CISA (Certified Information Systems Auditor): Requirements, Exam, Cost, and Professional Value

Table of Contents

1. What Is CISA?
2. CISA at a Glance
3. Who Awards and Oversees the Credential?
4. When and Why Was the Credential Created?
5. Who Pursues CISA, and Where Is It Used?
6. What Knowledge and Skills Does It Cover?
7. What Are the Eligibility Requirements?
8. How Do You Earn CISA?
9. How Long Does It Take, and How Do Candidates Prepare?
10. How Much Does CISA Cost?
11. How Do Holders Maintain CISA?
12. What Is Its Professional Value, and What Are Its Limitations?
13. What Should Employers and Clients Infer From It?
14. How Does CISA Compare With Related Credentials?
15. How Can You Verify CISA and Use Its Letters Correctly?
16. Frequently Asked Questions
17. Official Resources and Recent Changes

1. What Is CISA?

CISA stands for Certified Information Systems Auditor, a professional certification awarded by ISACA. It recognizes knowledge and qualifying experience in auditing information systems, evaluating technology controls, and assessing risks associated with organizational technology. Its central perspective is assurance: determining whether systems and controls protect information, support business objectives, and operate as intended.

Earning CISA requires passing an examination, satisfying an experience requirement with any approved substitutions, submitting an application, and accepting professional ethics, auditing standards, and continuing-education obligations. Passing the examination alone does not confer certification.

For hiring purposes, CISA should be interpreted as evidence of an assessed knowledge base and an accepted professional-experience record, not proof of expertise in every technology or industry. The abbreviation here does not refer to the U.S. Cybersecurity and Infrastructure Security Agency, which also uses CISA.

2. CISA at a Glance

Full name: Certified Information Systems Auditor.
Abbreviation: CISA.
Credential type: Individual professional certification.
Awarding organization: ISACA.
Current status: Active.

Official website: ISACA’s CISA credential page.

First introduced: 1978.
Professional focus: Information systems audit, controls, assurance, and security.
Intended career stage: Professionals building or demonstrating relevant experience, rather than complete beginners.
Geographic scope: International, with a common ISACA credential rather than separate national licenses.

Main eligibility requirement: Five years of qualifying experience, subject to approved substitutions; at least two years must remain relevant practical experience.
Assessment: One four-hour examination with 150 multiple-choice questions.

Indicative initial cost: In September 2026, US$625 for an existing member or US$810 for a nonmember, covering one examination attempt and the application fee, excluding preparation and other expenses.
Maintenance: At least 20 continuing professional education hours annually and 120 over three years, plus annual fees.
Verification: ISACA’s certification verification tool, using certification number and surname.

3. Who Awards and Oversees the Credential?

ISACA owns and awards CISA. It establishes certification requirements and updates the examination framework using practitioner research and subject-matter expertise. PSI administers computer-based examinations, including testing-center and remotely proctored delivery. A training provider can prepare a candidate, but it does not award CISA.

The ANSI National Accreditation Board lists ISACA’s CISA program within its ISO/IEC 17024 personnel-certification accreditation. This concerns the certification body’s processes for certifying people. It is not accreditation of every holder’s employer, consulting practice, or work product.

ISACA also administers ethics complaints and certification appeals. Its ethical requirements address objectivity, confidentiality, professional care, competence, and disclosure of significant findings. Misconduct can lead to investigation and disciplinary action. Candidates and holders can request reconsideration of specified certification decisions through ISACA’s appeals process.

4. When and Why Was the Credential Created?

CISA emerged as organizations became increasingly dependent on computerized records and auditors needed a distinct body of knowledge for examining automated systems. ISACA’s institutional history describes the development of technology-audit knowledge, control objectives, and professional standards alongside that shift.

• 1978: ISACA dates the CISA program’s inception to this year.
• 1981: The first CISA examinations followed, distinguishing the program’s creation from the beginning of examination delivery.
• 2017: CISA moved into computer-based testing, replacing the earlier paper-based examination model.
• August 1, 2024: An updated examination outline took effect, retaining five domains while refreshing coverage of emerging technology, risk, security, and audit practices.

