Last updated:
CISA preparation guide
What does your CISA QAE score tell you?
A CISA QAE score is your percentage correct on ISACA's practice questions. It is practice feedback, not your exam result: it does not convert to the exam's 200 to 800 scale, and ISACA publishes no QAE pass mark. ISACA also says its QAE questions are not the actual exam questions. The more useful reading is the pattern: steady results on questions you have not seen, every domain holding up, and misses you can explain. If those hold, the score is telling you something real, whatever the exact percentage.
The QAE is ISACA's official CISA practice database: a 1,070-question pool on ISACA's online platform, sold as a six-month subscription with an optional extension (US$299 at the member price, plus membership, or US$399 for non-members, when checked on 2 November 2026). It shows your results by job practice domain and includes three full-length practice exams built to mimic the real blueprint.
Many candidates worry when their QAE percentage sits below the number they hoped for, or below someone else's. On its own, that number is not evidence either way. Your sets are drawn at random or chosen by you, you repeat some questions more than others, and ISACA rates question difficulty from how learners perform, so two percentages are rarely measuring the same thing.
Start CISA baselineWhat each QAE number can tell you
| What you see in the QAE | What it can tell you |
|---|---|
| Overall percentage | How practice is going overall. It is not on the exam's 200–800 scale and has no pass mark. |
| Results by domain | Where to spend your next sessions. One weaker domain is not an automatic fail: ISACA scores the whole exam. Domains 4 and 5 carry 26% each, so gaps there cost the most questions. |
| Full-length practice exam | Pacing and stamina on an exam built to mimic the real blueprint. ISACA lets you reset and retake them, so a repeat score partly reflects memory. |
| Questions you have seen before | Mostly recall: good for review, less telling about readiness. |
| Mastery level per topic (Beginner to Expert) | ISACA's own estimate for each topic area, linked to difficulty ratings that adjust with learner performance. Most useful as a trend. |
A worked example
Priya has used the QAE for five weeks. Her overall score has stopped rising, and she has now seen most Domain 1 and Domain 2 questions twice. Her first full-length practice exam shows Domain 4 behind the others, and she finishes with time to spare.
Her overall percentage mixes repeats with new questions, so it flatters Domains 1 and 2 and says little about Domain 4, which carries 26% of the exam. A useful next week: one fresh mixed set, focused sessions on Domain 4, and a note on each Domain 4 miss saying whether she did not know the topic or knew it but answered from the wrong role. Her finish time shows pacing is not the issue. She doesn't need a higher percentage to get something useful here: it shows her exactly where to look.
Why the QAE percentage is not the exam score
ISACA reports CISA results on a 200 to 800 scale and requires 450 or higher to pass. The score is based on how many scored questions you answer correctly, whatever their domain; domain results are for information only, and unscored pretest questions do not count. The QAE gives a percentage on practice questions that ISACA says are not the actual exam questions, and ISACA publishes no way to convert one into the other.
Read your QAE results as a pattern
Look at three things over a week or two rather than one session: your results on questions you have not seen, whether every domain is holding up, and whether you can explain your misses. A dip after moving to a new domain or a fresh set is normal. A rise from repeated questions is welcome, but it shows recall more than readiness.
ISACA's domain and sub-category filter is useful for a short targeted set; then go back to mixed sets to check the gain holds when topics are shuffled.
Didn't know it, or knew it but chose wrong?
CISA covers a wide range, from systems development to business resilience to network security, so some misses are plain knowledge gaps: read the topic, then retest. Others come from the auditor's point of view. Common traps are fixing a problem instead of reporting it, accepting a plan or a policy document as proof that a control operates, and acting where independence would stop an auditor.
Sorting each miss into one of these two groups tells you whether to read more or practise judgement.
Using the three practice exams well
Spread them out: one early to see where you stand, one in the middle, and one in the last couple of weeks. Review every miss before the next one. Because ISACA lets you reset and retake them, a second go at the same exam mostly tells you what you remember; a fresh one is the better read.
When your score seems stuck
A plateau is common and is not a verdict. Check which group your misses fall into, knowledge or judgement, and try changing how you review before adding more questions.
The last week
Take one mixed set of questions you have not seen, reread your notes on why you missed, and rest. Avoid a reset-and-repeat binge: a high score on familiar questions late on is reassuring, but it is not new evidence.
Where CertArc fits alongside the QAE
The QAE is ISACA's official resource, with ISACA's own questions and explanations. CertArc is independent: original CISA scenarios, not QAE or exam questions, where you choose Confident, Unsure or Guess before each answer is revealed and tag why you missed, so you can see which misses you were sure about and which reasons repeat. The readiness score is a preparation signal, not a pass prediction. The free start is a 25-question baseline across every CISA domain.
Frequently asked questions
What does my CISA QAE score mean?
It is your percentage correct on ISACA's practice questions: practice feedback, not an exam score. It does not convert to the 200–800 exam scale, and ISACA publishes no QAE pass mark.
Is my CISA QAE score good enough?
It's a fair question. ISACA does not publish a QAE pass mark, so look at the pattern instead: steady results on questions you have not seen, every domain holding up, and misses you can explain.
What QAE score do I need to pass CISA?
ISACA sets no QAE target. The exam itself is scored from 200 to 800, with 450 to pass, based on the total you answer correctly; there is no separate pass mark per domain.
My QAE score is lower than other people's. Should I worry?
Not on that basis. Each person draws different questions, repeats some more than others and works through domains in a different order, so two percentages rarely measure the same thing. Compare yourself with your own trend on new questions.
Is the real exam harder than the QAE?
Candidates describe it both ways in public forums, and ISACA does not publish a comparison. Both cover the same five job practice domains, so the habits that hold up on new QAE questions are the ones to rely on.
Are QAE questions the same as the real exam?
No. ISACA says the QAE contains practice questions designed to help you prepare, and that they are not the actual exam questions.
Should I reset the QAE and go through it again?
You can: ISACA allows you to reset and retake the practice exams as many times as you want during your subscription. Use a second pass for review, and judge readiness on questions you have not seen.
How long does QAE access last?
ISACA sells it as a six-month subscription with an optional extension; on 2 November 2026 the store showed access until 30 April 2027.
Does a low QAE score mean I should move my exam?
Not on its own. Look at the pattern above first; the CertArc readiness page walks through when moving a date does make sense.
Sources and limits
Exam scope and weights: ISACA CISA exam content outline. Certification eligibility: ISACA certification requirements. Other sources: ISACA CISA Questions, Answers & Explanations database; ISACA QAE support FAQ; ISACA 2026 exam candidate guide (scoring); ISACA CISA exam content outline (domains and weights). Checked 2 November 2026.
Study methods and examples are independent CertArc teaching guidance. Practice results do not convert to an official score or guarantee a pass. CertArc is not affiliated with or endorsed by ISACA.
