ISACA CISA guideStudy & preparation
Failed the CISA? Retake Rules and a Plan for Your Next Attempt
Use CISA's retake waiting periods to diagnose a failed attempt, rebuild weak topics, change your practice routine, and decide when to book again.
Short answer
ISACA requires a 30-day wait after your first failed CISA attempt, then 90 days after the second and third, with no more than four attempts in a rolling 12-month period. Use the wait to combine official domain feedback with fresh practice, separating topic gaps from reasoning and pacing problems. Book the next attempt around the work you need to complete, rather than treating the first permitted date as a readiness target.
How soon can you retake the CISA?
ISACA requires a 30-day wait after your first failed CISA attempt and 90-day waits after the second and third, with a maximum of four attempts within a rolling 12-month period. A useful retake plan uses that wait to identify what failed in your preparation and practice it differently before paying for another attempt.
The retake rules in ISACA's Certification Exam Candidate Guide, checked November 3, 2026, produce this hypothetical earliest-attempt sequence:
| Attempt | Minimum wait after the previous failed attempt | Earliest relative day in this example |
|---|---|---|
| First | Starting point | Day 0 |
| Second | 30 days | Day 30 |
| Third | 90 days | Day 120 |
| Fourth | 90 days | Day 210 |
The example assumes every preceding attempt was unsuccessful and each next appointment is available at the minimum interval. It is calendar arithmetic, not a booking promise. The rolling annual cap and your registration eligibility also apply; January 1 does not automatically reset your attempt count.
Write down your actual attempt dates before choosing a target. The earliest permitted date answers when you may test, not whether your preparation has changed enough to justify doing so.
What should you learn from the failed attempt?
Start with the official score report. ISACA releases it within 10 working days, and its domain feedback is informational. A weak domain result points to an area to investigate; it does not tell you whether the cause was missing knowledge, a misread question, or poor pacing. The CISA results and score-report guide explains how to interpret that distinction.
While waiting for the report, record broad observations about your preparation and timing without reconstructing live exam questions. Then use fresh practice to test those observations. This editorial error log separates three problems that call for different work:
| What happens in practice | What to investigate | Your next study task |
|---|---|---|
| You cannot explain the concept without notes | A topic gap | Review the concept, explain it in your own words, then try a different example |
| You know the terms but cannot justify the better choice | A reasoning gap | Identify the question's objective and explain why each option fits or fails it |
| You answer carefully at first but rush later | A pacing problem | Time a mixed set and record where you spend too long |
Include guessed answers in the log, even when they were correct. A correct guess gives you something to investigate; it is not evidence that you can explain the concept.
Match each topic gap to the five CISA domains. The official outline, checked November 3, 2026, assigns 26% each to Information Systems Operations and Business Resilience and Protection of Information Assets. Those weights matter when allocating review time, but they do not justify abandoning the other three domains.
For broader practice after this diagnosis, full ISACA CISA prep planned for launch includes 1,350 questions across the five domains. Choose your next study topic from the error log rather than simply restarting every resource from page one.
How should you use a 30-day or 90-day wait?
Use phases with a concrete output from each one. The schedules below are editorial examples, not ISACA requirements or a claim that either period is sufficient preparation. Start the diagnosis immediately, then add the official report when it arrives.
| Phase | Example within a 30-day wait | Example within a 90-day wait | What you should produce |
|---|---|---|---|
| Diagnose | Days 1–7 | Days 1–14 | Topic priorities and an error log based on fresh practice |
| Rebuild | Days 8–18 | Days 15–55 | Explanations of weak concepts and answers to different examples |
| Mix and apply | Days 19–24 | Days 56–75 | Mixed practice that includes weaker and stronger domains |
| Rehearse and review | Days 25–30 | Days 76–90 | A full-length practice session and a list of remaining problems |
If the report arrives after your initial diagnosis phase, revise the priorities. If a topic still needs substantial work near the end, extend your study schedule while checking your registration deadlines. The end of the mandatory wait is not a study deadline.
For a hypothetical candidate who struggles with backup and restoration, rebuilding means explaining the underlying concepts before trying another scenario. For a candidate who understands the material but repeatedly answers a different question from the one asked, the next session should focus on reading and justifying choices. Those are different remediation tasks, even if both candidates found the same domain difficult.
Put the sessions into the free CISA study plan, then reserve time to review the mistakes from each session. For terminology review between practice sessions, full ISACA CISA prep planned for launch includes 500 flashcards. Keep that recall work alongside questions that require you to apply the terms.
How do you practice without memorizing answers?
For each practice question, explain the decision before checking the answer. ISACA's candidate guide describes four options with one best answer. Your task is therefore more specific than recognizing a familiar term: explain why the selected option best fits this question.
Use this editorial review sequence:
- State the question's objective in your own words.
- Choose an answer and identify the information supporting it.
- Explain why the strongest alternative is less suitable.
- After checking the answer, record the concept or reasoning step you missed.
- Try a different question on that idea in a later session.
The 20 free CISA practice questions give you a small starting set for this exercise. For more detail on comparing plausible options, see how to approach CISA best-answer questions. Repeating a remembered answer is not the same check as explaining an unfamiliar example.
Also rehearse the duration. The CISA format is 150 questions in 240 minutes, checked November 3, 2026. That averages 96 seconds per question, but individual questions need different amounts of time. Time the session yourself and review where you slowed down; do not treat the average as a rigid limit on every item.
For full-length practice, full ISACA CISA prep planned for launch includes a 150-question mock exam. Use a rehearsal to identify unfinished work and pacing problems. Neither a practice percentage nor finishing on time establishes that you will pass the official exam.
What must you confirm before paying for the next attempt?
Each retake requires the full exam fee. Under the candidate-guide fees checked November 3, 2026, that is US$575 for ISACA members and US$760 for nonmembers, based on membership status at registration. Recheck the current fee before paying; the CISA requirements and cost guide covers the broader certification costs and requirements.
Before registering again, confirm:
- Your permitted attempt date: calculate the applicable wait and review all attempts within the rolling 12 months.
- Your actual eligibility and appointment options: check your account and the current registration instructions rather than assuming a prior registration extends automatically.
- Your changed preparation: identify which topic, reasoning, or pacing problems you addressed and what fresh practice shows about them.
- Your remaining work: leave room to review the rehearsal instead of placing it immediately before the exam.
Choose one weak topic, one reasoning habit, and one pacing check for your next week. Put those tasks on the calendar first, then select a retake target that allows you to complete and review them.
Trust the source
Official sources
Exam policies can change. Use these primary sources for the most current details.