For many working professionals in Hong Kong, the first questions are practical ones: can you take the CISA exam before you have five years of relevant experience? Which parts of your current role can count toward certification? How soon after payment do you need to take the exam? And how much study time should you set aside while working full-time?
The CISA exam itself does not require five years of work experience. The five-year professional experience requirement applies when you formally apply for CISA certification. Treating the exam and certification as two separate stages makes it easier to plan your registration, study schedule and longer-term experience requirements.
For exam fees, language options, exam difficulty and the CISA passing rate, see our separate CISA Exam Guide. Before registering, it is more useful to map your work experience, understand the six-month exam eligibility period and set a realistic study schedule.
1. Can I take CISA without five years of IT audit experience?
Yes. ISACA allows candidates to take the CISA exam before they have met the full work experience requirement for certification. You can pass the exam first, then complete and verify the required professional experience before applying for the CISA credential.
| Stage | Main requirement | What to note |
|---|---|---|
| Take the CISA exam | No five-year experience prerequisite for the exam | You may sit the exam first and continue building eligible work experience afterwards. |
| Apply for CISA certification | Pass the exam + meet the experience requirement + submit the application | You must apply for certification within five years of passing the exam. |
| Work experience | Normally five years in information systems audit, control, assurance or security | Experience must fall within the ten years before the application date and be independently verified. |
If you currently work in IT, information security, internal audit, technology risk, controls or assurance but have not yet reached five years of experience, review your actual responsibilities against the CISA Job Practice Domains. This helps you identify which experience may count later and avoids waiting until you have five full years before starting exam preparation.
1.1 What work experience counts toward CISA certification?
For certification, ISACA requires at least five years of professional experience in information systems auditing, control, assurance or security. The current application also requires at least two years of experience performing tasks within the CISA Job Practice Domains. Experience can come from more than one role, provided the work itself matches the relevant domains and can be verified by an eligible supervisor, manager, colleague or client.
1.2 Can the CISA work experience requirement be waived?
Part of the five-year requirement can be satisfied through approved work-experience or education waivers. Under the current CISA Certification Application, the total waiver is capped at three years.
| Experience waiver | Possible waiver | Key point |
|---|---|---|
| General information systems or general audit experience | Up to 1 year | The period cannot overlap with CISA Domain experience already claimed. |
| Associate degree | 1 year | Supporting academic evidence is required. |
| Bachelor’s, master’s or doctoral degree in any field | 2 years | Supporting academic evidence is required. |
| Master’s degree in Information Systems or a related field | 3 years | This is the highest education waiver. |
| CIMA full certification / ACCA member status | 2 years | Relevant supporting evidence is required. |
Even with the maximum three-year waiver, the current application still requires at least two years of actual CISA Job Practice Domain experience.
2. When should candidates in Hong Kong register for the CISA exam?
CISA registration is available throughout the year. Once you register and pay, you receive a six-month exam eligibility period. The exam can be taken at an authorised PSI test centre or by remote proctoring, and ISACA states that candidates can schedule an appointment as early as 48 hours after payment.
Because the six-month period starts when you register, timing matters. If the next one or two months are likely to be dominated by a major project, business travel or a seasonal workload peak, it can be more practical to complete the first stage of study before paying and starting the eligibility period.
2.1 Hong Kong CISA registration flow
- Review your audit, IT, risk or security background and estimate how much study time you can realistically commit.
- Create or log in to your MyISACA account and make sure your name matches the government-issued ID you will use on exam day.
- Complete CISA exam registration and payment. This starts your six-month exam eligibility period.
- Use the PSI platform to choose a test centre or remote proctoring.
- Book the exam date based on your study progress. Exam appointments are currently released up to 90 days in advance.
- If you need to reschedule, do so at least 48 hours before the appointment.
If six months is not enough, the 2026 ISACA Candidate Guide allows one additional six-month exam extension for US$75. The extension option appears in the account during the specified period around the original eligibility expiry, and each exam registration can be extended only once.
