Description: Preparing for the CISA exam? This guide covers the 2026 CISA exam fee, 150-question format, 450 passing score, exam difficulty, eligibility and preparation considerations, along with the key points candidates in Hong Kong should know before registering.
As Hong Kong’s only ISACA® Accredited Training Organization (ATO), KORNERSTONE has long provided ISACA-accredited training and official study materials to professionals. KORNERSTONE is also currently listed as an Elite partner in ISACA’s Accredited Training Partner Directory.
CISA (Certified Information Systems Auditor) is an internationally recognized certification awarded by ISACA. It covers information systems auditing, IT governance, risk, controls and the protection of information assets. This article focuses on the exam content, fees, passing score and difficulty, with the key points candidates should understand before taking the exam.
1. What Does the CISA Exam Cover?
The CISA exam consists of 150 multiple-choice questions and lasts 4 hours (240 minutes). The exam does more than test memory: candidates are expected to apply concepts in audit, risk, control and IT governance to practical situations.
The exam covers five domains:
| Exam Domain | Weighting | Main Focus |
|---|---|---|
| Information Systems Auditing Process | 18% | Audit planning, evidence collection, testing and reporting |
| Governance and Management of IT | 18% | IT governance, IT strategy and risk management |
| Information Systems Acquisition, Development and Implementation | 12% | Project governance, systems development and implementation |
| Information Systems Operations and Business Resilience | 26% | IT operations, business continuity and disaster recovery |
| Protection of Information Assets | 26% | IAM, network security, encryption and security monitoring |
Information Systems Operations and Business Resilience and Protection of Information Assets each account for 26% of the exam, making them the two highest-weighted domains.
2. How Much Does the CISA Exam Cost?
CISA exam registration fees vary depending on ISACA membership status:
| Fee Item | ISACA Member | Non-Member |
|---|---|---|
| CISA Exam Registration | US$575 | US$760 |
| Certification Application Fee | US$50 | US$50 |
| Annual Certification Maintenance Fee | US$45 | US$85 |
The member exam fee is US$185 lower than the non-member fee. A new ISACA Professional Membership currently costs US$145 per year, plus local chapter dues, so candidates may want to consider the overall cost before registering.
2.1 Do You Have to Pay Again If You Fail the Exam?
Yes. Each retake requires payment of the full Exam Registration Fee; there is no separate reduced retake fee.
Candidates may take the exam up to four times within a rolling 12-month period:
- After the first failed attempt: wait at least 30 days
- After the second failed attempt: wait at least 90 days
- After the third failed attempt: wait another 90 days
The full exam registration fee applies to each attempt.
3. What Is the CISA Passing Score and Pass Rate?
CISA uses a scaled scoring system from 200 to 800. Candidates need a score of 450 or higher to pass.
A score of 450 does not mean that a fixed percentage of questions must be answered correctly. ISACA converts the raw score to a common scaled score so that different versions of the exam can be reported on a consistent basis.
Candidates can view their preliminary pass/fail status immediately after the exam. The official score is emailed and made available in MyISACA within 10 working days.
3.1 What Is the CISA Pass Rate?
ISACA does not publish an overall global CISA pass rate, so different estimates found online should be treated carefully and checked against their sources.
KORNERSTONE’s ISACA programmes have a pass rate of over 85%, reflecting one of the strengths of our long-standing focus on ISACA certification training.
When preparing for the exam, it is more useful to focus on how well you understand the five domains and whether you are comfortable with the way CISA questions test judgement and application, rather than relying on an overall pass-rate figure.
4. Is the CISA Exam Hard?
How difficult the CISA exam feels depends heavily on your professional background.
If you already work in IT Audit, Internal Audit, Technology Risk or Internal Control, some of the concepts and question styles may feel more familiar. Candidates from more technical IT backgrounds may need more time to adjust to the audit, risk and control perspective used in CISA questions.
Many CISA questions are not simple definition checks. They present a practical situation and ask you to identify the most appropriate response. Preparation therefore involves more than learning individual concepts; candidates also need to understand how controls, risk, governance and audit fit together. This is one of the key differences between CISA and a purely technical certification.
For more information on eligibility, the Hong Kong registration process, preparation time and study planning, see CISA Exam 2026 | Eligibility and Preparation.
Planning to Take the CISA Exam?
As Hong Kong’s only ISACA® Accredited Training Organization (ATO), our CISA course uses official ISACA materials and focuses on scenario-based learning and practical application to help candidates understand the five exam domains and the audit mindset behind CISA.
If you would like to learn more about the CISA course, class schedule, preparation arrangements or fees, please contact our training consultants through Course Enquiry.
