The complete ISACA Certified Information Systems Auditor (CISA) study library — 13 lessons mapped to every domain and topic in the official exam guide. Free to read, no account needed.
Create a free account to track completed lessons, bookmark topics and see your exam readiness. · Pro lessons unlock with a one-time upgrade.
ISACA publishes exactly what the CISA tests and how much each part is worth. Here it is — every domain, its weight, the topics inside it, and the lessons that cover them.
Planning and executing IS audits: audit standards and ethics, audit types, risk-based planning, control types, audit project management, testing and sampling, evidence, data analytics, reporting and quality assurance of the audit function. Official weighting 18%.
Evaluating IT governance and management: laws and standards, governance structure and IT strategy, policies, enterprise architecture, enterprise risk management, privacy and data governance, then IT resources, vendors, performance monitoring and quality management. Official weighting 18%.
Auditing how systems are acquired, built and put into production: project governance, business cases and feasibility, development methodologies, control design, readiness and implementation testing, configuration and release, migration and data conversion, and post-implementation review. Official weighting 12%.
Auditing IT operations — components, assets, scheduling, interfaces, shadow IT, availability, incident and change management, logs, service levels and databases — and business resilience: the BIA, resilience, backup and restoration, and continuity and disaster recovery plans. Official weighting 26%.
Auditing information asset security — frameworks, physical controls, identity and access, network and endpoint security, DLP, encryption and PKI, cloud, mobile and IoT — and security event management: awareness, attack methods, testing and monitoring tools, incident response and forensics. Official weighting 26%.
Reading every note front to back is the slowest way to pass. The exam is weighted, so your revision should be too — the blueprint above tells you exactly where the marks are.
Information Systems Operations and Business Resilience carries the most marks on the CISA, so it earns the most of your attention. Work down the blueprint from the heaviest domain to the lightest rather than starting at domain 1 and grinding forward.
Read each lesson once without stopping to memorise — you are building a map, not a memory. On the second pass, read only the "what's tested" and key-takeaway blocks. If a takeaway surprises you, that lesson goes back on the pile.
Cover a lesson's key takeaways and try to say them out loud from the heading alone. Recall you can produce under your own steam is the only recall that survives a timed exam; recognition on a re-read is not the same thing.
Finishing the notes is not the goal — scoring is. Move to CISA practice questions early, then come back to the exact lessons your wrong answers point at. That loop is worth far more than a third read-through.
Exam structure, domain weights and scoring on this page come from the official CISA exam guide.