The CISA Domain Weightings, and Where to Actually Spend Your Study Time

The five CISA domains are not equal, and studying them as if they were is the most common way to waste prep time. Two of the five domains carry more than half the exam between them, while the lightest domain is barely a tenth of it. If you split your study hours evenly across all five, you are overinvesting in the small domains and underinvesting in the ones that decide whether you pass. The fix is simple: budget your time by the actual weightings.

This guide gives you the exact CISA domain weightings from the current 2024 exam content outline, explains what each domain covers, and then does the thing most pages skip: it maps those percentages to where you should actually spend your study time. If you only remember one thing, make it this: Domains 4 and 5 together are 52 percent of the exam, per ISACA.

Quick takeaways

• The CISA has 5 domains (ISACA calls them job practice areas), reweighted in the 2024 outline effective August 1, 2024.
• Domain 4 (IS Operations and Business Resilience) and Domain 5 (Protection of Information Assets) are 26 percent each, so together they are 52 percent of the exam.
• Domain 3 (IS Acquisition, Development and Implementation) is the lightest at 12 percent. Domains 1 and 2 are 18 percent each.
• The exam is 150 questions in 4 hours, and you pass at 450 on a scaled 200-to-800 range, per ISACA. The scaled score is not a raw percentage.
• Budget study hours to the weightings, not evenly. Front-load Domains 4 and 5.
• PrepClubs is independent prep material and is not affiliated with or endorsed by ISACA.

The 5 CISA domains and their 2024 weightings

Here are the current CISA domains and their percentage weightings, taken from ISACA's official CISA exam content outline effective August 1, 2024. Watch out for older articles that still list Domain 1 at 21 percent; that is the pre-2024 number and it is wrong for the current exam.

The shape of that table is the whole point. This is not a flat five-way split. Two domains dominate, one is deliberately light, and two sit in the middle. Your study plan should look like this table, not like a neat 20-percent-each grid.

What each domain actually covers

Weightings only help once you know what sits inside each domain. Here is the short version, grounded in ISACA's outline.

• Domain 1, Information Systems Auditing Process (18%). How you plan and execute an audit: risk-based audit planning, evidence collection, sampling, audit standards and ethics, and reporting results. This is the auditor's core craft.
• Domain 2, Governance and Management of IT (18%). IT strategy, policies, organizational structure, enterprise architecture, IT resource and portfolio management, and how IT aligns to business goals. The board-and-strategy layer.
• Domain 3, Information Systems Acquisition, Development and Implementation (12%). Project management, the systems development life cycle, requirements and testing, and controls around building or buying systems. The lightest domain, but do not skip it.
• Domain 4, Information Systems Operations and Business Resilience (26%). IT operations, service management, incident and problem handling, business continuity and disaster recovery. Nearly a quarter of the exam on its own.
• Domain 5, Protection of Information Assets (26%). Logical and physical access controls, network and endpoint security, encryption, data classification, and security awareness. The other quarter.

Where to actually spend your study time

Most CISA domain guides stop at the table. That is where they leave value on the table, because a weighting is a study instruction if you read it that way. Here is a defensible way to budget a study block by the weightings.

Two deliberate tweaks. First, give Domain 1 a slightly larger share than its 18 percent, because the auditing-process mindset threads through questions in every other domain. If you understand risk-based planning and the auditor's report-do-not-implement stance, you answer better across the whole exam. Second, do not over-cut Domain 3. It is the lightest at 12 percent, but a candidate who ignores it entirely can still lose a pass over a handful of SDLC and project-management items.

The headline instruction stands: if Domains 4 and 5 are 52 percent of your exam, they should be roughly half your study time. Front-load them.

A quick word on the scaled score

The passing mechanics confuse people, so clear it up before you plan. The CISA is 150 questions in 4 hours, and you pass at 450 on a scaled range of 200 to 800, per ISACA. A 450 does not mean you answered 450 of anything, and it does not map to "56 percent correct." ISACA converts your raw performance to the 200-to-800 scale so scores stay comparable across exam versions. The practical takeaway for study planning: practice to a clear margin above passing on full-length sets rather than trying to hit an exact percentage.

FAQ

What are the 5 CISA domains?

They are: (1) Information Systems Auditing Process, (2) Governance and Management of IT, (3) Information Systems Acquisition, Development and Implementation, (4) Information Systems Operations and Business Resilience, and (5) Protection of Information Assets. These are ISACA's five job practice areas for the current exam.

What are the current CISA domain weightings?

Per ISACA's 2024 outline (effective August 1, 2024): Domain 1 is 18 percent, Domain 2 is 18 percent, Domain 3 is 12 percent, Domain 4 is 26 percent, and Domain 5 is 26 percent. Domains 4 and 5 together are 52 percent of the exam.

Did the CISA domains change in 2024?

Yes. The exam content outline was updated effective August 1, 2024, adjusting the weightings across all five domains. Older guides that list Domain 1 at 21 percent are using the retired pre-2024 numbers. The current figure for Domain 1 is 18 percent.

Which CISA domain is the most important to study?

By weight, Domains 4 and 5 (26 percent each) matter most, since together they are more than half the exam. Domain 1 deserves a slight overinvestment because its auditing mindset carries into the other domains. Domain 3, at 12 percent, is the lightest, but do not skip it entirely.

How many questions are on the CISA exam?

The CISA is 150 multiple-choice questions delivered over 4 hours, per ISACA. Passing is a scaled score of 450 on a 200-to-800 range, which is not a raw percentage of questions answered correctly.

How should I budget study time across the CISA domains?

Mirror the weightings. Give Domains 4 and 5 roughly half your hours combined, give Domain 1 slightly more than its 18 percent because it underpins the rest, hold Domain 2 near 18 percent, and keep a smaller but real block for Domain 3. Do not split your time evenly.

Related on PrepClubs

• CISA Practice Questions: What to Pay and Why Auditor-Judgment Depth Matters
• How Hard Is the CISSP, Really, and Why Technical People Fail It
• The 8 CISSP Domains Explained, With Their Exact 2024 Weightings

The CISA is a judgment exam, and the fastest way to waste study time on it is to treat all five domains as equal when two of them are more than half the test. Budget your hours to the weightings, front-load Operations and Resilience and Protection of Information Assets, and practice on full-length sets that mirror the domain mix. PrepClubs' CISA track is built on original scenario questions across all five domains, weighted the way the real exam is, each with a written rationale that models the auditor's judgment, plus a free diagnostic to find your weak domains first. It is a one-time purchase with 30 days of access, not a renewing subscription you rent by the year. If you prepare with PrepClubs and do not pass your real test, we extend your access at no extra cost. No fine print. PrepClubs has helped more than 1,600 students prepare for cognitive and certification assessments. Start with the free CISA diagnostic.