What the CISA exam actually measures

The CISA is not a hands-on technical certification in the way a cloud admin or SOC analyst exam is. It validates that you can audit, assess, and report on information systems controls in a way that aligns with business risk, governance, regulatory expectations, and operational reality.

You are being tested on how an auditor thinks:

What should exist in a controlled environment
How to evaluate whether it exists and works
What evidence is sufficient and appropriate
How to communicate risk, control gaps, and recommendations

The current CISA exam is built around five domains:

Information System Auditing Process — 18%
Governance and Management of IT — 18%
Information Systems Acquisition, Development and Implementation — 12%
Information Systems Operations and Business Resilience — 26%
Protection of Information Assets — 26%

Those weights matter. If your study plan does not spend the most time on Domains 4 and 5, you are misallocating effort.

Expect scenario-heavy questions. ISACA likes questions where several answers seem plausible, and the difference is whether you understand:

the auditor’s role versus management’s role
preventive, detective, and corrective controls
design effectiveness versus operating effectiveness
what the best action is, not merely a technically possible one

This exam is for:

IT auditors
Internal auditors moving into technology risk
Security professionals who need governance and audit credibility
IT managers, compliance leads, and risk practitioners who work with auditors regularly

What makes CISA hard is not deep technical detail. It is the breadth and the need to answer from an ISACA control and assurance perspective, even when your real-world instinct says, "I would fix the system first." On the exam, you often assess, validate evidence, determine impact, and report before jumping to remediation.

Domain 1 and 2: audit method first, governance second

If you do not get the first two domains right, the rest of the exam feels slippery. These domains teach you how ISACA expects you to reason.

Domain 1 — Information System Auditing Process (18%)

This is the foundation. Study it early.

You need to be comfortable with the full audit lifecycle:

Risk-based audit planning
Defining scope, objectives, and criteria
Identifying key controls
Selecting sampling methods
Gathering sufficient, reliable, relevant, and useful evidence
Documenting workpapers
Reporting findings and following up on remediation

Focus hard on these exam themes:

Audit charter and independence
Distinction between auditing, consulting, and operational management
Compliance testing vs substantive testing
Computer-assisted audit techniques (CAATs)
Use of data analytics in audits
Materiality, risk, and sampling risk
Internal controls and control objectives
Fraud indicators and escalation paths

Know the audit evidence hierarchy in practical terms. For example:

Evidence generated independently is generally stronger than evidence produced by the process owner alone.
Reperformance and direct observation can be stronger than inquiry.
A system report is not automatically reliable unless you can assess the controls around the system generating it.

Specific concepts worth drilling:

Attribute sampling vs variable sampling
Statistical vs nonstatistical sampling
Walkthroughs, interviews, observation, inspection, reperformance
Segregation of duties (SoD) evaluation
Root cause, impact, recommendation, management response, and residual risk

Domain 2 — Governance and Management of IT (18%)

This domain tests whether you understand how IT should be directed and controlled at the enterprise level.

Core topics:

Enterprise governance of IT
IT strategy alignment with business objectives
Policies, standards, procedures, and guidelines
Organizational structure and accountability
Risk management and risk appetite
Performance monitoring and metrics
Third-party governance and vendor management
Quality assurance and quality management

Frameworks matter here. You do not need to memorize every publication, but you should know what each is for:

COBIT — governance and management objectives, control orientation, process capability, alignment with business goals
ITIL — service management concepts such as incident, problem, change, service level management
ISO/IEC 27001 and 27002 — information security management and control guidance
COSO Internal Control Framework — control environment, risk assessment, control activities, information and communication, monitoring
Risk IT and general enterprise risk concepts

Questions often test whether a control issue is really a governance failure. Examples:

No approved security policy? Governance issue.
Projects repeatedly miss objectives because business owners are not engaged? Governance and portfolio oversight issue.
Critical SaaS provider has no due diligence or ongoing monitoring? Third-party governance issue.

What to prioritize:

Who owns risk: management, not the auditor
Who approves policy: appropriate governance body or leadership, not technical staff alone
Who ensures alignment: steering committees, executive oversight, portfolio governance
What the auditor does: evaluate, report, recommend, follow up

A common trap: choosing the most technically detailed answer instead of the one that fixes the governance root cause.

