What CISA asks of you, and a sensible way to prepare
ISACA charges $760 for the CISA exam, or $575 for members, in the US in November 2026. With ISACA's question bank, a first attempt costs about $1,159; a live class brings it to between $2,499 and $4,010 (non-member prices), plus a $50 application fee when you certify. CISA fits IT auditors and the risk, control and security staff who work with them. Plan on 2 to 4 months of study alongside a full-time job (our estimate).
Key facts
- The CISA exam costs $760, or $575 for ISACA members, in the US. (ISACA, checked November 5, 2026)
- The exam has 150 questions across five weighted areas. (ISACA, checked November 5, 2026)
- To certify, you need five years of IS audit, control or security work within the 10 years before applying; you have five years after passing to apply, and the application fee is US$50. (ISACA, checked November 5, 2026)
- Keeping CISA takes an annual fee of $85 ($45 for members) and 120 CPE hours per three-year cycle. (ISACA, checked November 5, 2026)
- From January 1, 2027, at least 90 of every 120 CPE hours must match the exam domains. (ISACA, checked November 5, 2026)
Is CISA the right credential for your work?
CISA is ISACA's certification for information systems audit. It covers planning and running IT audits, governance, how systems are acquired and run, and protecting information assets. It fits IT auditors and the risk, control and security staff who work with them, and it shows you can test controls rather than only operate them.
A good fit if
- You plan or run IT audits, or test controls for an internal audit or compliance team
- You work in risk, control or security and spend much of your time working with auditors
- You have, or are building, five years of IS audit, control or security work
Think twice if
- Your goal is to lead a security program rather than audit one
- You want a hands-on technical security credential rather than an audit one
- You want the full certification soon but do not have five years of audit, control or security work
Consider instead: CISM for security management (see CISA vs CISM), or CySA+ for hands-on security analysis.
What ISACA requires
Passing comes first and the experience can follow. To hold the certification, ISACA wants five years or more of IS audit, control or security work, all within the 10 years before you apply, and ISACA's get-certified page lists no experience waivers or substitutions (checked November 5, 2026); the clock to apply runs five years from your pass, and applying costs US$50. Holding CISA then costs $85 a year ($45 for members) and 20 hours of continuing education a year and 120 per three-year cycle. ISACA is tightening that rule on January 1, 2027: of each 120-hour cycle, a minimum of 90 hours has to match CISA's audit domains, leaving no more than 30 for general career learning.
Five areas, unevenly weighted
Expect 150 questions over five weighted areas. You book through ISACA and test with PSI, in a center or online, any time in the six months after you register.
| Area | Weight |
|---|---|
| The audit process | 18% |
| IT governance and management | 18% |
| Acquiring, developing and implementing systems | 12% |
| IT operations and business resilience | 26% |
| Protecting information assets | 26% |
If you come from security, expect to spend most of your time on the audit process and governance; if you come from audit, on operations and protecting information assets. Study the side you have not worked.
Study routes for CISA
For most people CISA comes down to the exam fee and ISACA's practice questions. The review manual helps if you want a reference; a class helps if you want a schedule. Everything else is optional.
A live class is worth paying for when an employer covers it or you need fixed dates to keep going.
The prices that matter
Totals add the $760 non-member exam fee unless the provider includes the voucher.
| Route | Provider and course | Published price | Exam fee | First attempt |
|---|---|---|---|---|
| Question bank only | ISACA, Six months of ISACA’s official CISA practice questions (QAE); $299 for members. Checked November 5, 2026. | $399 | + $760 exam (non-member) | $1,159 |
| Review manual and question bank | ISACA, The 28th-edition CISA Review Manual at $139 with the $399 practice-question subscription ($408 together for members). Checked November 5, 2026. | $538 | + $760 exam (non-member) | $1,298 |
| Live class with voucher, 4 days | Learning Tree, CISA training, exam voucher included in tuition. Checked November 5, 2026. | $3,850 | Included | $3,850 |
| Live online boot camp with voucher, 4 days | Risk Tide, ISACA CISA Boot Camp, live virtual; exam voucher, a free retake, ISACA prep materials and a year of ISACA membership included; sale price, regularly $2,999. Checked November 5, 2026. | $2,499 | Included | $2,499 |
| Live online class, 5 days | New Horizons, Certified Information Systems Auditor (CISA); the page does not mention an exam voucher. Checked November 5, 2026. | $3,250 | + $760 exam (non-member) | $4,010 |
Among the live classes, count the voucher. Learning Tree's $3,850 includes one; New Horizons' $3,250 does not mention one, so with a voucher bought separately it comes to $4,010. The lowest live price we found is Risk Tide's four-day online boot camp at $2,499 (a sale price; regularly $2,999), which bundles the voucher, a free retake and a year of ISACA membership.
Member or not
Joining costs US$145 for a year of professional membership, and most chapters add their own dues. Buy the exam, review manual and question bank as a member and you pay $185, $30 and $100 less, a $315 discount. Unless your chapter charges more than $170, membership is cheaper than paying non-member prices. Lower maintenance fees ($45 rather than $85) apply only after certification.
Comparing CISA course providers
- When an included voucher expires. An included voucher usually has its own expiry; ask for the date before you enroll.
- Whether a retake is covered. The paragraph below the table shows Risk Tide's; ask the others.
- Which edition of ISACA's materials the course uses. The current CISA Review Manual is the 28th edition; ask whether the course follows it and whether ISACA's question bank is included.
- Who teaches, and whether the date is confirmed. Ask for the instructor and what happens if a listed class does not run.
When an employer pays
Make the case around the work: CISA covers how to plan and run IT audits and test controls, which is what an audit or compliance team does every day. If several staff are going, ask a provider whether a private class includes vouchers and question-bank access for each person, and compare that with buying ISACA's materials for each person and running a study group.
FAQ
- How much is the CISA exam?
- $760 for non-members and $575 for ISACA members, as of November 2026.
- Is the CISA exam fee included in training courses?
- Sometimes. Risk Tide and Learning Tree include it; New Horizons' course page does not mention a voucher.
- Can I sit the CISA exam without five years of experience?
- Yes. Experience is needed to certify, not to test, and the window to apply stays open five years after you pass.
- What does keeping CISA cost?
- An $85 yearly fee ($45 for ISACA members) and 20 hours of continuing education each year.
Next step
Tell us your background and deadline, and we will point you to the study route that fits.
Ask for help choosing CISA training
Sources
- ISACA: CISA certification (exam fees, application fee, delivery, study products), checked November 5, 2026
- ISACA: CISA exam content outline (questions, domain weights), checked November 5, 2026
- ISACA: get CISA certified (experience requirement), checked November 5, 2026
- ISACA: maintain CISA certification (maintenance fee, CPE), checked November 5, 2026
- ISACA: CPE policy changes from January 1, 2027, checked November 5, 2026
- ISACA: become a member (professional membership fee), checked November 5, 2026
Prices are published list prices we recorded on the dates shown, not quotes. How we research.