Overview
The CISA exam tests whether you can think like an IS auditor: plan risk-based audits, gather sufficient and reliable evidence, evaluate controls over IT governance, development, operations and information protection, and report findings that help management reduce risk. The 2024 job practice has five domains. Questions are scenario-based and ask for the BEST, MOST or FIRST action — so understanding the auditor's role, independence and the sequence of audit work matters as much as technical knowledge.
Exam domains and weightings
- D1 · 18%Information System Auditing Process
- D2 · 18%Governance and Management of IT
- D3 · 12%Information Systems Acquisition, Development and Implementation
- D4 · 26%Information Systems Operations and Business Resilience
- D5 · 26%Protection of Information Assets
Risk-based audit casework guide
For a complex case, keep the audit role, evidence quality and business risk visible at each decision point.
- 1
Clarify objective and scope
Identify the business service, audit criteria, risk question, boundaries, stakeholders and any prior involvement that could affect objectivity.
- 2
Prioritize risk
Understand inherent exposure, relevant changes and critical dependencies before choosing procedures and samples.
- 3
Obtain reliable evidence
Corroborate representations with current system records, observation, reperformance, external evidence or carefully designed samples.
- 4
Evaluate design and operation
Distinguish documented intent from actual operation; test exceptions, scope, timing, cause, impact and compensating controls.
- 5
Communicate a supported conclusion
Explain condition, criteria, cause and impact; leave management responsible for decisions and corrective action.
Evidence checklist
- Approved audit objective, criteria and scope
- Evidence provenance, date and population
- Sampling rationale and exceptions
- Risk-owner decisions and compensating controls
- Clear conclusion and tracked management actions
Common failure modes
- Taking over management’s go-live or remediation decision
- Relying on dashboards without validating evidence
- Testing a low-risk control while missing a changed critical path
- Treating one exception as systemic without assessing extent
Key concepts examiners test
Risk-based audit planning
Directing limited audit resources to the areas of greatest risk to enterprise objectives.
Detection risk
The risk that audit procedures fail to detect a material error — the only audit risk the auditor controls directly.
Audit evidence reliability
Independent, auditor-obtained and system-generated evidence is more reliable than auditee representations.
Independence
Prior advisory or operational involvement can impair objectivity; disclose it to audit management first.
Compensating controls
Controls that reduce risk when a primary control is missing or weak — always consider them before rating a finding.
Exam technique
- Read the last sentence first: is the question asking for the FIRST, BEST, MOST or PRIMARY answer?
- Answer as an auditor — you assess, report and recommend; you don't implement controls or make management decisions.
- When two answers look right, prefer the one that addresses risk to business objectives.
- Watch for sequencing: understand the process and assess risk before testing or concluding.
Study plan
- Weight your study time to the exam: Domains 4 and 5 together are over half the questions.
- Practise in timed blocks — the real exam has 150 questions in four hours (about 1.6 minutes each).
- After every practice test, review incorrect answers by domain and re-read the rationale, not just the right letter.
- Learn the sampling and evidence vocabulary precisely; small wording differences decide many answers.