The continuity is important: CISA remains an audit-and-control credential even as the systems being audited change. Its expansion into contemporary technology risks should not be interpreted as conversion into a hands-on security engineering certification. That distinction follows from its assessment structure and audit-focused framework.

5. Who Pursues CISA, and Where Is It Used?

CISA’s intended audience includes information systems auditors, technology-control professionals, assurance practitioners, and security professionals whose responsibilities involve evaluating controls. It can also suit an experienced financial or operational auditor moving into technology assurance, provided the person develops qualifying technology-related experience.

Documented employer use extends beyond the issuer’s description. A Citi senior audit manager vacancy posted on July 16, 2026, included CISA among relevant credentials for AI governance and risk auditing. The role separately required AI knowledge, financial-services understanding, management experience, and communication skills. This illustrates both the credential’s relevance in banking and its limits as a hiring shortcut.

A 2025 U.S. Postal Service Office of Inspector General technology-audit leadership vacancy likewise accepted CISA among several possible credentials, alongside substantial specialized experience. This is evidence of use in public-sector assurance, not a rule that all government technology auditors must hold CISA.

For project planning, useful potential applications include evaluating access controls, reviewing technology changes, assessing outsourced-service controls, and examining recovery arrangements. In a manufacturing assignment, for example, an auditor might examine ERP access and production-system change controls; in a technology-services business, the emphasis might be customer-data protection and supplier oversight. These are illustrative applications of the syllabus, not evidence that every holder has delivered such work.

6. What Knowledge and Skills Does It Cover?

The current examination uses five domains. The percentages describe examination coverage, not the proportion of a holder’s professional experience or a guaranteed level of practical proficiency.

• Information Systems Auditing Process, 18%: Risk-based planning, evidence, sampling, analytics, reporting, and audit quality. This supports deciding what to test and whether findings are sufficiently substantiated.
• Governance and Management of IT, 18%: Technology governance, policies, risk management, vendors, privacy principles, and performance oversight. This supports evaluating accountability and alignment with business objectives.
• Information Systems Acquisition, Development and Implementation, 12%: Project controls, development methods, testing, migration, and post-implementation review. This supports assessing whether a new or changed system is ready for use.
• Information Systems Operations and Business Resilience, 26%: Operational controls, changes, incidents, backups, continuity, and disaster recovery. This supports evaluating service reliability and recovery readiness.
• Protection of Information Assets, 26%: Access, network and endpoint security, encryption, cloud environments, monitoring, and incident response. This supports assessing safeguards rather than assuming their presence establishes effectiveness.

Applied capabilities

Illustrative assignments include determining whether an access review addresses inappropriate privileges, evaluating evidence that a migration preserved important records, and examining whether recovery testing supports management’s stated recovery objectives. These examples translate syllabus topics into potential work; they are not additional assessments performed during certification.

Boundaries

The assessment is a multiple-choice examination, not an observed audit engagement or engineering laboratory. Employers should therefore test practical abilities separately, including extracting evidence from systems, using analytics tools, writing defensible findings, and explaining technical risk to nontechnical decision-makers. Neither examination breadth nor a passing score establishes product-specific implementation skill.

7. What Are the Eligibility Requirements?

Examination eligibility and certification eligibility are different. Candidates may take the examination before meeting the experience requirement. To receive CISA, they must establish qualifying experience earned within the ten years preceding their application and apply within five years after passing.

The baseline is five years of professional information systems auditing, control, or security experience. Approved substitutions can reduce that requirement by at most three years, leaving at least two years of experience within CISA’s practice areas. A degree is not compulsory.

Published substitution routes include:

• One year for an associate degree.
• Two years for a bachelor’s, master’s, or doctoral degree in any field.
• Three years for a master’s degree in information systems or a related field.
• Two years for full Chartered Institute of Management Accountants certification or Association of Chartered Certified Accountants member status.
• Up to one year for qualifying general information systems or general audit work outside the experience already claimed toward the core requirement.

These are alternatives and controlled substitutions, not credits to add together without restriction. Applicants must document the applicable route and respect the overall three-year ceiling. For example, a two-year education substitution still leaves three years to satisfy through qualifying experience and any permitted additional substitution.

