How CISA and CISM Are Scored — and What 450 Really Means
Candidates often ask how many questions they need to get right. ISACA does not publish a raw-to-scaled conversion, so no one can give an exact number. Here is what is known.
The facts
- Both exams have 150 questions in 4 hours.
- Results are reported on a scaled score from 200 to 800.
- A score of 450 or higher passes.
- There is no penalty for wrong answers, so answer every question.
- The official score report shows your performance by domain.
Why a scaled score?
Different candidates see different sets of questions. Scaling adjusts for small differences in difficulty between exam forms, so 450 represents the same standard regardless of which form you sat.
What this means for you
- There is no fixed percentage that guarantees a pass. Anyone quoting one is guessing.
- Every domain matters. Weakness in a heavily weighted domain is hard to offset.
- Unanswered questions only cost you. Guess when unsure.
Judging readiness without a conversion
Use practice that mirrors the exam:
- Take full 150-question mocks in one timed sitting.
- Track accuracy by domain, not just overall.
- Aim for 70% or more in every domain on mocks written to ISACA's style before booking.
- Review every miss, and name the mindset you got wrong.
A commonly shared benchmark among candidates is around 70–75% on the official ISACA question bank. Treat any benchmark as a guide, not a guarantee.
If you do not pass
- You can request a rescore within 30 days of results for a fee.
- You can retake up to four times in a rolling 12 months, with waits of 30, then 90, then 90 days, paying the full fee each time.
- Compare your domain performance with your mock results and target the weakest areas.
Related on Auditor Path
Sources
ISACA Exam Candidate Guide; ISACA CISA and CISM certification pages.