered as proof |
| What is the GREATEST concern? | The exposure that most threatens the stated objective | A real weakness that does not affect this objective |
| What should the auditor recommend? | A recommendation that management owns and implements | The auditor implementing the control |
| What is MOST important when …? | The precondition the other options depend on | Good practices that come later |
Original teaching example
An auditor finds that a change was moved to production without approval. Options: reverse the change; report the finding to management; determine whether the change was authorised by other means; recommend stronger change controls.
If the question asks what to do FIRST, the answer is to establish the facts: was there approval somewhere else, such as an emergency change record? Reporting comes after the evidence is clear, a recommendation follows the finding, and reversing the change is management’s decision, not the auditor’s.
Pace for the whole exam, not each question
4 hours for 150 questions is about 96 seconds each. Some take twenty seconds and some take three minutes. Check the clock at fixed points, such as every 25 questions, rather than after every item.
When a question stalls you, choose your best answer, flag it and move on. Return to flagged questions with the time you saved, and change an answer only for a reason you can name.
Read the stem as the auditor
Before the options, name three things: who is acting, where the audit is (planning, fieldwork, reporting or follow-up) and what evidence already exists. Most wrong options are good actions for someone else, or right actions at another stage.
The auditor evaluates, concludes and recommends. Options where the auditor designs, approves or operates a control usually break independence, however sensible they sound.
Cover all five domains
Domains 4 and 5 carry 26% each, Domains 1 and 2 carry 18% each and Domain 3 carries 12%. The smallest domain is still around 18 questions. Use the official outline as a checklist, and take a baseline to find the domains your study has skipped.
Frequently asked questions
How long is the CISA exam?
4 hours (240 minutes) for 150 multiple-choice questions.
Can I take the CISA exam online?
Yes. ISACA offers remote proctoring through PSI as well as test-centre appointments. Check the remote proctoring guide for the room and equipment rules.
When can I book my CISA exam?
Registration is continuous. Once the fee is paid you can book an appointment as early as 48 hours later, within your six-month eligibility window.
Can I reschedule the CISA exam?
Yes, without penalty, as long as you do it at least 48 hours before your appointment and stay within your eligibility window.
How is the CISA exam scored?
ISACA reports a scaled score from 200 to 800 based on all scored items. Domain-level results are informational. See ISACA’s candidate guide for the full scoring rules.
Sources and limits
Exam scope and weights: ISACA CISA exam content outline. Certification eligibility: ISACA certification requirements. Other sources: candidate guide v1.26 (format, scoring, scheduling); ISACA CISA page (registration and testing). Checked 26 October 2026.
Study methods and examples are independent CertArc teaching guidance. Practice results do not convert to an official score or guarantee a pass. CertArc is not affiliated with or endorsed by ISACA.
