CISA Study Plan — 12 Weeks @ 5–7 hrs/week
Built: 4 October 2026 Target exam date: Tuesday 22 December 2026 (morning slot) Total planned study time: ~72 hours
1. The exam you are actually preparing for
| Item | Detail |
|---|---|
| Questions | 150 multiple-choice, 4 options each, single best answer |
| Time | 240 minutes (4 hours) — 1.6 min/question average |
| Scoring | Scaled 200–800; pass at 450. No penalty for wrong answers |
| Delivery | PSI test centres (Hong Kong) or online-proctored |
| Scheduling | Continuous testing — book any date year-round |
| Voucher validity | 1 year from registration; one exam attempt per voucher |
| Attempt limit | Max 4 attempts in 12 months. Wait 30 days after attempt 1; 90 days after attempts 2 and 3 |
| Fee (approx.) | ~US$575 ISACA member / ~US$760 non-member — verify current pricing before you pay |
| After passing | 5-year window to submit experience; then 120 CPE over 3 years (min 20/yr) + annual maintenance fee |
Verify these before booking: fees, test-centre availability and the experience-waiver rules change. Confirm on ISACA's official CISA pages rather than trusting any third-party summary (including this one).
Domain weights — this drives your time budget
| # | Domain | Weight | ~Questions | Your hours |
|---|---|---|---|---|
| 1 | Information Systems Auditing Process | 18% | ~27 | 13 |
| 2 | IT Governance and Management | 18% | ~27 | 13 |
| 3 | IS Acquisition, Development and Implementation | 12% | ~18 | 9 |
| 4 | IS Operations and Business Resilience | 26% | ~39 | 19 |
| 5 | Protection of Information Assets | 26% | ~39 | 19 |
| Total | 100% | 150 | ~73 |
The single most important consequence: Domains 4 and 5 are 52% of the exam. Most candidates over-study Domain 1 because it feels like "the audit stuff". Do not make that mistake — earn Domains 4 and 5 first.
2. Eligibility — settle this now, not in December
There are two separate gates, and confusing them is the most common reason people delay unnecessarily:
| Gate | Requirement |
|---|---|
| Registering for and sitting the exam | None. No degree, no experience, no prerequisite. Anyone can register and sit |
| Applying for the certification after you pass | 5 years of professional IS audit, control, assurance or security work |
So there is no reason to wait. Sit the exam, then submit your experience. You have 5 years from passing to apply.
Experience substitutions
- A bachelor's degree or above waives 2 years, so you would need 3 years of qualifying experience instead of 5. The degree must be completed first — time in study does not count.
- ISACA's applicant guide documents additional substitutions (for example, related teaching or certain associate degrees), and caps total substitution. Verify your specific case with ISACA — sources disagree on the details, and this is not something to guess at.
- The 5 years need not be continuous, and need not be a job titled "auditor". It must genuinely sit within IS audit, control, assurance or security and relate to information systems. Unrelated administrative, sales or purely technical roles generally do not count.
- Where your experience spans several roles, it can be combined — but each period needs a verifiable referee and a description of your responsibilities. ISACA does check relevance.
Action this week
Start a simple experience log now, whatever your current situation:
| Employer | Dates | Role | IS audit / control / assurance / security work you did | Referee |
|---|---|---|---|---|
Reconstructing five years of history in 2031 is far worse than maintaining a table for five years.
3. Your weekly rhythm (5–7 hours)
Anchoring to fixed slots is what makes this survive a full-time job. Suggested shape:
| Slot | When | Duration | What |
|---|---|---|---|
| Session A | Tue evening | 60 min | New content — read one note section, write your own 5-line summary |
| Session B | Thu evening | 60 min | Continue new content + 15 practice questions on last week's topic (spacing) |
| Session C | Sat morning | 180–240 min | The heavy block — finish the week's domain, then 40–60 practice questions |
| Session D | Sun (optional) | 45 min | Flashcard/recall drill only, no new material |
≈ 5.5 hrs/week minimum, 7 hrs/week if you use Sunday. That lands at ~72 hours over 12 weeks, matching the budget above.
Rules that make it work
- One domain at a time, but never zero practice. Practice questions start in Week 1, not Week 10.
- Read for the exam, not for depth. You are being tested on judgement and control classification, not on implementing a firewall.
- Write your own one-page summary per domain. If you cannot compress it, you have not understood it. These become your Week 12 revision material.
- Mixed practice from Week 6. Never do 100 questions from one domain in one sitting — the real exam interleaves them randomly.
- Log every wrong answer with: domain, why you were wrong, the rule you missed. This log is worth more than any book in the final fortnight. Target: fewer than 15 unresolved entries by Week 12.
