Last updated:
CISA preparation guide
CISA vs CISM vs CRISC: auditor, security manager or risk role?
Choose by the decision your work asks you to make. CISA is for the person who tests controls and reports on them; CISM is for the person who runs the security program; CRISC is for the person who assesses IT risk and decides how to respond. All three are 150-question ISACA exams at the same fee, so cost does not separate them. Your role and experience do.
The three outlines share vocabulary: governance, risk, controls, continuity. That overlap is why people search for all three together, and why studying for one can feel like preparing for another. The difference shows up in the question stem: who is acting, and what that person is accountable for.
A CISA question usually asks what the IS auditor should do, conclude or recommend. A CISM question asks what the security manager should do next for the program. A CRISC question asks how the risk should be assessed, treated or reported. The same facts can lead to three different best answers.
Start CISA baselineCISA, CISM and CRISC side by side
| CISA | CISM | CRISC | |
|---|---|---|---|
| Your role in the question | Independent IS auditor: test, conclude, report | Security manager: govern, build and run the program | Risk practitioner: assess risk, choose and monitor the response |
| Domains (ISACA outline) | 5: audit process; IT governance; acquisition and implementation; operations and resilience; protection of information assets | 4: governance; risk management; security program; incident management | 4: governance; risk assessment; risk response and reporting; technology and security |
| Experience to certify | 5 years in IS audit, control or security | 5 years of CISM work, across at least 3 of the 4 domains | 3 years of CRISC work, across at least 2 of the 4 domains |
| Exam | 150 questions, 4 hours | 150 questions, 4 hours | 150 questions, 4 hours |
| Exam fee (member / non-member) | US$575 / US$760 | US$575 / US$760 | US$575 / US$760 |
| A common wrong turn (CertArc teaching view) | Fixing the problem instead of evidencing and reporting it | Choosing a technical fix instead of managing the program | Treating a control as the goal instead of a response to a stated risk |
Original teaching example
Backups for a payment system have failed silently for six weeks. Nobody noticed until a restore was needed. The same facts appear in a CISA, a CISM and a CRISC question.
The CISA answer establishes whether backup monitoring was designed and operating: job logs, alert records and restore tests, then a reported finding with its cause and a recommendation. The CISM answer makes sure someone owns backup monitoring and fixes the process across the program. The CRISC answer re-rates the data-loss risk against appetite, updates the register and sets an indicator to watch. Reconfiguring the backup job yourself is wrong in all three.
Pick the certification that matches the job you do
If you test controls, write findings or work in internal audit, CISA describes your job. If you lead a security function or are moving into that role, CISM does. If your work is the risk register, control owners and risk reporting, CRISC does. The experience requirements differ too: CISA and CISM ask for five years of relevant work, CRISC for three.
You can sit any of the three exams before you have the experience. ISACA gives you five years from passing to apply, so the exam can come first and the application later.
Where the exams overlap, and why the answers still differ
Business continuity is a good test. CISA Domain 4 covers business resilience; CISM covers it through incident management; CRISC covers it as a risk response. Knowing what an RTO is helps in all three, but the question is rarely about the definition. It is about whether you should test the plan, own the plan or rate the risk the plan addresses.
When you move from one exam to the next, re-read practice questions for the actor first. It is easy to keep answering in the role of the exam you studied before.
Taking more than one
Each credential has its own exam, application, experience requirement and yearly maintenance fee. ISACA lets CPE hours count towards more than one of its certifications when the activity is relevant to each, and the maintenance fee drops for the third and later certifications.
Frequently asked questions
Is CISA harder than CISM?
ISACA does not publish comparable pass rates. Difficulty depends mostly on whether the exam’s role matches your experience: auditors often find CISA questions natural and CISM questions slippery, and security managers the reverse.
Can I take CISA without audit experience?
Yes. The exam is open to anyone. You need the qualifying experience to apply for certification, and ISACA gives you five years from passing to apply.
Should I take CRISC after CISA?
If your work is moving from testing controls to owning risk decisions, CRISC is the closer match. Study it as a change of role: the best answer manages the risk instead of evaluating the control.
Do CISA, CISM and CRISC cost the same?
Yes. ISACA shows US$575 for members and US$760 for non-members for each exam, plus a US$50 application fee after passing.
How does CISA compare with CISSP?
CISSP is an ISC2 security certification with eight domains; CISA is ISACA’s audit certification. See the CISSP vs CISA comparison for the detail.
Sources and limits
Exam scope and weights: ISACA CISA exam content outline. Certification eligibility: ISACA certification requirements. Other sources: CISM requirements; CRISC requirements; candidate guide v1.26 (exam length). Checked 26 October 2026.
Study methods and examples are independent CertArc teaching guidance. Practice results do not convert to an official score or guarantee a pass. CertArc is not affiliated with or endorsed by ISACA.
