Updated recently
Last updated:
Quick Answer: What is certified information systems auditor credential: CISA is the Certified Information Systems Auditor credential – a globally recognised qualification for people who audit, control and assure IT systems. It requires five years of relevant experience with waivers, covers five domains, and needs 120 continuing education credits per three-year cycle.
CISA at a Glance
CISA is one of the most widely held IT audit credentials in the world, and in the United States it is close to a contractual requirement in many regulated industries and government programmes. It sits in a different market from the technical security certifications, and the difference is important when you are choosing.
The role it certifies is assurance: knowing whether a control exists, whether it operated, and whether the evidence supports the claim. That is a different skill set from defending systems, and candidates who come from a security operations background often underestimate how much of CISA is process and evidence rather than technology.
| Element | Detail | What it means |
|---|---|---|
| Experience | 5 years in IS auditing, control or assurance | Waivers exist for degrees and certain certifications |
| Domains | IS auditing, control and assurance; acquisition, development and maintenance; information security and protection; information systems governance | Governance and audit process carry the heaviest weight |
| Exam format | Multiple choice and multiple response, 100 questions | Scenario-heavy, and deliberately so |
| Indicative cost | ~$575 for ISACA members, ~$795 for non-members | Membership pays for itself if you will take more than one exam |
| Renewal | Three-year cycle, 120 CPEs | Annual reporting of CPEs, 40 per year |
| Recertification | CISA-CR for audit, control and assurance professionals | A separate credential within the CISA family |
ISACA changes fees and exam structure periodically and applies different rates by region and membership status, so confirm the current figures before budgeting.
What Is Certified Information Systems Auditor Credential: The Domains and What They Test
The domains are where most candidates underestimate the exam. Information systems auditing and control are the largest and the most process-heavy – audit planning, evidence, sampling, findings and reporting. Information systems acquisition, development and maintenance covers the delivery lifecycle and change control in an audit context.
Information security and protection is the domain most candidates prepare hardest for, because it is the most recognisable, and it is usually the one they are least tested on proportionately. Governance covers how an organisation manages the risk of its information assets.
The certification says something specific: you can assess whether an IT control is designed properly, whether it operated, and whether the evidence proves it. That is what makes it valuable in audit, GRC and compliance roles, and why it pays less as a general technology credential.
Is CISA Still Worth It in 2026
In audit, GRC and compliance roles, yes, and increasingly so. Regulatory pressure across healthcare, finance and critical infrastructure has made third-party assurance a permanent cost line, and CISA is the credential that hiring managers recognise without explanation. It is named in a large share of US postings for IT audit and compliance analyst roles.
As a general technology credential, no. It does not carry weight with engineering hiring managers, and it will not help in a platform or security engineering interview. It is a specialist credential, and the market it opens is real but narrower than the technology certifications.
The career value is in combination. CISA plus Security+, or CISA plus a cloud security credential, is a strong signal for a security or risk analyst role, because it pairs assurance knowledge with technical credibility.
How CISA Differs From Security+ and How They Work Together
They certify different professions. Security+ certifies the person who understands and works with security controls and technology. CISA certifies the person who audits whether controls are properly designed and operating. A lot of strong security professionals hold both, and the pairing is a standard combination for GRC and internal audit roles.
If you are trying to move from an operations role into audit or compliance, CISA is the credential that does the work. If you are trying to move from support into security engineering, Security+ is the better first step and CISA can wait.
How to Keep the CISA CPE Requirement Manageable
Work out what your employer already funds. Most organisations with an audit function run internal training, subscribe to a security publication, and send people to conferences – all of which commonly count as continuing professional education if you log them.
The failure mode is doing none of it until the final quarter of the cycle and then paying for an expensive course to hit 120 credits. A spreadsheet with the requirement and the annual target is enough to avoid that, and the annual reporting requirement makes a small monthly habit much easier.
An Auditor Who Could Not Get the Evidence
A candidate with three years in IT operations applied for a CISA-backed audit role and was invited to an interview. The interview included a scenario on change management, which she knew well operationally.
The question was not about the change process. It was about how you would prove that changes were tested and approved – where the evidence lives, who signs it, and what you would do when a team had no approval artefact at all. She could describe good practice; she could not describe the audit method for establishing it.
The feedback was that she had the audit mindset but not the method. She studied for a year – mostly the auditing and control domains, with a deliberate focus on evidence and sampling – passed, and moved into an internal audit role she would not have been able to enter without it.
Why This Matters Outside the United States
CISA is one of the most widely held audit credentials globally and is a standard requirement for US IT audit and GRC postings, which makes it a common target for non-US candidates.
CISA is one of the most widely held IT audit credentials globally and is a standard requirement for IT audit and GRC postings in the US, which makes it a common target for candidates outside the country – the exam is offered widely and ISACA operates in over 180 countries.
How to Read These Numbers
ISACA sets the fees and applies different rates for members, non-members and, in some regions, local associations. It also revises the exam structure periodically, so confirm the current domain weighting and the number of questions.
The five-year experience requirement has a set of waivers that candidates frequently do not know about, and each waiver can change the timeline considerably.
Key Terms Used Above
| Term | What it means in practice |
|---|---|
| CISA | The Certified Information Systems Auditor credential. |
| Assurance | The practice of evaluating whether a control is properly designed and operating. The heart of what CISA certifies. |
| Evidence | The artefacts an auditor relies on. Knowing where they live is a large part of the exam. |
| Sampling | Testing a subset of a population rather than all of it – a core audit method. |
| CPE | Continuing professional education credits, required annually within the three-year renewal cycle. |
If you are moving into audit from a technical role, spend your preparation time on the auditing and control domains. That is where your knowledge is thinnest and where the exam is densest.
Related Reading
If you want the wider context, start with our ranked cybersecurity certifications guide, then the full guide, then the full guide. Each of these covers a different part of the same decision.
Training Resources
For a structured path rather than scattered free material, the SkilBrill training programme covers the practical side of this topic with the same framing employers use. For a broader foundation, the related SkilBrill course covers the surrounding concepts so you are not learning this topic in isolation.
FAQ
What is the Certified Information Systems Auditor credential?
CISA is a globally recognised certification for people who audit, control and assure IT systems. It covers information systems auditing, control, governance and assurance, with a strong emphasis on ISACA’s framework and COBIT.
What experience do I need for CISA?
Five years of professional experience in information systems auditing, control or assurance, although waivers exist for degrees, certain certifications and specialised training.
How much does the CISA exam cost?
ISACA charges members substantially less than non-members, and there are additional discounts through the ISACA chapter network – the exam fee is one of the bigger parts of the total cost.
Is CISA still worth it?
Yes, in audit, GRC and compliance roles, where it is frequently a contractual or resume requirement. It pays less as a general technology credential than cloud or security certifications.