Plan to identify a supervisor or manager who can verify the claimed work. A job title alone is less useful than accurate dates and a clear description of relevant responsibilities. Applicants also accept ethics, continuing-education, and information systems auditing standards obligations.

8. How Do You Earn CISA?

Step 1: Check the path to the final award

Before paying, map previous roles to the practice areas, identify potential verifiers, and gather education or professional-qualification documentation. This prevents a common planning mistake: treating examination readiness as equivalent to readiness for certification.

Step 2: Register and schedule

Create an ISACA account with a name matching your identification, purchase examination registration, and schedule through PSI. Delivery is available at authorized testing centers or through remote proctoring. New registrations have a six-month examination eligibility period.

Step 3: Take the examination

The closed-book examination contains 150 multiple-choice questions and lasts four hours. Languages include English, Simplified Chinese, French, German, Japanese, Korean, and Spanish. The passing score is 450 on a 200-to-800 scale, not a percentage-correct cutoff.

Step 4: Receive results and apply

A preliminary result appears after testing; official results normally arrive within ten working days. Once official results are released, pay the US$50 application fee and submit the experience application and supporting verification. ISACA’s approval, not the preliminary pass message, completes the award process.

Retakes and deadlines

ISACA permits four attempts in a rolling twelve-month period. After failures, the waiting periods are 30 days, then 90 days, then 90 days. Each attempt requires payment. This rolling limit is separate from a registration’s eligibility period.

Keep three milestones separate in professional communications: completing training, passing the examination, and receiving certification. Only the final award supports a claim to be CISA certified. An examination passer who still needs experience should describe that narrower achievement accurately.

9. How Long Does It Take, and How Do Candidates Prepare?

Prerequisite-building time: For someone without relevant experience, the main constraint is accumulating qualifying work, not studying. Approved substitutions can shorten the experience path but do not eliminate it.

Preparation time: There is no useful universal study-hour estimate. An experienced technology auditor may need targeted revision; a financial auditor may need more work on infrastructure, security, and resilience. Start with a diagnostic assessment, identify weak areas, and set a schedule that fits the registration deadline.

Official resources: ISACA offers the CISA Review Manual, online review instruction, and its Questions, Answers & Explanations database. The database provides practice questions, answer rationales, domain-level feedback, and timed practice examinations. These are preparation tools, not substitutes for the actual assessment.

Administrative time: Leave room after the examination for official results, verifier responses, and application review. Do not promise an employer a certification date that depends on someone else’s verification or an unresolved waiver decision.

10. How Much Does CISA Cost?

The following are listed U.S.-dollar prices in September 2026. Taxes, currency conversion, travel, and optional learning expenses can change the amount a candidate actually pays.

• Examination: US$575 for ISACA members or US$760 for nonmembers.
• Certification application: US$50.
• First-attempt examination plus application: US$625 for an existing member or US$810 for a nonmember.

Membership is an additional purchase. Standard professional membership is US$145 annually plus local chapter dues. Someone joining solely for discounted examination pricing should compare the complete checkout total, rather than treating US$625 as an all-inclusive new-member price.

Optional preparation: The official six-month Questions, Answers & Explanations database is listed at US$299 for members or US$399 for nonmembers. Thus, a nonmember budgeting for one examination, the application, and this database would allow US$1,209 before tax and other expenses. Review manuals and instruction are separate choices.

Scheduling and additional attempts: Timely rescheduling is free at least 48 hours before the appointment. One six-month eligibility extension costs US$75 under the candidate guide’s conditions. Retakes require another examination payment.

Ongoing costs: Annual certification maintenance is US$45 for members or US$85 for nonmembers, separate from membership dues and any paid continuing education.

11. How Do Holders Maintain CISA?

Active holders must earn and report at least 20 continuing professional education hours annually and 120 over each three-year cycle, pay annual maintenance fees, and comply with ethics and auditing standards. Twenty hours every year totals only 60, so meeting the annual minimum alone does not satisfy the cycle requirement.