Domain 3: projects, SDLC, and change without audit blind spots

This domain is only 12%, but it produces a lot of missed questions because people underestimate it.

You need to know how auditors assess whether systems are acquired, built, configured, tested, and deployed under proper control.

Information Systems Acquisition, Development and Implementation (12%)

Study these areas:

Business cases and feasibility analysis
Project governance and steering committees
Project management controls: scope, schedule, budget, quality, risk, resources
System development life cycle (SDLC)
Agile, iterative, and DevOps implications for control design
Requirements definition and traceability
System testing: unit, integration, system, user acceptance, regression
Data conversion and migration controls
Change management and release management
Post-implementation review

What CISA cares about is not whether you can run a project. It is whether you can identify where control failure leads to business risk.

Examples of high-value exam concepts:

User involvement early in requirements and acceptance testing reduces the risk of building the wrong solution.
Program changes should be authorized, tested, approved, and segregated before migration to production.
Emergency changes need control too: retrospective approval, logging, review, and evidence.
Source code access should be restricted; developers should not have uncontrolled production access.
Data migration reconciliation is essential. Record counts alone are rarely enough if financial or transactional integrity matters.

Be ready for older and newer delivery models. ISACA does not ignore modern environments.

You should understand how controls apply in:

Traditional waterfall projects
Agile product delivery
DevOps / CI/CD pipelines
Packaged software and ERP implementations
Cloud adoption and SaaS onboarding

Specific technologies and control points worth knowing:

Version control systems like Git and the need for branch protection, approvals, and audit trails
CI/CD tools such as Jenkins, GitHub Actions, GitLab CI, Azure DevOps — not in product-detail depth, but in control principle terms
Infrastructure as Code and why code review, segregation, and tested deployment matter
ERP configuration changes and transport controls in systems such as SAP or Oracle environments

A practical way to study this domain is to ask, for every SDLC phase:

What can go wrong?
What control should prevent or detect it?
What evidence would an auditor request?

That framing maps well to actual exam questions.

Domain 4: operations and resilience — the biggest scoring opportunity

At 26%, this is one of the two most important domains. It is broad. Treat it like three mini-domains: operations, service control, and continuity.

Information Systems Operations and Business Resilience (26%)

Operations and service support

You need a working audit understanding of day-to-day IT operations:

Job scheduling and batch processing
Incident management and escalation
Problem management and root cause analysis
Change, release, and configuration management
Service levels and performance monitoring
Capacity and availability management
End-user computing controls where relevant
Logging, monitoring, and event review

Know the difference between these operational records:

Incident: service disruption or degradation
Problem: underlying cause of recurring incidents
Change: controlled modification to environment
Configuration item: tracked component in the environment

ISACA likes to test whether weak operations create downstream risk. Example: poor configuration management makes recovery unreliable because nobody knows what should be restored.

Infrastructure and platform operations

Expect concepts around how systems are administered and safeguarded:

Network operations and segmentation basics
Server administration controls
Database administration controls
Patch and vulnerability management
Backup operations and media handling
Cloud operations shared responsibility
Capacity planning and performance baselining

You do not need packet-level expertise, but you should know the control intent behind technologies such as:

Firewalls
IDS/IPS
SIEM platforms
Virtualization platforms
Public cloud services like AWS, Azure, and Google Cloud from an audit/control perspective
Endpoint management and centralized logging

Cloud shows up increasingly in real-world audit scenarios. Study these control ideas:

Responsibility split between customer and provider
Importance of service organization reports like SOC 1, SOC 2, and where relevant SOC 3
Configuration baselines, IAM, logging, encryption, backup, and region/availability design
Contractual and compliance implications of data residency and provider lock-in

Business resilience and disaster recovery

This subdomain is consistently tested and very auditable.

Know these terms precisely:

BIA — Business Impact Analysis
RTO — Recovery Time Objective
RPO — Recovery Point Objective
MTD — Maximum Tolerable Downtime
BCP — Business Continuity Plan
DRP — Disaster Recovery Plan

What you need to understand:

BIA comes before recovery strategy because business requirements drive technical recovery design.
Critical systems need defined dependencies: people, facilities, network, vendors, applications, data.
Backups are not the same as recoverability. Restore testing matters.
Alternate sites differ: hot, warm, cold.
Resilience includes communications, crisis management, and third-party dependencies.

