An 8-Week CISA Study Plan for Working Professionals
This plan assumes six to eight hours a week and some IT or audit background. Adjust the pace to your experience.
The domain weights you are planning around
- Domain 1, Information System Auditing Process — 18%
- Domain 2, Governance and Management of IT — 18%
- Domain 3, Information Systems Acquisition, Development and Implementation — 12%
- Domain 4, Information Systems Operations and Business Resilience — 26%
- Domain 5, Protection of Information Assets — 26%
Week by week
Week 1 — Mindset and baseline. Learn the auditor's mindset rules: report, do not fix; independence; evidence quality. Do a short mixed quiz to find your starting point.
Week 2 — Domain 1. Audit planning, standards, sampling, evidence and reporting. Practice sampling and evidence questions until the ranking is automatic.
Week 3 — Domain 2. Governance, policies, risk, privacy, vendors and performance. Focus on who is accountable for what.
Week 4 — Domain 3. Projects, business cases, development methodologies, testing, release and migration.
Week 5 — Domain 4, part one. Operations, change and patch management, logging, service levels and databases.
Week 6 — Domain 4, part two, and first full mock. BIA, backups, resilience, BCP and DRP. Sit a full 150-question mock under time.
Week 7 — Domain 5 and weak areas. Access, network, encryption, cloud, monitoring and incident response. Drill your two weakest domains from the mock.
Week 8 — Final mock and review. Sit a second full mock. Book the exam when every domain is consistently at 70% or more.
Daily habits that work
- 20–30 questions a day, reading every explanation.
- Keep a mistake log with the mindset you missed, not just the topic.
- Retry your mistakes a few days later.
If you fall behind
Do not skip the mocks. Shorten topic study instead; the mocks reveal what matters.
Related on Auditor Path
Sources
ISACA CISA exam content outline (effective 1 August 2024).