Academy · ISACA · 5 domains
CISA preparation: planning, evidence, sampling, and a finding that holds.
The audit credential. Five domains covering the audit process itself, IT governance, systems acquisition and development, operations and resilience, and the protection of information assets. Preparation follows ISACA’s published exam content outline — and spends most of its time on evidence, because that is what an audit conclusion rests on.
Instructor-led and arranged in a conversation, not bought from a page. Independent preparation — CyberWave is not an ISACA training partner. All five tracks
What it is
A method credential, not a technology one.
CISA examines whether you can plan an engagement, select a sample, gather evidence that supports a conclusion, and write a finding that survives being argued with by the person who owns the system. The technology across the five domains is examined through that lens — how you would audit it, not how you would build it.
- A screenshot produced on request
- Somebody senior confirming that it happens
- A policy stating that it should happen
- A report with no date and no named source
- A sample chosen because it was easy to reach
- A finding phrased so that nobody argues with it
- Sufficient, reliable, relevant and useful — four separate tests
- System-generated over asserted; re-performed over observed
- A control that operated, on a date, with a record of it
- A source you can trace and a population you can define
- A sample that actually supports the conclusion drawn from it
- Condition, criteria, cause, effect, recommendation
Who sits it, and what sent them.
Two of these four arrive from outside IT entirely, which is why the substitution rules matter more on this track than on any other.
- The financial auditor
“I have audited for years. Just not systems.”
Planning, sampling, evidence, findings and follow-up transfer directly — and part of that background may substitute against the five years.
Driving it: a change of practice
- The audited
“They asked for evidence and we lost a week to it.”
Understanding how an auditor plans, samples and concludes changes what you prepare and how you answer. It is the cheapest way to stop losing that week.
Driving it: next year’s fieldwork
- The assurance lead
“I design controls. Nobody taught me to test them.”
CISA formalises the method and supplies the vocabulary that external auditors, customers and insurers already use.
Driving it: a control testing programme
- The consultant
“They want assurance work, and they screened on letters.”
CISA is the credential that says you understand evidence. The five domains are what keep the engagement defensible once you have it.
Driving it: a tender
The exam outline
The five domains, and where the marks sit.
ISACA’s domains, in ISACA’s order. Weightings are shown as ranges because ISACA has revised them across job practice updates — the current exam content outline gives the single figure that applies to your exam, and reading it is the first hour of preparation.
| Domain | Share | What it covers |
|---|---|---|
| 01Information System Auditing Process | 18–21% | Planning: audit standards, guidelines and ethics, understanding the business process, types of control, risk-based audit planning, and the difference between an audit, a review and an assessment. Then execution — audit project management, sampling methodology, evidence collection techniques, data analytics, reporting and communication, and quality assurance over the audit itself. |
| 02Governance and Management of IT | 17–18% | IT governance: frameworks, standards, policies and procedures, organisational structure, enterprise architecture, enterprise risk management, maturity models, and the laws and industry requirements that apply. Then IT management — resource management, acquiring and managing service providers, performance monitoring and reporting, and quality management. |
| 03Information Systems Acquisition, Development and Implementation | ≈12% | The smallest domain. Project governance and management, business case and feasibility analysis, development methodologies, identifying and designing controls, testing methodologies, configuration and release management, migration and data conversion, and the post-implementation review nobody schedules until an auditor asks for it. |
| 04Information Systems Operations and Business Resilience | 23–26% | One of the two largest. Technology components and IT asset management, job scheduling, system interfaces, end-user computing, data governance, performance management, problem and incident management, change, configuration, release and patch management, service level management, database management — then business impact analysis, resilience, backup and restoration, continuity plans and disaster recovery. |
| 05Protection of Information Assets | 26–27% | The other large one. Security frameworks and standards, privacy principles, physical and environmental controls, identity and access management, network and endpoint security, data classification, encryption and public key infrastructure, virtualised environments, mobile and wireless, awareness programmes, attack methods, security testing and monitoring techniques, incident response, and evidence collection and forensics. |
The shape is what matters for planning: operations and resilience plus protection of information assets take roughly half the paper between them, and the audit process domain is the lens the other four are examined through.
A finding is only as strong as the evidence behind it and the sentence it is written in.
A screenshot somebody produced on request, a system-generated report, an interview note and a re-performed control all carry different weight — and a conclusion resting on the wrong one is a finding that gets withdrawn.
Eligibility
Check the substitutions before you assume you are years away.
CISA asks for five years of information systems audit, control, assurance or security work — but it publishes the most generous substitution rules of the four ISACA credentials on this site, and most candidates qualify earlier than they expected.
The six rules, as ISACA publishes them
- 01
Five years of audit, control or security work
ISACA requires five years of professional information systems auditing, control, assurance or security work experience. “Control” is broader than people assume — designing or operating controls counts, not only testing somebody else’s.
- 02
Up to three years can be substituted
CISA has the most generous substitution rules of the four. Degrees, certain professional accounting memberships, a relevant master’s degree, and general information systems or non-IS audit experience each offset a defined amount, to a published maximum. Read ISACA’s current list against your own record — most candidates qualify sooner than they thought.
