Certified Information Systems Auditor credential artwork

Certified Information Systems Auditor (CISA)

Validates knowledge of IT auditing, covering audit processes, IT governance, systems development, operations, resilience and information asset protection.

Summary

CISA is ISACA's certification for IT audit, control and assurance, for people in IT audit, internal audit, IT risk and compliance. Its exam covers the audit process, IT governance, operations and resilience, and protecting information assets, and Big 4 technology risk roles list it.

Good fit if

  • You work in IT audit, internal audit, IT risk or compliance
  • Your target roles, such as Big 4 technology risk, list CISA
  • You can document IS audit or security work, or will build it

Look elsewhere if

  • You want to run a security program: CISM
  • You focus on IT risk assessment and response: CRISC
  • You want a general internal audit credential: CIA

Salary & jobs

Prerequisites

Experience required for certification

5 years of IS audit, control, assurance or security work

Required

At least 2 years must be direct work in the CISA domains, within the ten years before you apply. Waivers can replace up to 3 years in total.

Standard route5 years of qualifying work
Associate degree, IT Audit Fundamentals or CCAK1 year waived
Bachelor's or higher in any field, or full CIMA or ACCA membership2 years waived
Master's in information systems or a related field3 years waived
1 year of general IS or financial audit work1 year waived, combinable up to 3 in total

Verified experience and application

Required

A supervisor, manager, colleague or client verifies your work. Apply and pay the $50 application fee within five years of passing.

You can take the exam before you have the experience. ISACA members who pass without it can apply for the CISA Associate designation ($25, valid up to four years) while they build it.

Cost

USD · Non-member pricing
$760
$50
Members pay $575 for the exam. Membership costs $145 a year plus chapter dues. Each retake needs a new registration at the full fee. A six-month eligibility extension costs $75.

What holders say

Renewal

Keep CISA active each year with continuing education and an annual maintenance fee.

CPE each year
20 hours minimum
CPE over 3 years
120 hours
Annual maintenance
$45 member / $85 non-memberDue January 1. Reduced for a third ISACA certification.

CPE can count toward more than one ISACA certification when it is relevant to each. Keep records for 12 months after each three-year cycle in case you are selected for an audit.

ISACA CISA maintenance requirements ↗

Alternatives

Certified Information Security Manager credential artwork
CISM$810 required · Advanced

Security management, governance and program leadership.

Certified in Risk and Information Systems Control credential artwork
CRISC$810 required · Advanced

IT risk assessment, response and reporting.

Certified Internal Auditor credential artwork
CIA$1,515 required · Intermediate

Internal audit across the whole organization, not only IT.

Certified Information Systems Security Professional credential artwork
CISSP$884 required · Advanced

Broad security practice for architects and senior practitioners.

FAQ

What are the CISA requirements?

Pass the exam, then apply with five years of IS audit, control, assurance or security experience from the last ten years. Education and some credentials can waive up to three years. Apply within five years of passing.

Can I take the CISA exam without experience?

Yes. Anyone can register. You become certified once ISACA approves your experience application, which you can submit up to five years after passing.

What is a CISA Associate?

A designation for ISACA members who pass the exam but do not yet have the experience. It costs $25, needs active membership and lasts up to four years or until you become certified.

How much does CISA cost?

The non-member exam fee is $760 and the application fee is $50, so $810 in total. Members pay $575 for the exam. Study materials and the annual maintenance fee are extra.

How is the CISA exam scored?

Your result is a scaled score from 200 to 800, and you need 450 to pass. It is based on the total number of correct answers, not on each domain.

What is the CISA retake policy?

You can take the exam up to four times in a rolling 12 months. Wait 30 days after the first attempt and 90 days after the second and third. Each attempt needs a new registration.

Last updated October 2026