ISACA CISA: Cost, Exam Format, and the 5-Year Audit Experience Requirement

CISA is the credential IT audit work actually runs on, and its real gate is not the exam itself but the five years of hands-on audit, control, or security experience standing in front of it. This page covers what that experience requirement demands and how it can be partially waived, what the exam costs for members versus nonmembers, the five domains and their weights, and what nine years of renewal runs.

Who this cert is actually for

Auditing information systems for a living is the job this credential describes: IT auditors, control testers, and security professionals whose job is verifying that systems and processes actually do what they claim, not just building them. ISACA requires a minimum of five years of professional experience in IS/IT auditing, control, assurance, or security work, gained within the ten years preceding your application. Up to three of those five years can be waived through education: an associate’s degree counts for one year, a bachelor’s degree for two, and a master’s degree in information systems or a related field for three. ISACA caps the waivers at three years combined, so no combination can cut the requirement below two years of real experience.

If you have not yet banked the years, ISACA introduced the CISA Associate designation in 2025 specifically for this gap: pass the exam, keep an ISACA membership, pay a US$25 application fee, and hold Associate status for up to four years while you accumulate the experience needed to convert to full CISA. That mirrors the “pass now, certify later” pattern other advanced credentials use, and it exists so the exam pass does not go stale while your resume catches up.

Skip CISA if your work is security operations or engineering rather than audit and assurance; the exam’s scenario questions assume you have sat across the table from a system owner asking uncomfortable questions about controls, and that instinct is hard to fake. If governance and program-level security management is the better fit for your career than audit specifically, look at ISACA CISM instead, or build toward either with CompTIA Security+ first if you are still early career. CISA vs CISM lays out that fork in full.

What it costs all-in

ISACA prices the exam by membership status, and the gap is real money: $575 for ISACA members, $760 for nonmembers. This page uses $760, the nonmember figure, as the baseline cost, because most first-time candidates have not yet joined ISACA when they register. Whether joining first is worth it depends on ISACA’s current membership dues versus the $185 spread; run that math before you register rather than after. There is also a one-time US$50 application processing fee when you apply for certification, separate from the exam fee, and you have five years from your pass date to apply. Exam registration fees are nonrefundable and nontransferable once paid, and there is no free retake: ISACA requires the full registration fee for each attempt, with a 30-day wait after a first fail, 90 days between later attempts, and four attempts in any rolling 12 months. ISACA publishes these fees in US dollars only, with no separate local-currency price list.

Free and cheap prep exists here too. ISACA’s own exam content outline functions as the syllabus, and a well-reviewed CISA study guide or question bank in the $40 to $80 range covers most of what a self-study candidate needs beyond that. A realistic first-attempt budget is $760 for the nonmember exam plus $50 to $100 in prep materials, or $810 to $860, before the $50 application fee and any membership dues. Set that number against every other credential this site tracks on the ROI Index.

The exam itself

The exam is 150 multiple-choice questions over four hours, a fixed question count rather than a computerized-adaptive range, so every candidate answers the same number of items. A passing result is a scaled score of 450 out of a possible 200-to-800 range, and ISACA does not publish a pass rate, so treat any specific percentage you see in prep forums as an estimate, not an official figure.

Five domains make up the current job practice, updated by ISACA in 2024 to weight more heavily toward operations and business resilience: Information System Auditing Process (18 percent), Governance and Management of IT (18 percent), Information Systems Acquisition, Development and Implementation (12 percent), Information Systems Operations and Business Resilience (26 percent, tied for the largest share), and Protection of Information Assets (26 percent, tied for the largest share). Those five weights sum to exactly 100 percent, and the fact that the two largest domains now make up 52 percent of the exam is a real shift from older CISA study guides still circulating online, so verify you are studying against the current outline rather than a stale one.

Renewal math over 9 years

CISA is valid for three years, so nine years covers three renewal cycles. Each cycle requires 120 CPE hours, with ISACA setting a 20-hour annual minimum so the requirement cannot be crammed into a single year at the end of the cycle.

The Annual Maintenance Fee runs alongside CPE hours and does not depend on how you earn them: $45 a year for members, $85 a year for nonmembers, due by January 1 to keep you active through the coming calendar year. That is $135 per cycle for members or $255 for nonmembers, and $405 to $765 across nine years depending on membership status. If you hold three or more ISACA certifications, the fee for the third and subsequent credentials drops to $25 (members) or $50 (nonmembers), so stacking CISM or another ISACA credential on top of CISA does not multiply your total fee the way a naive read of the schedule might suggest.

The certification itself has no fixed expiry date while you keep it maintained: ISACA renews it each calendar year once the fee is paid and your annual CPE hours are reported, and the three-year cycle is the CPE reporting period, not an exam you sit again.

Nine-year cost of ownership: $1,030 to $1,575, the exam, the one-time $50 application fee, and nine years of annual maintenance fees, at the member rate ($575 plus $405, before membership dues) up to the nonmember rate ($760 plus $765). Certification renewal costs explained sets that against the other vendors’ models.

What it does for the occupation you are entering

CISA maps most directly to the information security analyst occupation (BLS code 15-1212), the same broad category Security+ and ISC2 CISSP target, though CISA holders often carry the specific title of IT auditor or controls analyst within that broader occupational data. The panel on this page shows the current national median wage and headcount for the occupation; treat it as a picture of the field CISA sits inside, not a wage this specific certificate pays out. The Bureau of Labor Statistics projects continued strong growth in information security roles broadly, and CISA’s concrete value is as a screening credential: it is the default requirement on audit and compliance postings in finance, government, and any regulated industry, and it signals that a candidate can both test controls and document the finding in language an auditor’s audience expects.

Common mistakes

Registering as a nonmember without checking the math. The $185 gap between member and nonmember exam pricing, plus the $40-a-year gap in maintenance fees once certified, is the number to set against ISACA’s current membership dues before paying the higher fee out of habit.

Studying an outdated domain breakdown. ISACA rebalanced the CISA domains in 2024, shifting significant weight toward operations and business resilience. A study plan built off an older 2019-era breakdown misallocates hours toward the wrong material.

Letting the Associate window lapse without documenting experience. The CISA Associate designation gives four years to convert, but candidates who treat that as a deadline to worry about later sometimes let the clock run out. Log qualifying work as it happens rather than reconstructing five years of experience from memory when the conversion deadline is close.