Qualifying learning must support relevant professional knowledge or capability under the applicable policy. Holders selected for a CPE audit must substantiate their claims. For the current cycle rules, supporting records should be retained for twelve months after the three-year cycle ends.

Announced change: Beginning January 1, 2027, at least 90 of the 120 cycle hours must align with the certification’s examination content; up to 30 may cover other professional development, such as leadership or communication. ISACA states that this change does not alter the 2026 reporting cycle.

ISACA provides approved Non-Practicing and Retired statuses. Non-Practicing status generally retains an annual fee and has return-to-active requirements. Retired status removes CPE and fee obligations but is permanent unless the individual retakes the examination and reapplies. Neither should be presented as ordinary active status.

Failure to maintain the credential can result in revocation. Reinstatement may require an approved appeal, supporting CPE evidence, outstanding fees, and a reinstatement charge. If an appeal is unsuccessful, examination and application requirements apply again.

12. What Is Its Professional Value, and What Are Its Limitations?

CISA can make a technology-assurance background easier for an employer or client to interpret. It combines an examination with experience verification and ongoing obligations, rather than merely recording course attendance. Its usefulness is greatest when the assignment requires structured evaluation of technology risks and controls. This is a professional interpretation of the credential’s design, not a guarantee of performance.

Employer recognition is visible in specific hiring requirements. Citi’s 2026 AI-audit vacancy and the Postal Service Inspector General’s 2025 technology-audit leadership vacancy both included CISA among acceptable credentials. Both also required substantial capabilities beyond certification. A credential may help a candidate meet a screening criterion without resolving whether that person can perform the entire role.

ISACA reported in July 2025 that more than 219,000 professionals had earned CISA since inception. That is a cumulative award count, not a count of currently active holders or evidence of an individual salary premium.

For career decisions, evaluate whether the next intended role actually involves assurance work. If the goal is security engineering, application development, or technology delivery leadership, CISA may complement experience but does not directly demonstrate those delivery skills. Likewise, a salary associated with a senior audit vacancy prices the whole combination of responsibility, experience, geography, and expertise, not the letters alone.

13. What Should Employers and Clients Infer From It?

What the credential establishes

An active CISA has satisfied ISACA’s examination and accepted experience pathway and remains subject to continuing-development and conduct requirements. Do not infer that every holder completed five full years specifically as an IT auditor, because approved substitutions and other qualifying work are permitted.

What still requires evaluation

Assess industry knowledge, audit independence, evidence handling, analytical skill, report quality, stakeholder management, and delivery at the proposed project’s scale. Ask which systems the individual personally examined and distinguish work they performed from work their team performed. CISA is an individual qualification, not authorization or accreditation of a consulting firm.

Where it matters in staffing

Its audit-and-control perspective can be relevant to a cyber risk assessment, particularly the workstream examining whether controls address material risks. This is an application of its assessed knowledge, not a claim that CISA alone qualifies someone to lead the whole engagement.

Evidence to request

Request sanitized examples of a risk-and-control matrix, test procedure, evidence index, audit finding, and remediation follow-up. Ask the candidate to explain their personal contribution and the reasoning behind conclusions. Do not request confidential client records or proprietary examination content.

Three questions to ask

1. An ERP access review is signed off, but privileged users can approve their own changes. How would you evaluate the control? A useful answer distinguishes documented approval from effectiveness and addresses incompatible privileges, evidence, and compensating controls.
2. How would you test migration completeness and accuracy before go-live, and what would justify delaying release? Look for reconciliations, exception investigation, control ownership, and a risk-based explanation of unresolved issues.
3. A supplier reports successful backups but has not demonstrated restoration. What evidence would you request? Look for actual restoration testing, dependencies, recovery objectives, and a clear explanation of why backup completion alone is insufficient.

