CISA — Certified Information Systems Auditor
Practise audit decisions across the five CISA domains, with an explanation for every option.
Try 10 free questions and see your levelTake a full mock exam
- 500 questions in the bank
- 150 questions in 240 min per mock
- 50 flashcards
Every option explained so you understand why
If your exam were today, would you pass?
Try 10 free questions without signing up. Get your score and find your weak areas as soon as you finish.
A payment processor's IT director refuses audit access because the audit function has no approved mandate. What should the chief audit executive obtain first?
All 10 free questions with answers and an explanation for every option
450 on the 200–800 scale This is your practice accuracy. It cannot be converted to the exam’s scaled score or used to determine whether you pass.
What you get
- 500questions in the bankPractise with the answer shown right away, or sit a full timed mock
- 5unitsSplit by the exam syllabus
- 50flashcardsTo lock in terms and definitions
- 80quick review pointsEach unit in a few key lines
Unit map
- 01Information Systems Auditing Process27 questions
- 02Governance and Management of IT27 questions
- 03Information Systems Acquisition, Development and Implementation18 questions
- 04Information Systems Operations and Business Resilience39 questions
- 05Protection of Information Assets39 questions
Exam facts
CISA — Certified Information Systems Auditor — Number of questions: 150 questions. Exam time: 240 minutes. Pass mark: 450 on the 200–800 scale. Calculator: Not permitted. Exam fee: US$575 for members; US$760 for nonmembers. Source: ISACA (Last verified: 2026-11-04). Question bank: full mock exams of 150 questions in 240 minutes, like the real test with a result for every unit, plus 500 explained questions across 5 units, every option explained, a review of your mistakes, and two ways to practise: see the answer right away, or sit a full timed mock. Free questions: a 10-question diagnostic test covering the main units, no sign-up; at the end you get your score and your weakest units.
- Exam language
- English or English or English or English or English or English or English
- Number of questions
- 150 questions Source
- Exam time
- 240 minutes Source
- Pass mark
- 450 on the 200–800 scale Source
- Calculator
- Not permitted Source
- Exam fee
- US$575 for members; US$760 for nonmembers Source
- Registration
- Registration is open throughout the year; eligibility lasts six months. Source
- Retakes
- Up to four attempts in a rolling 12 months, with waiting periods of 30, 90 and 90 days after failures. Source
Last verified: 2026-11-04
Where other sources differ
- Arabic explanations support study; Arabic is not a listed CISA exam language.
- Passing the exam is one step toward certification; experience and an application are also required.
How to register
- Create an ISACA account and use the name on your accepted government identification.
- Register and pay for the CISA exam in your chosen exam language.
- Use MyISACA to schedule a PSI test-centre or remotely proctored appointment within the eligibility period.
Exam body
ISACA: Official website: ISACA
Study guides
Frequently asked questions
Is 450 out of 800 a percentage pass mark?
No. CISA uses a scaled score. A practice percentage cannot be converted directly to the official score.
Can I try CISA questions for free?
Yes. Free questions: a 10-question diagnostic test covering the main units, no sign-up; at the end you get your score and your weakest units. The free practice test page lists the same questions with answers and an explanation for every option. The rest of the questions and the full mock exams come with a pass from SAR 26.
What makes this CISA question bank different?
Question bank: full mock exams of 150 questions in 240 minutes, like the real test with a result for every unit, plus 500 explained questions across 5 units, every option explained, a review of your mistakes, and two ways to practise: see the answer right away, or sit a full timed mock. Every question is reviewed and referenced, ready to practise on your phone. Try the free questions and read the explanations before buying full access.
Can I study with Arabic explanations?
Yes. Questions and explanations are available in English and Arabic here. The official exam is offered in seven languages, including English, but not Arabic.
Is this an official site, and how do I pay?
It is an independent site, not part of Qiyas or any government body, and every question is reviewed before it is published. You pay once, with no automatic renewal, through Waffo Pancake (the merchant of record) by Visa, Mastercard, Apple Pay or Google Pay, and your statement shows "WAFFO". If you were charged twice or the pass did not open, email support@saudiexams.com.
Study material sample: Information Systems Auditing Process
Summary
Learn to plan, execute and communicate a risk-based information-systems audit. Connect the audit objective to testing, evidence, conclusions and follow-up while applying professional ethics and systematic quality practices.
What the exam focuses on
- Translate the mandate and risk assessment into a scoped audit plan.
- Select audit types, control tests and sampling methods suited to the objective.
- Evaluate evidence quality and use analytic or automated techniques appropriately.
Show 2 more
- Communicate supported conclusions and verify risk-focused remediation.
- Apply ethics and improve audit quality through structured feedback.
Common traps
- A larger sample does not repair an incomplete population or an irrelevant test objective.
- An approval policy shows intended design; completed approvals provide evidence of operation.
- A dashboard or continuous feed is evidence input, not an automatic assurance conclusion.
Show 3 more
- Do not extrapolate a judgmental sample as if it had a quantified statistical error bound.
- A planned fix or reminder is not proof that the underlying risk was addressed.
- A control deficiency below the material-weakness threshold may still require oversight attention; do not equate 'not material' with 'not worth reporting.'
Try the flashcards
Tap a card to see the answer
What separates an audit plan from an audit program?
The plan organizes nature, timing, extent and resources; the program gives procedural steps.
What should precede a population conclusion from an extract?
Validate that the data and selection cover the intended population and objective.
Which test checks whether an approval control operated?
Compliance testing of actual approval evidence during the period.
What does substantive recalculation address?
Accuracy of recorded amounts, rather than merely the presence of approvals.
Why investigate contradictory audit records?
Professional skepticism requires critical assessment before accepting a conclusion.
How does parallel simulation produce evidence?
Independent reprocessing of application data is compared with application output.
What limits an audit opinion's scope?
The work performed, evidence obtained and criteria actually evaluated.
What is the purpose of post-audit follow-up?
Evaluate whether identified risk has been sufficiently addressed.
Why you can trust these questions
- Published questions: 500. We reviewed every one before publishing it: the answer, the explanation of each option and the source.
- Exam facts last checked against the organiser’s website: 2026-11-04. We check them again every three months and two weeks before each test.
- Found a mistake? Tap "Report an error" under any question in the practice area, or email us at support@saudiexams.com
- Independent website. Not affiliated with ETEC (Qiyas), the Financial Academy or any government body.