4. The 12-week calendar
Each week lists the primary source (the domain notes in this folder), the practice target, and a checkpoint.
| Wk | Dates (2026) | Focus | Domain weight | Practice target | Checkpoint |
|---|---|---|---|---|---|
| 1 | Oct 5–11 | D1 Part A — audit standards & ITAF, ethics, independence, audit types, risk-based planning, control types | 18% | 30 Q | Can you classify any control as preventive/detective/corrective and general/application without hesitating? |
| 2 | Oct 12–18 | D1 Part B — audit project mgmt, sampling, evidence, CAATs, reporting (5 Cs), QAIP | 50 Q D1 | Can you rank evidence by reliability from memory? | |
| 3 | Oct 19–25 | D2 Part A — governance vs management, COBIT 2019, ISO 38500, EA, ERM, privacy law, data governance | 18% | 40 Q | Can you recite the COBIT 2019 domains and their objective counts? |
| 4 | Oct 26–Nov 1 | D2 Part B — IT resource & vendor management, SOC reports, IT performance, quality management | 50 Q D2 | Do you know why a SOC 2 Type 2 report still leaves you with work to do? | |
| 5 | Nov 2–8 | D3 — the whole domain: project governance, business case, SDLC, testing, cutover, PIR | 12% | 60 Q D3 | Can you pick the right cutover strategy from a scenario? |
| 6 | Nov 9–15 | Consolidation D1–D3 + mixed practice | — | 75-question half-mock + review | Half-mock score ≥ 60%. Below that, re-read your weakest domain before Week 7 |
| 7 | Nov 16–22 | D4 Part A — IS operations: infrastructure, assets, scheduling, interfaces, EUC/shadow IT, availability, incident & problem, change/config/patch, logs, SLAs, databases | 26% | 60 Q | Incident vs problem vs change vs event — instant definitions? |
| 8 | Nov 23–29 | D4 Part B — resilience: BIA, RTO/RPO/MTD/WRT, backup schemes, recovery sites, BCP/DRP, testing hierarchy | 60 Q D4 | Can you derive backup restore requirements from an RPO? | |
| 9 | Nov 30–Dec 6 | D5 Part A — security frameworks, physical, IAM, network/endpoint, DLP, crypto, PKI, cloud/virtualisation, mobile/IoT | 26% | 60 Q | Digital signature vs encryption — can you state what each does and does not give you? |
| 10 | Dec 7–13 | D5 Part B — awareness, attack methods, security testing, monitoring/SIEM, incident response, forensics & evidence | 60 Q D5 | Order of volatility and IR lifecycle from memory? | |
| 11 | Dec 14–20 | Full mock #1 (150 Q, 4 hrs, timed, no notes) + deep remediation of the two weakest domains | — | 150 Q mock + 80 Q targeted | Mock ≥ 70%? If yes, proceed. If no, decide by Dec 17 whether to move the exam |
| 12 | Dec 21–27 | Taper. Cheat sheet + wrong-answer log only. No new material after Dec 20 | — | Light recall (≤ 45 min/day) | EXAM: Tue 22 Dec, morning slot |
Taper rules for Week 12 — read these twice
- No new topics after Sunday 20 December. New material this late only creates panic, not marks.
- Monday 21st: read the cheat sheet and your own domain summaries. 2 hours maximum.
- Day before: pack ID, confirm the test-centre address and travel time, sleep. Do not cram.
- Exam morning: review only the cheat sheet. Nothing else.
5. Booking logistics — do these in the next 10 days
| When | Action |
|---|---|
| This week (Oct 5–11) | Join ISACA as a member if you haven't. It cuts the exam fee, and membership is required for the member rate. |
| This week | Register for the exam and buy the voucher. The voucher is valid 1 year, so registering early costs you nothing in flexibility. |
| By mid-October | Book the actual PSI slot for Tue 22 Dec, morning. December slots in Hong Kong fill up; book ~8 weeks ahead. |
| Before booking | Check whether your preferred date has an English-language slot at a Hong Kong centre, and whether online-proctored is available to you as a backup. |
| If 22 Dec is unavailable | Any weekday in the week of 14–20 Dec works, or shift to early-to-mid January 2027 and add 2–3 weeks of light revision. Do not push past mid-January — momentum decays. |
Booking decision rule
Register now, even if you feel unready. Because there is a 1-year voucher validity and a 30-day retake wait, an early booking is a free option: worst case you move the slot, best case the deadline is what actually forces you to finish.
6. Practice questions — the part that actually decides pass/fail
Reading alone does not pass CISA. Budget roughly 35–40% of total study time on questions.
Recommended order of resourcing:
- ISACA's official CISA Questions, Answers & Explanations (QAE) database — the closest thing to the real exam. If you buy one thing, buy this. Work it in study mode for learning and exam mode for pacing.
- ISACA Review Manual — use as reference, not as a cover-to-cover read. Look things up when a question explanation surprises you.
