ISACA CISA: Cost, Exam Format, and the 5-Year Audit Experience Requirement

CISA is the credential IT audit work actually runs on, and its real gate is not the exam itself but the five years of hands-on audit, control, or security experience standing in front of it. This page covers what that experience requirement demands and how it can be partially waived, what the exam costs for members versus nonmembers, the five domains and their weights, and what nine years of renewal runs.

Who this cert is actually for

Auditing information systems for a living is the job this credential describes: IT auditors, control testers, and security professionals whose job is verifying that systems and processes actually do what they claim, not just building them. ISACA requires a minimum of five years of professional experience in IS/IT auditing, control, assurance, or security work, gained within the ten years preceding your application. Up to three of those five years can be waived: an associate’s degree counts for one year, a bachelor’s degree for two, and a master’s degree in information systems or a related field for three, and other substitutions exist for non-IS auditing work or time spent as a full-time university instructor in a related field. None of these waivers, alone or combined, can cut the requirement below two years of real experience.

If you have not yet banked the years, ISACA introduced the CISA Associate designation in 2025 specifically for this gap: pass the exam, pay a small fee, and hold Associate status for up to four years while you accumulate the experience needed to convert to full CISA. That mirrors the “pass now, certify later” pattern other advanced credentials use, and it exists so the exam pass does not go stale while your resume catches up.

Skip CISA if your work is security operations or engineering rather than audit and assurance; the exam’s scenario questions assume you have sat across the table from a system owner asking uncomfortable questions about controls, and that instinct is hard to fake. If governance and program-level security management is the better fit for your career than audit specifically, look at ISACA CISM instead, or build toward either with CompTIA Security+ first if you are still early career. CISA vs CISM lays out that fork in full.

What it costs all-in

ISACA prices the exam by membership status, and the gap is real money: $575 for ISACA members, $760 for nonmembers. This page uses $760, the nonmember figure, as the baseline cost, because most first-time candidates have not yet joined ISACA when they register. Whether joining first is worth it depends on ISACA’s current membership dues versus the $185 spread; run that math before you register rather than after. There is also a one-time application processing fee once you submit your experience documentation, separate from the exam fee itself, and exam registration fees are nonrefundable and nontransferable once paid.

Free and cheap prep exists here too. ISACA’s own exam content outline functions as the syllabus, and a well-reviewed CISA study guide or question bank in the $40 to $80 range covers most of what a self-study candidate needs beyond that. A realistic all-in self-study budget is $760 for the nonmember voucher plus $50 to $100 in prep materials, before any membership dues. Set that number against every other credential this site tracks on the ROI Index.

The exam itself

The exam is 150 multiple-choice questions over four hours, a fixed question count rather than a computerized-adaptive range, so every candidate answers the same number of items. A passing result is a scaled score of 450 out of a possible 200-to-800 range, and ISACA does not publish a pass rate, so treat any specific percentage you see in prep forums as an estimate, not an official figure.

Five domains make up the current job practice, updated by ISACA in 2024 to weight more heavily toward operations and business resilience: Information System Auditing Process (18 percent), Governance and Management of IT (18 percent), Information Systems Acquisition, Development and Implementation (12 percent), Information Systems Operations and Business Resilience (26 percent, tied for the largest share), and Protection of Information Assets (26 percent, tied for the largest share). Those five weights sum to exactly 100 percent, and the fact that the two largest domains now make up 52 percent of the exam is a real shift from older CISA study guides still circulating online, so verify you are studying against the current outline rather than a stale one.

Renewal math over 9 years

CISA is valid for three years, so nine years covers three renewal cycles. Each cycle requires 120 CPE hours, with ISACA setting a 20-hour annual minimum so the requirement cannot be crammed into a single year at the end of the cycle.

The Annual Maintenance Fee runs alongside CPE hours and does not depend on how you earn them: $45 a year for members, $85 a year for nonmembers, due by January 1 to keep you active through the coming calendar year. That is $135 per cycle for members or $255 for nonmembers, and $405 to $765 across nine years depending on membership status. If you hold three or more ISACA certifications, the fee for the third and subsequent credentials drops to $25 (members) or $50 (nonmembers), so stacking CISM or another ISACA credential on top of CISA does not multiply your total fee the way a naive read of the schedule might suggest.

What it does for the occupation you are entering

CISA maps most directly to the information security analyst occupation (BLS code 15-1212), the same broad category Security+ and ISC2 CISSP target, though CISA holders often carry the specific title of IT auditor or controls analyst within that broader occupational data. The panel on this page shows the current national median wage and headcount for the occupation; treat it as a picture of the field CISA sits inside, not a wage this specific certificate pays out. The Bureau of Labor Statistics projects continued strong growth in information security roles broadly, and CISA’s concrete value is as a screening credential: it is the default requirement on audit and compliance postings in finance, government, and any regulated industry, and it signals that a candidate can both test controls and document the finding in language an auditor’s audience expects.

Common mistakes

Registering as a nonmember without checking the math. The $185 gap between member and nonmember pricing often costs less than a year of ISACA membership dues, so compare the two before paying the higher fee out of habit.

Studying an outdated domain breakdown. ISACA rebalanced the CISA domains in 2024, shifting significant weight toward operations and business resilience. A study plan built off an older 2019-era breakdown misallocates hours toward the wrong material.

Letting the Associate window lapse without documenting experience. The CISA Associate designation gives four years to convert, but candidates who treat that as a deadline to worry about later sometimes let the clock run out. Log qualifying work as it happens rather than reconstructing five years of experience from memory when the conversion deadline is close.