14. How Does CISA Compare With Related Credentials?

• CIA, Certified Internal Auditor: The Institute of Internal Auditors’ credential covers internal auditing more broadly, including operational and organizational assurance. Its traditional route has three examinations and education-dependent experience requirements, including two years for bachelor’s-degree holders or one for master’s-degree holders. Active CISA holders can pursue a separate one-part CIA Challenge Exam route. CIA is a complement or broader-audit alternative, not an automatic award for holding CISA.
• CISM, Certified Information Security Manager: ISACA’s security-management credential emphasizes governing and managing an information security program. It requires an examination and documented qualifying experience, with a five-year baseline. It is more directly aligned with security-management responsibilities than independent technology assurance. Treat it as a complement when a role combines oversight and assurance, not a higher grade of CISA.
• CISSP, Certified Information Systems Security Professional: ISC2’s credential addresses broad security practice. Its experience framework generally requires five years across at least two domains, subject to an approved one-year reduction. It is an alternative or complement for security-focused careers; its breadth does not replace evidence of audit methodology and engagement experience.
• CRISC, Certified in Risk and Information Systems Control: ISACA’s risk-and-control credential requires an examination and three years of relevant experience. It fits professionals assessing and managing technology risk, while CISA places greater emphasis on evaluating systems and controls through an audit perspective. Neither is an automatic prerequisite for the other.

A separate specialization path is ISACA’s Advanced in AI Audit, or AAIA. An active CISA is one of its accepted prerequisite designations; additional assessment is required.

15. How Can You Verify CISA and Use Its Letters Correctly?

Use ISACA’s official certification verification function. Select CISA and enter the holder’s certification number and surname exactly as recorded in their ISACA profile. If necessary, submit a verification request to ISACA with the individual’s signed consent.

Check both identity and current status. ISACA distinguishes the three-year cycle date shown on a certificate from the annual expiration and current status reflected by its verification tool. A certificate that appears unexpired does not override failure to meet annual maintenance requirements.

If verification fails, first check the number, spelling, and name history with the individual. The tool is a targeted lookup, not a general name-search directory. An unsuccessful entry should prompt clarification rather than an immediate allegation of misrepresentation.

ISACA permits holders to place CISA after their name, for example, “Alex Morgan, CISA.” It does not permit unrestricted individual use of the CISA certification logo on promotional materials, because that can imply organizational endorsement.

Examination passers must not imply that they already hold full certification. Approved Associates should identify the separate Associate designation accurately. Non-Practicing and Retired holders should disclose their actual status; revoked holders may no longer present themselves as currently certified.

16. Frequently Asked Questions

Do I need an accounting or technology degree?

No degree is compulsory. The experience route allows candidates without a degree to qualify, while approved education substitutions can reduce the required work experience. A degree alone does not satisfy the full certification requirements.

Can I pass the examination before I have enough experience?

Yes. Examination eligibility does not require completing the certification experience requirement first. However, you must apply for certification within five years after passing and satisfy the experience rules before ISACA awards the credential.

Is CISA Associate the same as CISA?

No. CISA Associate is a separate designation for eligible examination passers who lack the experience for full certification. It requires active ISACA membership, has a US$25 application fee, and lasts up to four years, with no CPE requirement.

Does completing a CISA preparation course make me certified?

No. Training completion, examination success, and certification are separate milestones. A course can help build knowledge, but ISACA must still accept the examination result, experience application, and required commitments before awarding full CISA status.

Does CISA expire?

CISA requires ongoing maintenance rather than remaining automatically active for life. Annual obligations apply even within the three-year CPE cycle. Employers should verify current status rather than relying only on an old certificate or résumé entry.

17. Official Resources and Recent Changes

Official resources available: ISACA provides examination content outlines, candidate guides, application guidance, preparation materials, ethics policies, maintenance instructions, and verification tools. Use the material applicable to the examination and reporting period involved.

• July 10, 2025: ISACA announced CISA Associate, a distinct designation rather than a replacement for full CISA certification.
• April 16, 2026: Access periods for newly purchased examinations and specified digital preparation products moved from twelve months to six months. Check the expiration attached to an earlier purchase rather than assuming identical terms.
• January 1, 2027: The announced CPE revision introduces the 90-hour certification-aligned minimum and optional 30-hour broader professional-development allocation within the unchanged 120-hour cycle total. This is a future rule, not the 2026 requirement.

This profile is an independent Umbrex reference and is not issued or endorsed by the credential owner unless an explicit relationship is stated.