2026 Exam Guide
ISACA CISA Study Guide
Current exam coverage, candidate guidance, important topics, and practical preparation advice for the CISA exam.
What Is ISACA CISA?
ISACA CISA is a leading information systems audit certification for professionals who assess, audit, control, and monitor information systems. It validates knowledge of audit planning, governance, acquisition, operations, resilience, and protection of information assets.
CISA questions commonly focus on evidence, independence, audit risk, control design, control effectiveness, governance, change management, business continuity, and security controls. In 2026, preparation should include cloud and outsourced services, data protection, audit documentation, and risk-based audit planning.
Who Should Take This Exam?
CISA is appropriate for IT auditors, internal auditors, assurance professionals, compliance analysts, risk professionals, security assessors, and consultants.
Candidates should understand audit methodology, IT controls, business processes, governance, and evidence quality. Technical knowledge helps, but the exam viewpoint is audit and assurance.
Exam Domains
Information Systems Auditing Process
CoreAudit planning, standards, evidence, sampling, reporting, and follow-up.
Governance and Management of IT
CoreStrategy, policies, enterprise architecture, risk, and performance oversight.
Information Systems Acquisition, Development and Implementation
CoreProject governance, SDLC, change management, testing, and release controls.
Information Systems Operations and Business Resilience
CoreOperations, service management, continuity, disaster recovery, and monitoring.
Protection of Information Assets
CoreSecurity controls, identity, privacy, data protection, and infrastructure safeguards.
Common Topics Covered
- Audit evidence
- Control testing
- Risk-based audit
- IT governance
- Change management
- SDLC controls
- BCP and DR
- Logical access
- Data protection
- Audit reporting
Study Tips
Think like an auditor. The best answer is often the one that preserves independence, verifies evidence, tests control effectiveness, or reports risk appropriately.
Practice distinguishing control design from operating effectiveness. Review change management, privileged access, backup testing, incident records, and third-party assurance evidence.
Practice Questions Overview
Certoga's CISA practice questions emphasize audit judgment, evidence quality, and control assessment. They help candidates move beyond technical familiarity into assurance reasoning.