Certified Information Systems Auditor (CISA)

Readers mistake this for a technical certificate

The table is the whole argument. An auditor is not paid to make a system secure and is not paid to say whether it is. An auditor is paid to say whether the organisation can demonstrate, to somebody outside the room, that a control existed, operated throughout the period, and left evidence behind. That stance runs through all 150 questions, and it is why engineers with years of hands-on security sometimes score below compliance officers who have never opened a firewall console. The engineer knows what a good configuration looks like. The exam wants to know whether the configuration change was approved, logged, reviewed and reconciled, and whether the reviewer was somebody other than the person who made it.

Five domains, weighted toward operations and protection

ISACA's outline splits the syllabus into five domains: the audit process itself, governance and management of IT, the acquisition and development of systems, operations and business resilience, and the protection of information assets. The last two carry the largest share at roughly a quarter each, and they are where candidates from a pure audit background lose the most marks, because they demand a working grasp of backups, incident handling, access control and encryption at the level of knowing what evidence each one should produce. The first three domains reward audit reasoning and can be learned from the outline and a good question set. The last two reward having sat next to the people who run systems.

• Four hours for 150 questions works out at a little over a minute and a half each, which is comfortable until a scenario runs to a paragraph and every option sounds defensible.
• Scores are scaled from 200 to 800 and 450 passes. The scale means a raw percentage tells you nothing; treat practice scores as directional only.
• PSI centres or remote proctoring, and remote sitting changes nothing about the paper. It does change how you handle scratch notes, so read the rules before the day.
• Ten exam languages, and some translations appear only in certain windows. If you want to sit in German or Japanese, check availability before you plan the date.

The exam is the middle of the process, not the end

Certification requires five years of professional audit, control or security work, with waivers of up to three years for degrees and related experience, and it can be claimed up to five years after passing. Passing first and applying later is common and sensible for anyone a year or two short. Once certified, upkeep is a minimum of 20 continuing-education hours every year and 120 across each three-year reporting cycle, plus an annual maintenance fee, discounted for members. None of that is onerous for somebody working in the field, and all of it is invisible in a comparison that stops at the sitting fee.