CISA: ISACA Certified Information Systems Auditor Exam

The Certified Information Systems Auditor (CISA) is one of ISACA’s principal current credentials for professionals who audit, assess, monitor, or advise on information systems and technology controls. The current exam contains 150 questions across five domains: Information Systems Auditing Process at 18 percent, Governance and Management of IT at 18 percent, Information Systems Acquisition, Development and Implementation at 12 percent, Information Systems Operations and Business Resilience at 26 percent, and Protection of Information Assets at 26 percent. The distribution reflects modern audit practice: candidates need broad assurance judgment across governance, change, operations, resilience, security, privacy, and emerging technology.

CISA is both an exam and an experience-based professional certification. Passing the examination demonstrates knowledge, while the CISA certification requires qualifying professional experience and ongoing maintenance. It sits within the larger family of ISACA certifications, where neighboring credentials focus more directly on security management, risk, privacy engineering, governance, or advanced AI assurance. CISA’s distinctive question is whether information systems, processes, controls, and evidence provide reasonable assurance that organizational objectives are being achieved and risks are being managed.

Audit planning starts with objectives, risk, scope, independence, and reliable evidence

An effective audit begins before testing. The auditor needs to understand business objectives, the process or system under review, stakeholder concerns, applicable requirements, prior findings, material risks, and the purpose of the engagement. Scope should be broad enough to address the audit objective without becoming an unmanageable review of everything connected to technology. Risk-based planning directs limited assurance effort toward the areas most capable of affecting the organization.

Independence and professional judgment are central. Auditors should avoid owning the controls they later assess, disclose conflicts, protect confidential information, and maintain sufficient skepticism when evaluating management representations. Evidence should be relevant, reliable, and sufficient for the conclusion being drawn. Inquiry alone is weaker than corroborated evidence; a screenshot may show configuration at one moment but not prove sustained operation; a sample can support a population conclusion only when selection and testing are appropriate.

Candidates should be comfortable with sampling, analytical techniques, interviews, observation, inspection, reperformance, computer-assisted audit techniques, and data analytics. The exam is less about choosing one universal test than about selecting evidence that fits the objective and risk. Findings should describe condition, criteria, cause, consequence, and practical corrective action without exaggerating what the evidence can support.

Governance and management determine whether technology remains aligned and accountable

Auditors assess whether structures, policies, responsibilities, strategy, performance measures, architecture, and decision processes support enterprise objectives. Weak governance often appears as unclear ownership, inconsistent priorities, unmanaged exceptions, poor risk reporting, or technology investments disconnected from business value. The principles behind information security governance are especially relevant when evaluating accountability and oversight for security risk.

Frameworks can provide structure. COBIT 2019 distinguishes governance from management and organizes objectives, components, performance, and design considerations that an auditor may encounter. CISA candidates do not need to treat one framework as mandatory for every organization; they need to understand whether the chosen governance approach is appropriate, implemented, measured, and capable of producing reliable decisions.

Third-party governance is part of the same picture. Cloud providers, managed services, outsourced operations, software vendors, data processors, and critical suppliers can create concentration and dependency risk. Auditors should evaluate due diligence, contracts, service levels, security and privacy obligations, monitoring, right-to-audit arrangements, incident notification, continuity, subcontractors, and exit plans rather than assuming that outsourcing transfers accountability.

Acquisition and development audits follow the system lifecycle from need to controlled change

The acquisition, development, and implementation domain covers how organizations select, build, test, deploy, and change systems. Auditors should understand business cases, requirements, project governance, development methods, architecture, data conversion, testing, release, post-implementation review, and change control. Agile and DevOps practices can change the cadence of evidence, but they do not eliminate the need for authorization, traceability, testing, segregation of duties, and controlled promotion to production.

Requirements are an important control point because defects introduced early can become expensive or dangerous later. Auditors should examine whether security, privacy, resilience, accessibility, regulatory, data, and logging requirements are defined alongside functional requirements. They should also evaluate whether acceptance criteria and testing prove that the system meets those requirements rather than merely showing that the application runs.

Data migration deserves special attention. Completeness, accuracy, reconciliation, transformation logic, access, rollback, and retention can all affect integrity during conversion. An implementation that technically succeeds can still fail audit objectives if records are missing, balances do not reconcile, interfaces are incomplete, or old data remains accessible without a justified retention purpose.

Operations auditing focuses on reliability, controlled administration, and observable processes

Production systems depend on configuration management, job scheduling, monitoring, incident management, problem management, patching, capacity, backups, privileged administration, and service management. Auditors should determine whether these processes are designed appropriately and operating consistently. A written procedure provides weak assurance when logs, tickets, monitoring data, or samples show that actual practice differs.

Access administration is a recurring theme. Joiner-mover-leaver processes, privileged access, service accounts, periodic reviews, authentication, segregation of duties, and emergency access should be examined in the context of business roles and system sensitivity. The auditor should consider both preventive controls and detective evidence capable of revealing misuse or configuration drift.

