Question 1Audit evidence collection techniques
The IT manager at a logistics company tells the IS auditor that every security patch is tested before deployment. What should the auditor do NEXT?
How hard is the CISA exam?
It is broad and it asks for an auditor's judgement: five domains, from audit planning and sampling to governance, system development, operations, resilience and security, tested with scenario questions where more than one answer sounds right.
| Questions | 150 multiple choice |
|---|---|
| Time | 4 hours (240 minutes) |
| Score scale | 200 to 800 |
| Passing score | 450 |
| Experience to certify | Five years in IS audit, control or security |
What makes it hard
- Breadth: five domains, with operations and business resilience and the protection of information assets the largest at 26% each.
- Judgement: many questions ask what an IS auditor should do FIRST, what is the BEST recommendation or what is the GREATEST concern, so you choose between good options.
- The auditor's point of view: the auditor plans, tests, reports and recommends; management owns the controls and fixes the problems. Answers that have the auditor implement a fix are usually wrong.
- Stamina: 150 questions in 4 hours is about 96 seconds a question.
What makes it easier
The judgement follows a few steady principles: start from risk, rely on independent and sufficient evidence, keep the auditor independent, report to the right audience and let management decide. Practicing scenarios against those principles pays off more than memorizing more terms.
Try 3 questions
Question 2Organizational structure, IT governance and IT strategy
A logistics company is setting up an IT steering committee. What should be its PRIMARY function?
Question 3Business impact analysis
An IS auditor reviews a logistics company's business impact analysis. For the dispatch process, the maximum tolerable downtime is 48 hours, but the recovery time objective set by IT is 72 hours. What should the auditor conclude?
Next step
Questions people ask
Is the CISA exam harder than it looks?
The facts are learnable; the hard part is choosing the best of several reasonable answers from an auditor's point of view, across all five domains.
How long should I study for the CISA?
ISACA does not set a study time. Most of the work is putting your own audit, control or security experience into the outline's terms and practicing the question style.
What is the hardest domain?
It depends on your background. An auditor from finance often finds the technical security domain hardest; a security engineer often finds the audit process and governance domains hardest. The free diagnostic shows which is yours.