What's on the CISA Exam? The Five Domains, Weights, and Format

The five CISA domains and their weights

The CISA exam tests five job practice domains, each with a published weight: Information System Auditing Process 18%, Governance and Management of IT 18%, Information Systems Acquisition, Development, and Implementation 12%, Information Systems Operations and Business Resilience 26%, and Protection of Information Assets 26%. ISACA's candidate guide lists 150 multiple-choice questions in four hours (240 minutes), and a scaled score of 450 or higher on a 200 to 800 scale passes.

The last column multiplies each weight by 150 to show relative emphasis, not a count you can rely on. ISACA says its exams include pretest items that do not count toward your score, and it publishes no per-domain item count. What the table does show is that Domains 4 and 5 together make up just over half the exam, and that Domain 3 is the smallest at 12%. For practice in the same proportions, full CISA prep planned for launch sizes each domain's question set to these weights, from 162 questions for Domain 3 to 351 each for Domains 4 and 5.

The topic counts line up with the weights more closely than you might expect. Spread evenly, each listed topic would be worth roughly 1.5% to 1.8% of the exam in every domain. ISACA weights domains, not topics, so treat that as a reason not to skip any topic, not as a scoring rule.

What each CISA domain covers, in plain words

The content outline names every topic. These summaries regroup them by what an IS auditor actually does in each area. Read the outline itself for the exact wording.

ISACA's announcement of this outline says the five domains stayed similar to the previous outline, but the updated outline requires testing of risk, security, and controls related to disruptive technologies and emerging IT audit practices. In the topic list, that shows up in entries such as shadow IT and end-user computing in Domain 4 and audit data analytics, including audit algorithms, in Domain 1.

How the 43 CISA tasks shape the questions

Next to the topics, the outline lists 43 supporting tasks, the work a CISA is expected to perform. Of those 43, 32 begin with the word "Evaluate": evaluate the IT strategy for alignment, evaluate the change and patch management programs, evaluate the organization's privacy program, and so on. Four begin with "Conduct," two with "Utilize," and the rest with plan, apply, communicate, determine, and provide guidance.

That count is the best clue to the exam's point of view. The tasks rarely ask you to build, configure, or run a control. They ask you to judge whether a control is designed well, whether it works, and what the risk is if it does not. A practical approach for answering scenario questions follows from that:

1. Ask what the auditor's job is in the scenario. Planning, testing, reporting, and following up belong to the auditor. Designing and operating the fix belong to management.
2. Prefer evidence over assurances. An answer that tests, reconciles, or obtains records usually beats one that accepts a statement or an email.
3. Rank by risk. When several problems appear, the one with the greatest impact on the organization's objectives usually comes first.
4. Protect objectivity. Watch for options that have the auditor review their own work or take over a management decision.

This is editorial advice, not an ISACA scoring rule, but it explains why two technically correct options can differ on a CISA question: one fits the auditor's role and the other does not.

How the CISA exam is scored

ISACA reports results as a scaled score from 200 to 800. A score of 800 means every question was answered correctly, 200 is the lowest possible score, and 450 or higher passes. Some items on each exam are pretest items that do not count toward the score.

You see a preliminary pass or fail result on screen as soon as you finish. The official score arrives by email and in your ISACA account within 10 working days. The score report includes domain-level results, but ISACA says they are for information only: the score is based on the total number of scored items answered correctly, regardless of domain. Question-level results are not provided, so a domain result is the most detailed feedback you get.

Which CISA outline applies to a 2027 exam date

The outline in force is ISACA's CISA Examination Content Outline (Effective August 2024). ISACA announced it on May 1, 2024, and the updated exam became available on August 1, 2024. ISACA's current Certification Exam Candidate Guide, version 1.26, prints the same outline in its first appendix, and the CISA outline page on isaca.org shows the same five weights.

As checked on November 1, 2026, the ISACA pages we reviewed announced no newer CISA outline, so a 2027 candidate should study the current five-domain outline. If you use older study materials, check the edition: ISACA released the CISA Review Manual, 28th Edition with this outline. If your notes were written before August 2024, compare their topic list with the current one. CISA prep planned for launch is written to the current five-domain outline, not to the one it replaced.

Turning the CISA weights into study time

A simple way to use the weights is to split your hours by them and then adjust for your gaps. With 100 study hours, a straight split gives 18 hours each to Domains 1 and 2, 12 hours to Domain 3, and 26 hours each to Domains 4 and 5. That is a starting point, not an ISACA rule. Move hours toward the domains furthest from your daily work. For example, an auditor from a finance background may want more time on Domains 4 and 5, and a security engineer more on Domain 1's audit process.

Then check the clock. The exam gives 240 minutes for 150 questions, about 1.6 minutes per question on average. Reading a scenario, spotting the auditor's role, and ruling out the management answer all take time, so rehearse at that pace before the appointment. Full CISA prep planned for launch includes a 150-question, four-hour timed mock exam for that rehearsal.

Your first step with the CISA domains

Start by finding where you stand. The 20 free CISA practice questions are split across the five domains by their weights, explain every option, and end with a breakdown by domain. Use that breakdown to choose your weak domain in the free CISA study planner, which turns your exam date and daily minutes into a dated outline.

Before you book, also check what you need to become certified after you pass. The exam is open to anyone, but the credential needs five years of experience, with waivers that can replace up to three of them. The guide to CISA requirements, waivers, and costs walks through each rule and fee. For recall of terms such as RPO and RTO or owner and custodian, see how the 500 flashcards planned for full CISA prep are split across the five domains.