ISACA CISA guideStudy & preparation

Failed the CISA? Retake Rules and a Plan for Your Next Attempt

Use CISA's retake waiting periods to diagnose a failed attempt, rebuild weak topics, change your practice routine, and decide when to book again.

Short answer

ISACA requires a 30-day wait after your first failed CISA attempt, then 90 days after the second and third, with no more than four attempts in a rolling 12-month period. Use the wait to combine official domain feedback with fresh practice, separating topic gaps from reasoning and pacing problems. Book the next attempt around the work you need to complete, rather than treating the first permitted date as a readiness target.

How soon can you retake the CISA?

ISACA requires a 30-day wait after your first failed CISA attempt and 90-day waits after the second and third, with a maximum of four attempts within a rolling 12-month period. A useful retake plan uses that wait to identify what failed in your preparation and practice it differently before paying for another attempt.

The retake rules in ISACA's Certification Exam Candidate Guide, checked November 3, 2026, produce this hypothetical earliest-attempt sequence:

AttemptMinimum wait after the previous failed attemptEarliest relative day in this example
FirstStarting pointDay 0
Second30 daysDay 30
Third90 daysDay 120
Fourth90 daysDay 210

The example assumes every preceding attempt was unsuccessful and each next appointment is available at the minimum interval. It is calendar arithmetic, not a booking promise. The rolling annual cap and your registration eligibility also apply; January 1 does not automatically reset your attempt count.

Write down your actual attempt dates before choosing a target. The earliest permitted date answers when you may test, not whether your preparation has changed enough to justify doing so.

What should you learn from the failed attempt?

Start with the official score report. ISACA releases it within 10 working days, and its domain feedback is informational. A weak domain result points to an area to investigate; it does not tell you whether the cause was missing knowledge, a misread question, or poor pacing. The CISA results and score-report guide explains how to interpret that distinction.

While waiting for the report, record broad observations about your preparation and timing without reconstructing live exam questions. Then use fresh practice to test those observations. This editorial error log separates three problems that call for different work:

What happens in practiceWhat to investigateYour next study task
You cannot explain the concept without notesA topic gapReview the concept, explain it in your own words, then try a different example
You know the terms but cannot justify the better choiceA reasoning gapIdentify the question's objective and explain why each option fits or fails it
You answer carefully at first but rush laterA pacing problemTime a mixed set and record where you spend too long

Include guessed answers in the log, even when they were correct. A correct guess gives you something to investigate; it is not evidence that you can explain the concept.

Match each topic gap to the five CISA domains. The official outline, checked November 3, 2026, assigns 26% each to Information Systems Operations and Business Resilience and Protection of Information Assets. Those weights matter when allocating review time, but they do not justify abandoning the other three domains.

For broader practice after this diagnosis, full ISACA CISA prep planned for launch includes 1,350 questions across the five domains. Choose your next study topic from the error log rather than simply restarting every resource from page one.

How should you use a 30-day or 90-day wait?

Use phases with a concrete output from each one. The schedules below are editorial examples, not ISACA requirements or a claim that either period is sufficient preparation. Start the diagnosis immediately, then add the official report when it arrives.

PhaseExample within a 30-day waitExample within a 90-day waitWhat you should produce
DiagnoseDays 1–7Days 1–14Topic priorities and an error log based on fresh practice
RebuildDays 8–18Days 15–55Explanations of weak concepts and answers to different examples
Mix and applyDays 19–24Days 56–75Mixed practice that includes weaker and stronger domains
Rehearse and reviewDays 25–30Days 76–90A full-length practice session and a list of remaining problems

If the report arrives after your initial diagnosis phase, revise the priorities. If a topic still needs substantial work near the end, extend your study schedule while checking your registration deadlines. The end of the mandatory wait is not a study deadline.

For a hypothetical candidate who struggles with backup and restoration, rebuilding means explaining the underlying concepts before trying another scenario. For a candidate who understands the material but repeatedly answers a different question from the one asked, the next session should focus on reading and justifying choices. Those are different remediation tasks, even if both candidates found the same domain difficult.

Put the sessions into the free CISA study plan, then reserve time to review the mistakes from each session. For terminology review between practice sessions, full ISACA CISA prep planned for launch includes 500 flashcards. Keep that recall work alongside questions that require you to apply the terms.

How do you practice without memorizing answers?

For each practice question, explain the decision before checking the answer. ISACA's candidate guide describes four options with one best answer. Your task is therefore more specific than recognizing a familiar term: explain why the selected option best fits this question.

Use this editorial review sequence:

  1. State the question's objective in your own words.
  2. Choose an answer and identify the information supporting it.
  3. Explain why the strongest alternative is less suitable.
  4. After checking the answer, record the concept or reasoning step you missed.
  5. Try a different question on that idea in a later session.

The 20 free CISA practice questions give you a small starting set for this exercise. For more detail on comparing plausible options, see how to approach CISA best-answer questions. Repeating a remembered answer is not the same check as explaining an unfamiliar example.

Also rehearse the duration. The CISA format is 150 questions in 240 minutes, checked November 3, 2026. That averages 96 seconds per question, but individual questions need different amounts of time. Time the session yourself and review where you slowed down; do not treat the average as a rigid limit on every item.

For full-length practice, full ISACA CISA prep planned for launch includes a 150-question mock exam. Use a rehearsal to identify unfinished work and pacing problems. Neither a practice percentage nor finishing on time establishes that you will pass the official exam.

What must you confirm before paying for the next attempt?

Each retake requires the full exam fee. Under the candidate-guide fees checked November 3, 2026, that is US$575 for ISACA members and US$760 for nonmembers, based on membership status at registration. Recheck the current fee before paying; the CISA requirements and cost guide covers the broader certification costs and requirements.

Before registering again, confirm:

  • Your permitted attempt date: calculate the applicable wait and review all attempts within the rolling 12 months.
  • Your actual eligibility and appointment options: check your account and the current registration instructions rather than assuming a prior registration extends automatically.
  • Your changed preparation: identify which topic, reasoning, or pacing problems you addressed and what fresh practice shows about them.
  • Your remaining work: leave room to review the rehearsal instead of placing it immediately before the exam.

Choose one weak topic, one reasoning habit, and one pacing check for your next week. Put those tasks on the calendar first, then select a retake target that allows you to complete and review them.

Trust the source

Official sources

Exam policies can change. Use these primary sources for the most current details.