The 12-Week CISA Study Plan That Got Me Through on the First Try

I knew nothing about IS auditing when I started. Three months and a lot of coffee later, I walked out of the testing center with a CISA pass. Here's the exact plan I followed — week by week, resource by resource.

The Certified Information Systems Auditor (CISA) has a reputation for being dry. And honestly? Parts of it are. But the structured approach I'm about to share turns a massive, intimidating syllabus into manageable weekly chunks. No heroics required.

CISA at a Glance: What You're Up Against

Before we dive into the study plan, let's understand the beast. CISA is administered by ISACA and it's one of the most respected certifications in IT audit, risk, and governance.

Quick Facts

The Five Domains

Domains 4 and 5 together account for 50% of the exam. If you're short on time, that's where to focus. But don't neglect Domain 2 — governance questions are conceptually tricky even if the weight is lower.

The 12-Week Study Plan

This plan assumes 10-15 hours per week. If you can do more, compress it. If you're working full-time with family obligations (like I was), 12 weeks is realistic without burning out.

Weeks 1-2: Domain 1 — IS Auditing Process (21%)

Start here because it sets the foundation. Everything in CISA comes back to audit methodology.

• Topics: Audit standards, risk-based audit planning, audit evidence, reporting, follow-up
• Study: ISACA CRM Chapter 1 + supplement with online videos
• Practice: 50 questions per day on ExamCert CISA practice tests
• Key insight: ISACA loves asking "what should the auditor do FIRST?" — learn the audit lifecycle cold

Weeks 3-4: Domain 2 — Governance and Management of IT (17%)

This is where people get tripped up. It's abstract, policy-heavy, and the questions test judgment more than knowledge.

• Topics: IT governance frameworks, IT strategy, resource management, risk management, quality assurance
• Study: CRM Chapter 2 + COBIT 2019 overview (don't deep-dive COBIT, just understand the principles)
• Practice: Focus on scenario questions — "The board wants to ensure IT alignment. What's the BEST approach?"
• Key insight: Think like a senior auditor advising the board, not a technician fixing systems

Weeks 5-6: Domain 3 — IS Acquisition, Development & Implementation (12%)

Lowest weight domain. Don't overthink it, but don't skip it either.

• Topics: SDLC, project governance, testing methodologies, change management, data migration
• Study: CRM Chapter 3 — this one reads faster than the others
• Practice: 30 questions per day
• Key insight: Know the difference between unit testing, integration testing, system testing, and UAT inside out

Weeks 7-9: Domain 4 — IS Operations and Business Resilience (23%)

Second-heaviest domain and, in my experience, the most practical. If you've worked in IT operations, you'll recognize a lot.

• Topics: IT service management, database management, BCP/DRP, incident management, change management
• Study: CRM Chapter 4 — spend extra time on BCP/DRP, it's heavily tested
• Practice: 50 questions per day, focus on BCP scenarios
• Key insight: Recovery Time Objective (RTO) vs Recovery Point Objective (RPO) — know these cold and how they drive technology decisions

Weeks 10-11: Domain 5 — Protection of Information Assets (27%)

The biggest domain. Overlaps significantly with CISSP content if you've studied security before.

• Topics: Access controls, network security, encryption, data classification, privacy
• Study: CRM Chapter 5 + review crypto concepts (symmetric vs asymmetric, PKI, hashing)
• Practice: 50+ questions per day on ExamCert
• Key insight: CISA tests security from an auditor's perspective, not a practitioner's. You need to evaluate controls, not implement them.

Week 12: Full Review + Mock Exams

The final week is all about simulation and confidence building.

• Take 2-3 full-length mock exams (150 questions, 4 hours, timed)
• Review every wrong answer — don't just read the explanation, understand why you picked the wrong one
• Re-read your notes on weak areas
• Light review only on exam eve — your brain needs rest, not cramming

Resources That Actually Helped

I tried a bunch of resources. Here's what was worth the money and time:

Must-Have (Non-Negotiable)

• ISACA CISA Review Manual (CRM): Dense but essential. It's the source material for exam questions.
• ExamCert CISA Practice Tests: 1000+ questions with detailed explanations. The spaced repetition feature is what pushed my scores from 60s to 70s.
• ISACA QAE Database: Official questions from ISACA. Different style from third-party questions.

Nice-to-Have

• Hemang Doshi's CISA videos: Good for visual learners. Covers all domains in plain language.
• IT Audit/Security study groups: Reddit r/CISA, Discord servers — helpful for motivation and clarifying concepts

CISA vs CISSP: Which Should You Get?

This comparison comes up constantly. Short answer: they serve different careers.

CISA is for people who audit, assess, and evaluate IT systems. CISSP is for people who design, implement, and manage security programs. There's overlap in Domain 5, but the perspective is completely different.

If you work in GRC, internal audit, or compliance → CISA first. If you work in security operations, architecture, or engineering → CISSP first. If you want both (many CISO-track professionals do), CISA is easier to get first and the security knowledge transfers.

5 Mistakes That Almost Failed Me

Learn from my screw-ups:

1. Studying like a technician. CISA questions ask "what should the IS auditor recommend?" not "how do you configure a firewall." I kept picking technically correct answers that were wrong from an audit perspective.
2. Ignoring ISACA's thinking framework. ISACA has a specific way of ranking answer priority: risk-based, governance-first, prevention over detection. Once I internalized this, my scores jumped 10%.
3. Skipping BCP/DRP. I thought I knew disaster recovery. I didn't know it the CISA way. Audit perspective on BCP is different from implementation perspective.
4. Not timing practice exams. 150 questions in 4 hours is roughly 1.6 minutes per question. That's tight. Practice under time pressure.
5. Over-studying Domain 3. At 12%, it's the smallest slice. I spent too much time on SDLC details that barely appeared on the exam.

Is CISA Worth It in 2026?

Absolutely. IT audit and governance aren't going away — if anything, AI and cloud adoption are creating more audit demand, not less. CISA holders earn an average of $120,000-$150,000 in the US, with senior audit managers pushing past $180,000.

The cert also pairs well with CISM for a management track, or with cloud certs like AWS SAA-C03 for cloud audit specialization.

Frequently Asked Questions