Common exam logic:

The best evidence that recovery works is a successful test, not merely documented procedures.
The most important missing element in continuity is often the one tied to business impact, not the technically elegant answer.
If a third party hosts a critical application, your resilience assessment must include the vendor’s recovery capability and contractual commitments.

This domain rewards practical experience. If you have not worked in operations, build examples from ITIL processes, backup workflows, and continuity plans until the terms feel operational rather than theoretical.

Domain 5: protection of information assets — security through an auditor’s lens

This is the other 26% domain. Security professionals often feel comfortable here, but they over-answer technically. CISA wants control effectiveness, governance linkage, and audit evidence.

Protection of Information Assets (26%)

Break your study into these clusters.

Information security governance and policy

Security strategy and alignment with enterprise objectives
Security policies, standards, baselines, and procedures
Data ownership and classification
Roles and responsibilities
Security awareness and training

You should know how data is categorized and handled:

Public
Internal
Confidential
Restricted / highly sensitive

And what controls follow from classification:

Encryption requirements
Access restrictions
Retention and disposal rules
Monitoring expectations

Identity and access management

This is heavily testable.

Study:

Authentication, authorization, and accounting
Least privilege
Need-to-know
Privileged access management (PAM)
Role-based access control
Joiner-mover-leaver process
Password controls and MFA
Periodic access recertification
Service account management
Segregation of duties in access design

Know the audit priorities:

Timely removal of terminated-user access
Monitoring of privileged activities
Independent approval for access provisioning
Strong controls over shared, generic, and emergency IDs

Network, endpoint, and application protection

You do not need to engineer these controls, but you must know what they do and how to audit them:

Firewalls, proxies, WAFs
IDS/IPS
EDR/XDR concepts
Secure configuration baselines
Endpoint hardening
Vulnerability scanning and remediation tracking
Secure software controls and application-layer security basics
Logging and alerting

Cryptography and data protection

Know the purpose and control implications of:

Encryption at rest and in transit
Key management
Digital signatures
Certificates and PKI basics
Hashing versus encryption
Tokenization where relevant

An auditor’s question is usually not “Which cipher is strongest?” It is more like:

Are keys protected and rotated?
Is encryption required by policy and classification?
Can management demonstrate control over certificate lifecycle?

Security incident response

Study the lifecycle:

Preparation
Detection and analysis
Containment
Eradication
Recovery
Lessons learned

Be ready for questions about:

Escalation criteria
Evidence preservation
Logging sufficiency
Coordination between security, legal, HR, privacy, and management
Post-incident control improvements

Physical and environmental controls

Do not neglect this just because it feels old-school. It still appears.

Know controls for:

Data center access
Visitor logs
CCTV and badges
Fire suppression
HVAC and environmental monitoring
Power conditioning and UPS
Media storage and disposal

The exam often uses these to test whether you understand layered protection and compensating controls.

How to study CISA without drowning in theory

CISA is broad enough that random reading fails. You need a weighted plan.

Recommended study order

Use this sequence:

Domain 1 — learn the audit mindset first
Domain 2 — governance gives context to every control question
Domain 5 — security controls are familiar to many candidates and score-rich
Domain 4 — large domain, operationally broad, needs time
Domain 3 — smaller but easier once you understand control thinking
Final mixed review across all domains

Timelines by experience level

If you already work in IT audit or internal audit

Plan 6 to 8 weeks, about 8 to 10 hours per week.

Week 1: Domain 1
Week 2: Domain 2
Week 3: Domain 5 part 1
Week 4: Domain 5 part 2 + mixed questions
Week 5: Domain 4 part 1
Week 6: Domain 4 part 2
Week 7: Domain 3 + weak areas
Week 8: Two full review cycles and timed practice

If you are in cybersecurity, infrastructure, or IT operations but not audit

Plan 10 to 12 weeks, about 8 to 12 hours per week.

Your biggest gap is usually:

audit evidence
sampling
reporting language
governance roles

Spend extra time in Domains 1 and 2 before leaning on your security background.

If you are coming from general IT, compliance, or risk with limited audit depth

Plan 12 to 16 weeks, about 10 to 12 hours per week.

