ISACACertified Information Systems Auditor
The Certified Information Systems Auditor (CISA) certification is the global standard for professionals who audit, control, monitor, and assess an organization's information technology and business systems. It validates your ability to apply a risk-based approach to audit engagements, covering everything from IS auditing processes to the protection of information assets. Earning CISA demonstrates your expertise in IT audit and positions you for career growth in a field where professionals earn an average salary of US$149,000+.
782 practice questions · Updated 2026-07-30
5Domains
24Objectives
204Concepts
782Questions
CISA Curriculum
Every domain, objective, and concept the CISA exam measures.
- IS Audit Standards
- IS Audit Guidelines
- ISACA Code of Professional Ethics
- Types of Audits
- Types of Assessments
- Types of Reviews
- Risk-Based Audit Planning
- Risk Assessment Techniques
- Audit Universe and Prioritization
- Types of Controls
- Control Classifications
- Control Considerations in Audit Planning
- Audit Project Management
- Audit Program Development
- Audit Resource Allocation
- Audit Monitoring and Reporting
- Audit Sampling Fundamentals
- Statistical vs. Non-Statistical Sampling
- Sampling Techniques
- Sample Size Determination
- Evaluating Sample Results
- Types of Audit Evidence
- Evidence Collection Techniques
- Evidence Sufficiency and Appropriateness
- Evidence Documentation
- Audit Data Analytics Overview
- Data Analytics Techniques
- Data Analytics Tools and Procedures
- Interpreting Data Analytics Results
- Audit Reporting Standards and Requirements
- Structuring the Audit Report
- Effective Communication of Audit Results
- Management Action Plans and Follow-up
- Quality Assurance and Improvement Program (QAIP)
- Audit Process Metrics and Monitoring
- Continuous Improvement of Audit Practices
- Regulatory Compliance Frameworks
- IT Governance Principles
- IT Strategy Development
- Organizational Structures for IT
- IT Policies, Standards, and Procedures
- Enterprise Architecture Frameworks
- IT Governance and Business Alignment
- Enterprise Risk Management (ERM) Framework
- Risk Assessment Process
- Risk Response and Mitigation
- Risk Monitoring and Reporting
- Privacy Principles and Frameworks
- Privacy Program Implementation
- Data Governance Concepts
- Data Classification and Handling
- IT Resource Management Overview
- Resource Planning and Allocation
- IT Asset Management
- Capacity Management
- IT Skills and Human Resource Management
- IT Vendor Management Overview
- Vendor Selection and Evaluation
- Contract and SLA Management
- Vendor Risk Management
- Vendor Performance Monitoring
- Vendor Relationship and Exit Management
- IT Performance Monitoring and Reporting
- Performance Measurement Frameworks
- Reporting to Stakeholders
- Quality Assurance (QA) in IT
- Quality Management (QM) in IT
- Quality Standards and Frameworks
- Continuous Improvement in IT
- Project Governance Frameworks
- Project Management Methodologies
- Project Organizational Structures
- Roles and Responsibilities in Projects
- Project Initiation and Charter
- Project Planning and Scheduling
- Project Scope Management
- Project Risk Management
- Project Quality Management
- Project Communication Management
- Project Monitoring and Control
- Project Change Management
- Project Closure and Post-Implementation Review
- Project Governance and Compliance
- Benefits Realization Management
- Project Portfolio Management
- Agile and Adaptive Governance
- Vendor and Contract Management in Projects
- Business Case Components
- Feasibility Study Types
- Cost-Benefit Analysis
- Risk Assessment in Feasibility
- Alternatives Evaluation
- Stakeholder Involvement
- Alignment with Business Strategy
- Feasibility Study Documentation
- System Development Life Cycle (SDLC) Phases
- SDLC Models and Approaches
- Agile Methodologies
- Rapid Application Development (RAD)
- Prototyping
- Object-Oriented Analysis and Design (OOAD)
- Structured Analysis and Design
- Selecting a Development Methodology
- Control Identification
- Control Design
- Control Classification
- Control Mapping to Risks
- Control Integration
- System Readiness Assessment
- Implementation Testing Strategies
- User Acceptance Testing (UAT)
- Data Conversion and Migration Testing
- Cutover Planning and Execution
- Post-Implementation Review
- Implementation Planning
- Configuration Management Process
- Release Management
- Change Management Integration
- Version Control
- Deployment Strategies
- Rollback and Contingency Planning
- Post-Implementation Review
- System Migration Planning
- Migration Strategies
- Data Conversion Methods
- Data Validation and Reconciliation
- Infrastructure Deployment Planning
- Deployment Execution and Rollback
- Post-Implementation Review
- Post-implementation review objectives
- Post-implementation review timing
- Post-implementation review scope
- Post-implementation review participants
- Post-implementation review process
- Post-implementation review techniques
- Evaluating system performance
- Evaluating user satisfaction
- Evaluating benefits realization
- Identifying deficiencies and improvements
- Post-implementation review reporting
- Follow-up actions
- IT Components
- IT Asset Management
- Job Scheduling and Production Process Automation
- System Interfaces
- Shadow IT and End-User Computing
- Systems Availability and Capacity Management
- Problem and Incident Management
- IT Change, Configuration, and Patch Management
- Operational Log Management
- IT Service Level Management
- Database Management
- Business Impact Analysis (BIA)
- BIA Metrics and Recovery Objectives
- System Resilience Design
- Operational Resilience and Risk Management
- Data Backup Strategies
- Data Restoration and Testing
- Business Continuity Plan (BCP) Development
- BCP Maintenance and Testing
- Disaster Recovery Plan (DRP) Strategies
- DRP Implementation and Coordination
- Information Asset Security Frameworks
- Standards and Guidelines for Information Security
- Security Awareness Training Programs
- Evaluating Security Awareness Effectiveness
- Physical Controls
- Environmental Controls
- Physical Access Controls
- Environmental Threats and Mitigation
- Physical and Environmental Control Assessment
- Identity and Access Management (IAM) Fundamentals
- Identity Lifecycle Management
- Authentication Methods
- Authorization and Access Control Models
- Access Control Administration
- Single Sign-On (SSO) and Federated Identity
- Privileged Access Management (PAM)
- IAM Governance and Compliance
- Network Security Fundamentals
- Endpoint Security Controls
- Data Loss Prevention (DLP) Strategies
- Data Encryption Concepts
- Public Key Infrastructure (PKI) Components
- Cloud Security Considerations
- Virtualized Environment Security
- Mobile Device Security
- Wireless Network Security
- Internet-of-Things (IoT) Security
- Attack Methods and Techniques
- Security Testing Tools and Techniques
- Security Monitoring Tools and Techniques
- Incident Response Lifecycle
- Incident Classification and Triage
- Incident Response Roles and Responsibilities
- Incident Response Procedures and Playbooks
- Incident Detection and Reporting
- Containment, Eradication, and Recovery Strategies
- Evidence Collection and Handling
- Forensic Imaging and Data Acquisition
- Forensic Analysis and Examination
- Forensic Tools and Techniques
- Legal and Regulatory Considerations in Forensics
- Documentation and Reporting of Forensic Findings
Ready to practice?Test your knowledge with exam-style questions or take an intelligent quiz tailored to your level.
Percentages reflect share of the current practice bank, not official exam weightings — no structured per-skill weight is published for CISA, so none is invented.