Failed CISA or CISM? Retake Rules, Costs and a Recovery Plan
Not passing on the first attempt is common, and the score report is not very detailed. Here are the rules, the costs and a practical plan.
The rules (ISACA Exam Candidate Guide)
- Four attempts are allowed in a rolling 12-month period.
- Wait 30 days after the first attempt, then 90 days before the third and the fourth.
- Each attempt costs the full registration fee — US$575 for ISACA members and US$760 for non-members at the time of writing.
- You can request a rescore within 30 days of receiving results, for a US$75 fee.
Always check isaca.org for the current rules before scheduling.
Reading the score report
The score report shows performance by domain, not which questions or subtopics you missed. Look for patterns: weakness in governance-heavy domains usually points to a mindset problem rather than a knowledge gap.
A 30-day recovery plan
Week 1 — Diagnose. Take a full 150-question mock under exam conditions. Compare your domain results with the score report.
Week 2 — Fix the mindset. For every question you miss, read why each distractor is wrong and name the mindset being tested (report, don't fix; business impact first; escalate to the owner).
Week 3 — Target weak domains. Drill your weakest two domains by subtopic, weighted by their share of the exam.
Week 4 — Rehearse. Take a second full mock. Book the exam only when every domain is consistently at or above your readiness target.
Related on Auditor Path
Sources
ISACA Exam Candidate Guide; ISACA support article on retake rules; ISACA CISA and CISM certification pages.