You need repetition. Use a cycle of:

read a domain
make a one-page control summary
do 50 to 100 practice questions
review every missed question by concept, not by answer key alone

Weekly cadence that works

A practical rhythm:

2 sessions reading and note consolidation
2 sessions practice questions
1 session error review and flashcard cleanup

Do not just track scores. Track why you missed questions:

Didn’t know the term
Knew the term but chose a management action instead of an audit action
Misread “best,” “first,” “most important,” or “greatest risk”
Fell for a technically attractive but governance-weak answer

That error log is worth more than rereading chapters.

Resources that are actually worth your time

Use a small set of reliable resources. CISA has enough material already; resource sprawl hurts more than it helps.

Official ISACA material

Start here.

ISACA CISA Review Manual — the core reference aligned to the exam content outline
ISACA CISA Questions, Answers & Explanations Database (QAE) — one of the best ways to learn ISACA question style
ISACA Exam Candidate Guide — for logistics and current policy details
ISACA certification page for CISA — exam domains, eligibility, and updates

The QAE is especially useful because it teaches how ISACA distinguishes between similar-sounding answers.

Books and references

These are useful supplements, not replacements for the official manual:

CISA Certified Information Systems Auditor Study Guide by Mike Chapple and David Seidl
CISA Certified Information Systems Auditor All-in-One Exam Guide by Peter H. Gregory
IT Governance: An International Guide to Data Security and ISO27001/ISO27002 by Alan Calder if you need stronger governance context

Frameworks and standards you should read selectively

Read the overview and core concepts, not every page.

COBIT guidance from ISACA
ITIL 4 Foundation materials for service management concepts
NIST Cybersecurity Framework (CSF)
NIST SP 800-53 for control families
NIST SP 800-61 for incident response
ISO/IEC 27001 and 27002 summaries or official overviews
AICPA SOC reports guidance so you understand SOC 1 vs SOC 2 use cases

Practice questions

You have 1156 practice questions on Truekia. That is enough volume to build pattern recognition if you use them correctly.

Best approach:

First pass: untimed, domain by domain
Second pass: mixed sets of 25 to 50
Final phase: timed blocks with post-review

Do not memorize answer letters. For every missed item, write one sentence explaining the control principle. If you cannot explain it, you do not own it yet.

Labs?

CISA is not lab-centric, but practical exposure helps. If you lack hands-on context, use:

A basic AWS or Azure trial account to understand IAM, logging, backup, and shared responsibility
Demo environments or videos showing ServiceNow incident/change workflows
Any sandbox or recorded demo for SIEM, IAM, backup, or ticketing systems

The goal is not product mastery. It is understanding what evidence and control points look like in real systems.

Last-mile exam strategy for ISACA questions

A lot of CISA candidates know the content and still underperform because they answer like engineers or operators.

How to read CISA questions

Before looking at options, identify:

Is this asking for the first, best, most effective, or greatest risk?
Am I answering as an auditor, manager, or administrator?
Is the issue about governance, control design, control operation, or evidence sufficiency?

Answer selection rules that help

Prefer the answer that addresses the root cause, not the symptom.
Prefer the answer that reflects risk-based prioritization.
If two answers seem right, pick the one that best fits the auditor’s responsibility.
If one option is highly technical and another is broader but ties to governance or evidence, the broader control answer is often right.
Documentation alone is weaker than tested, monitored, and independently reviewed execution.

Time management

Do not get stuck proving to yourself that one hard question has a perfect answer. CISA includes ambiguous-feeling scenarios by design.

A practical approach:

Move steadily through the exam
Mark questions where two options remain plausible
Return later with a fresher read

Final week checklist

In the last 7 days, review these high-yield items:

Audit evidence quality and sampling basics
Management vs auditor responsibilities
COBIT, ITIL, ISO 27001, SOC report purpose
SDLC controls and change management
BIA, RTO, RPO, DR testing
IAM lifecycle, PAM, MFA, recertification
Incident response and logging
Preventive vs detective vs corrective controls

Exam-day reminders specific to ISACA style

Read every qualifier. One word changes the answer.
Do not import your company’s procedures if they conflict with standard audit principles.
If you are torn, ask: what would provide the best assurance with the least assumption?
Stay disciplined. The exam rewards judgment, not speed-reading.

If you prepare by domain weight, practice enough scenario questions, and train yourself to answer from the assurance and control perspective, CISA is very passable. Most failures come from one of three things: underestimating governance, neglecting operations and resilience, or answering as a technician instead of an auditor.