- 03
Financial audit experience travels
If you have audited anything professionally, the planning, sampling, evidence and findings discipline transfers directly, and ISACA’s substitutions recognise part of it. The new material is the technology, not the method.
- 04
Sit first, apply later
You may sit the exam before the experience is complete and apply once it is, within the window ISACA sets after passing — currently five years. Experience must have been gained within the preceding ten years, and is verified independently on application.
- 05
The standards commitment is ongoing
CISA carries an obligation the others do not phrase as sharply: adherence to ISACA’s Code of Professional Ethics and to its Information Systems Auditing Standards. The credential is a commitment to a method, not only a record of passing an exam.
- 06
Upkeep is annual and cumulative
Continuing professional education — an annual minimum of 20 hours and 120 hours across a three-year cycle — plus an annual maintenance fee paid to ISACA. Missing the annual minimum is the usual way a credential is lost.
The format
How the exam is actually delivered.
A linear multiple-choice exam you can move back and forth through. Confirm the current numbers against ISACA’s published exam information before you plan, because a certifying body can change them.
As ISACA currently publishes it, the exam is 150 multiple-choice questions in a four-hour sitting, at a test centre or by remote proctoring, on a date you book with ISACA. Results are reported on a scaled range of 200 to 800 with 450 as the passing score. That is a scaled score rather than a percentage, so it does not translate into “how many questions did I get right”.
A preliminary result appears at the end of the sitting and the official one follows, with a domain breakdown. Questions are scenario-led: a short situation, four defensible-looking options, and one that an auditor following the standards would choose. The recurring pattern is that the best answer respects independence, follows the plan, and rests on evidence you could actually produce.
The question style
Look for what the question is really asking: the auditor’s FIRST step, the BEST evidence, the GREATEST risk. Those qualifiers are doing the work, and they are the difference between two answers that are both true.
What it does not test
No laboratory, no configuration, no code. It also does not test how to fix what you find — the recommendation is examined, the remediation is not. Independence is part of the material for that reason.
Preparation
What preparation covers, in this order.
Method first, because every later domain is examined through it, and the written finding last, because that is the part that has to survive a meeting. Scope and pace are agreed with you rather than fixed here.
- 01
Learn the method before the technology
Domain 1 is the lens for the whole exam. Risk-based planning, control types, sufficient and reliable evidence, sampling, and the audit trail behind a conclusion. Every other domain is then examined as “how would you audit this” rather than “how does this work”.
- 02
Get precise about evidence
Sufficient, reliable, relevant, useful — these are not synonyms on this exam. A screenshot, a system-generated report, an interview note and a re-performance carry different weight, and a large share of the marks turns on knowing which one a conclusion can rest on.
- 03
Spend the time where the marks are
Operations and resilience, and protection of information assets, together account for around half the paper. Preparation is weighted accordingly rather than giving five domains equal time and a fifth of the effort to the smallest.
- 04
Practise sampling and analytics properly
Statistical versus non-statistical, attribute versus variable, how a population is defined, and what a sample can and cannot support. Candidates from a non-audit background lose more marks here than anywhere else, and it is entirely learnable material.
- 05
Write findings that survive being argued with
Condition, criteria, cause, effect, recommendation. The exam tests the reasoning; the job tests whether the system owner can dismantle it in a meeting. Practising the written form improves both.
- 06
Plan the application and the upkeep
Work out which substitutions you can claim, who will verify your experience, and where the first 20 hours of continuing education will come from — before the exam rather than after it.
Back at work
Where the audit method meets the evidence library.
Academy is not product training and Sentinel is not exam preparation. The overlap is the vocabulary — and on CISA the vocabulary is unusually practical.
A CISA candidate learns what sufficient and reliable evidence means. An evidence library is where that judgement gets applied to your own penetration test report, your own training records, your own configuration exports — each with a status, an owner and an expiry date, still linked to the controls they support. Domain 1 teaches control testing; an audit engagement workspace is where a test has a scope, a sample, a result and a finding attached to it rather than living in a consultant’s document nobody can trace.
Neither depends on the other. You can take the track without opening the product, and nothing in Sentinel requires a credential. Sentinel organises readiness and evidence — it does not issue audit opinions, and it does not certify anything.
41 items accepted, 1 expired and 1 missing — the two states an auditor finds first. From the example workspace used across this site; Northstar Manufacturing Ltd. is fictional.
Straight answers
What we will not tell you about CISA.
No pass rate, no partner badge, no promise about the result. Where something has not been established, it does not appear on the page.
CISA questions people ask before they commit
I audit financial statements, not systems. Is CISA realistic?
CISA or CRISC?
Why are the domain weightings shown as ranges?
Is CyberWave an ISACA training partner?
What does preparation cost, and when does it run?
Does holding CISA let me certify an organisation as compliant?
The exam ends. The evidence request does not.
Somebody will ask for proof of a control next quarter, and the answer will be as good as what is filed and dated. That part is what Sentinel is for.
No credit card required
- Published pricing on every standard plan
- No credit card required for the trial
- No automatic charge when a trial ends
- Tenant-isolated architecture, data stored in Canada
- Clear data-processing terms
- No compliance guarantee — human judgement still required