Automation can strengthen operations when it produces repeatable configurations and evidence, but it can also propagate mistakes rapidly. Auditors should understand version control, approval, testing, deployment pipelines, infrastructure automation, and monitoring sufficiently to evaluate whether automated processes are controlled. The objective is assurance over the process, not a preference for manual or automated execution.

Business resilience requires evidence that recovery objectives can actually be met

Resilience auditing examines business continuity, disaster recovery, backup, redundancy, dependencies, crisis communication, alternate processing, supplier continuity, and testing. Recovery time objectives and recovery point objectives should be derived from business impact rather than copied from technology defaults. Critical processes need dependencies mapped across applications, identities, networks, facilities, people, data, and vendors.

A recovery plan that has never been exercised provides limited assurance. Tests should be designed around credible scenarios, document results, identify gaps, and track corrective action. The broader practice of disaster recovery planning illustrates why backups alone are insufficient: organizations must know whether systems can be restored in the required sequence, whether data is usable, whether alternate communication works, and whether teams can operate under degraded conditions.

Cyber incidents increasingly connect resilience and security. Ransomware, destructive attacks, cloud outages, identity compromise, and supplier failures may affect availability and integrity at the same time. Auditors should evaluate immutable or protected backups where appropriate, recovery access, clean restoration environments, dependency testing, and whether incident response and continuity plans work together.

Protection of information assets combines security architecture, operations, and control assurance

The largest CISA domains include security because information assets need confidentiality, integrity, availability, authenticity, accountability, and appropriate use. Candidates should understand identity and access management, network security, endpoint protection, cryptography, vulnerability management, monitoring, physical security, secure configuration, incident response, and data protection well enough to assess control design and evidence.

Auditors should avoid equating the presence of a product with an effective control. A firewall can be poorly configured, multifactor authentication can exclude important accounts, encryption can use weak key practices, and vulnerability scanners can generate findings that remain unremediated. Assurance depends on configuration, scope, monitoring, ownership, exception handling, and evidence of sustained operation.

Security testing also has limits. Penetration tests, vulnerability assessments, configuration reviews, code analysis, and red-team exercises answer different questions. Candidates should understand when each technique is useful, how scope and authorization matter, and why findings need risk-based remediation and follow-up rather than becoming isolated technical reports.

Privacy and data governance now form a visible part of information-systems assurance

Auditors increasingly evaluate data inventories, classification, purpose, retention, consent or other processing bases, access, transfers, third parties, individual rights, and privacy-by-design practices. The topic of data privacy and compliance in CISA reflects how assurance has expanded beyond traditional confidentiality controls. A privacy audit may need to trace information through applications, analytics, backups, logs, processors, and deletion workflows.

Classification is a practical bridge between governance and technical control. The principles of data classification help auditors ask whether sensitive information receives handling appropriate to its value and obligations. They should verify not only that labels exist but that access, encryption, retention, monitoring, sharing, and disposal reflect those labels.

Data quality and integrity matter as well. An organization can make harmful decisions from inaccurate data even when unauthorized access never occurs. Auditors should consider validation, reconciliation, lineage, change controls, master data, interface errors, and monitoring when the reliability of information affects reporting or business decisions.

Cloud and emerging technology change the evidence model without removing accountability

Cloud computing redistributes responsibility across customer and provider. Auditors should understand service models, shared responsibility, identity, configuration, logging, network controls, encryption, data location, resilience, and provider assurance. The Certificate of Cloud Auditing Knowledge provides a more specialized cloud-assurance path, while CISA expects candidates to incorporate cloud into broader audit judgment.

Artificial intelligence introduces additional questions about training and input data, model change, bias, explainability, human oversight, provider dependency, security, privacy, monitoring, and acceptable use. Experienced CISA holders who move deeply into AI assurance may encounter Advanced in AI Audit. On the CISA exam, the important skill is applying audit principles to emerging technology rather than assuming new systems are exempt from governance, evidence, change control, and risk management.

New technology can also change audit techniques. Continuous control monitoring, analytics, API-based evidence collection, automated configuration review, and AI-assisted analysis may improve coverage, but the auditor remains responsible for validating data completeness, logic, exceptions, and conclusions. Automation can increase assurance only when the method itself is controlled and understood.

CISA preparation should practice defensible assurance decisions across the whole enterprise

The exam rewards candidates who think like auditors. When several answers are technically possible, ask what evidence is needed, who owns the risk, whether independence is preserved, and which step should logically occur first. Auditors usually establish objectives and understand risk before testing; they obtain sufficient evidence before concluding; and they communicate findings through accountable channels rather than fixing management’s controls themselves.

Passing the exam is not the same as holding the certification. ISACA currently requires qualifying professional experience for certification and ongoing continuing professional education for maintenance. Candidates should verify the latest application, waiver, ethics, and maintenance requirements directly with ISACA when planning their path.

A strong study plan should cross domain boundaries. Take a cloud migration, ransomware event, ERP implementation, privacy initiative, or third-party service and ask how it would be governed, acquired, operated, protected, recovered, audited, and reported. That integrated view matches real assurance work and prevents the five domains from becoming disconnected memorization lists.