ISACA CISA - Exam Strategy¶

Format reminder¶

150 questions, 240 minutes (4 hours)
Pass mark: 450 / 800 (~70%)
Multiple choice
Five domains: Information System Auditing Process (21%), Governance & Management of IT (17%), Information Systems Acquisition / Development / Implementation (12%), Information Systems Operations & Business Resilience (23%), Protection of Information Assets (27%)

CISA tests how an auditor thinks:

When you see options where one says "the auditor performs X" (i.e., does management's job), it's almost always wrong.

Independence threats: self-review (auditing your own work), self-interest, advocacy, familiarity, intimidation. The fix is structural separation.
Evidence reliability hierarchy: independent corroborated system-generated > internal corroborated > internal uncorroborated > management assertion. System logs > observation > interview.
Statistical vs judgmental sampling: CISA prefers statistical (attribute or variable) for objectivity. Judgmental is acceptable for non-statistical purposes.
Inherent vs Residual vs Control vs Detection risk:
Inherent: risk before controls
Control: risk controls fail
Detection: risk audit misses
Residual: risk after controls (= inherent × control × detection)
First / FIRST / BEST: read carefully. ISACA loves these.
SoD: 4 functions (Authorize, Record, Custody, Reconcile) - separate or use compensating controls.
Audit lifecycle: Plan → Risk Assessment → Audit Program → Fieldwork (testing) → Findings → Reporting → Follow-up.
Materiality: aggregate impact + likelihood determines whether a finding is material. Auditors must articulate why.
Compensating controls: when an exact control isn't feasible, an alternate achieving similar risk reduction is acceptable.
Reporting findings: classify by risk (high / medium / low), document with evidence, recommend (don't dictate), follow up.

COBIT 2019 framework (governance + management practices)
ITAF (ISACA's IT Assurance Framework)
Continuous Auditing concepts (CAATs - Computer-Assisted Audit Techniques)
BCP/DRP audit concerns (BIA, RTO, RPO, alternate site, test frequency)
Application controls (input, processing, output) vs general IT controls (access, change management, ops)
Database access controls (DBA SoD, audit logging)
Encryption auditor concerns: key management, certificate lifecycle, algorithm strength

240 / 150 = 1.6 min/question. Pace: half done by 120 min, 100 questions by 160 min.

4 hours, 150 questions. Pearson VUE.

Pass: 5-year cycle, 120 CPE, maintenance fee.

Fail: Most failures are on Domain 4 (Operations - 23%) or Domain 5 (Protection - 27%).