- One reputable third-party question bank — for volume. Treat third-party questions with suspicion if their logic contradicts ISACA's; ISACA's own answer always wins.
Target volume: ~700–900 practice questions total, of which at least 300 in the final three weeks.
How to review a wrong answer properly
For every miss, record four things:
| Field | Example |
|---|---|
| Domain | D4 — Change management |
| What I picked | "Have the DBA approve the change" |
| Why it's wrong | DBA is not the change authority; and the DBA shouldn't approve changes they may implement |
| The rule | Change approval belongs to the change authority/CAB with business representation — never to the implementer |
The "rule" column is the only part you revise in December. Everything else is noise.
Score interpretation guide
| Practice score | Meaning | Action |
|---|---|---|
| < 55% | Gaps in understanding, not exam technique | Slow down. Re-read the domain notes. Do untimed questions |
| 55–65% | Borderline — most candidates sit here mid-plan | Identify your two weakest domains and re-study them properly |
| 65–75% | On track | Keep the mixed practice up; work on timing |
| 75–85% | Comfortable pass trajectory | Maintain. Focus on stamina and the wrong-answer log |
| > 85% | Strong | Do not get complacent — official QAE is easier than the real exam for some candidates |
Aim to enter the exam consistently above 75% on mixed, timed sets.
7. Risk management — plan for these now
| Risk | Likely when | Mitigation |
|---|---|---|
| Work travel / busy quarter | Unpredictable | The Sunday session is optional by design — losing it costs you only ~9 hours over the plan. If you lose a whole week, drop the Week 6 half-mock, never a new domain |
| Falling behind by week 6 | Common | Compress Domain 3 to 4 days (it's only 12%) and reclaim the time for D4/D5. Never compress Domains 4 or 5 |
| Plateauing at 60% | Weeks 8–10 | You are almost certainly memorising rather than reasoning. Switch to reading explanations only for a week, and force yourself to write the rule before checking the answer |
| Burnout | Week 9–10 | Take a full rest day. One day off costs nothing; a lost fortnight costs the attempt |
| Exam-day disaster (illness, travel) | December | ISACA allows rescheduling — check the deadline for your slot and the fee. Know it before you need it |
| Failed attempt | If it happens | Retake wait is 30 days. You now have a full wrong-answer log and know your weak domains — attempts 2 and 3 have a materially higher pass rate than attempt 1 |
8. What "ready" looks like on 20 December
Tick all six before you sit:
- I can state the 5 domains and their weights without looking.
- I can classify any control as preventive / detective / corrective and general / application, and explain input vs processing vs output controls.
- I score ≥ 70% consistently on mixed, timed 150-question sets, with time to spare.
- I have completed a full 4-hour timed mock without running out of time.
- My wrong-answer log has fewer than 15 open entries, and none in the top-weighted areas of Domains 4 and 5.
- I can recite the RTO/RPO/MTD relationship, the IR lifecycle, the order of volatility, and the recovery-site and cutover trade-offs from memory.
If you are missing more than two of these on 17 December, move the exam to January. A moved exam costs you nothing; a failed attempt costs 30+ days and a voucher.
9. Exam-day time budget
150 questions in 240 minutes = 1.6 minutes each. Most candidates finish with 30–60 minutes to spare, so do not rush the reading.
| Phase | Time | Action |
|---|---|---|
| Q1–50 | 0:00–1:20 | Steady pace. Flag anything you're unsure of and move on |
| Q51–100 | 1:20–2:40 | Same pace. Take a 2-minute stretch at the halfway point if the centre allows |
| Q101–150 | 2:40–3:40 | You will be tired. Read twice on the long scenario questions |
| Review | 3:40–4:00 | Only review flagged questions. Answer every single question — blanks are free marks thrown away |
Never leave a question blank. There is no negative marking.
10. Where to go next in this folder
| File | Use |
|---|---|
| 02-Domain1-IS-Auditing-Process.md | Weeks 1–2 |
| 03-Domain2-IT-Governance-and-Management.md | Weeks 3–4 |
| 04-Domain3-IS-Acquisition-Development-Implementation.md | Week 5 |
| 05-Domain4-Operations-and-Business-Resilience.md | Weeks 7–8 |
| 06-Domain5-Protection-of-Information-Assets.md | Weeks 9–10 |
| 07-Exam-Tactics-and-Question-Strategy.md | Read once in Week 1, again in Week 11 |
| 08-Rapid-Revision-Cheat-Sheet.md | Week 12 only — and the morning of the exam |
Source notes
Domain names, weights and official subtopic lists are taken from ISACA's published CISA exam content outline. Exam format (150 questions, 240 minutes, 450/800) is confirmed by ISACA. Fee, retake and waiver details are drawn from third-party summaries and publicly documented ISACA policy — verify all of them directly with ISACA before you rely on them financially or logistically.