3. How long should I study for CISA?
ISACA does not prescribe a fixed number of study months. The amount of preparation you need depends heavily on your professional background. Candidates with IT audit or internal audit experience are usually more familiar with audit, risk and control language. Candidates from technical IT or cybersecurity roles often need more time to become comfortable with governance, assurance and audit judgement.
| Background | Common preparation focus | Suggested approach |
|---|---|---|
| IT Audit / Internal Audit | ISACA question style, weaker domains, BEST / MOST judgement | Move into question practice and timed work earlier. |
| Technology Risk / Control / Compliance | Translate day-to-day risk and control work into ISACA audit logic | Build the Domain framework first, then focus on scenario questions. |
| Technical IT / Cybersecurity | Audit, governance, assurance and control objectives | Allow more time to understand audit logic instead of memorising answers. |
For a working professional, two to four months can be a reasonable starting point for planning, then adjusted according to the hours you can study each week and your practice performance. This is a planning reference, not an ISACA requirement.
4. How should I start preparing for CISA?
Start by understanding the five CISA Domains as one framework, then use practice questions to identify weak areas. This usually gives you a clearer study plan than focusing on question volume from the beginning.
- Review the current CISA Job Practice and exam scope so you understand the role of each Domain and how the Domains connect.
- Use the CISA Official Review Manual to build your knowledge framework. The first pass does not need to memorise every detail.
- Practise with official Questions, Answers & Explanations (QAE) and record why you missed a question rather than simply memorising the correct option.
- Return to weak areas through the manual or instructor explanation, then repeat similar questions to confirm understanding.
- Schedule full timed practice before the exam to improve pacing and time allocation.
Pay particular attention to qualifiers such as MOST and BEST. Several options can appear reasonable, but the task is to choose the answer that best reflects the audit, risk or control priority in the scenario. When reviewing mistakes, write down why your original choice was wrong; this helps you adapt to ISACA question logic rather than memorising isolated answers.
5. Self-study or a CISA course?
If you already have a solid audit or risk background and can maintain a regular study schedule, official ISACA materials and QAE can form the core of a self-study plan. If work is busy, audit thinking is unfamiliar, or you want help connecting the Domains, an instructor-led CISA course can make it easier to structure your preparation.
If you are comparing the best CISA prep course for your situation, focus on practical differences rather than the provider name alone: current official materials, instructor experience, learning format and the quality of scenario-based practice all affect how useful the training will be. For candidates considering online CISA courses, flexibility is important, but so is whether the format gives you enough feedback on question logic and weak areas.
When comparing a CISA course or CISA training option, check these four points:
- Whether the provider is an ISACA Accredited Training Organization and uses current official ISACA materials.
- Whether the instructor has practical experience in IT audit, technology risk, governance or information security.
- Whether the delivery format fits your schedule: instructor-led, virtual instructor-led and self-study each suit different learners.
- Whether the course connects the study material, practice questions and scenario judgement instead of only reading through notes.
KORNERSTONE is currently listed in the Elite category of the ISACA Accredited Training Partner Directory. Its CISA programme is a 29-hour instructor-led course and includes official ISACA materials, practical case studies and experience sharing. These are concrete factors to compare if you want more structure around audit thinking, scenario judgement and your weaker areas.
6. What should I check before registering?
| Current situation | Suggested arrangement |
|---|---|
| You have less than five years of relevant experience | You can prepare for and take the CISA exam now while continuing to build and document experience for certification. |
| You have relevant experience but have not organised it | Map your responsibilities to the CISA Job Practice Domains, employment periods and the people who can verify the experience. |
| You plan to take the exam within six months | Allow roughly two to four months for preparation, then start the six-month eligibility period when your schedule is realistic. |
| Self-study is inconsistent or audit thinking is unfamiliar | Consider instructor-led training to structure the concepts, scenario questions and weaker areas. |
Interested in preparing for the CISA exam?
If you want to review your work experience, preparation timeline, course schedule or official study materials before committing to an exam date, you can contact a KORNERSTONE training consultant through Course Enquiry. If you are still building the experience required for CISA certification, you can also plan the exam and certification timeline in parallel rather than waiting until all five years are complete.
