What the course covers
About this course map
Five domains, mapped one-for-one to the ISACA CISA exam content outline and taught in the same order, so nothing on the exam is left uncovered.
The outline that defines the current CISA took effect on 1 August 2024. The five domain names and their weightings carried over from the previous job practice, but the content inside them was rewritten around disruptive technology and the way IT audit work is actually being done now — cloud-hosted estates, automation, data analytics used as evidence, and resilience as a board-level question. Each domain below carries its published weighting, and we give it classroom time in proportion.
CISA is an assurance exam, not a technology exam. The questions rarely ask how a control works; they ask whether it is operating, what evidence would prove it, and what the auditor should do about what the evidence shows. The teaching is built around that — scenario work, evidence judgement, and practice at picking the best answer when three answers are defensible.
Domain 01 — Information Systems Auditing Process
How an audit is planned, executed and reported, and the standards an IS auditor is held to while doing it. 18% of the exam.
Domain 02 — Governance and Management of IT
Whether the IT function is being directed and controlled in the interests of the enterprise, and whether anyone can demonstrate it. 18% of the exam.
Domain 03 — Information Systems Acquisition, Development and Implementation
Auditing a system while it is still being built, when a control gap is still cheap to close. 12% of the exam.
Domain 04 — Information Systems Operations and Business Resilience
The joint-largest domain: running systems day to day, and surviving the day they stop. 26% of the exam.
Domain 05 — Protection of Information Assets
The security domain, examined from the auditor's chair rather than the engineer's. 26% of the exam.
Who should take this
IT auditors and internal auditors moving into systems work, IT risk and compliance professionals, security managers who are audited often enough that they would rather understand the process, and finance or external auditors whose scope now includes IT general controls.
ISACA requires five years of professional information systems auditing, control or security work experience, gained within the ten years before the certification application, before it will award CISA. Waivers can reduce that by up to three years — a year of general audit or general information systems work, or a relevant degree, among others — but at least two years cannot be waived. You may sit the exam before you have the experience, and you then have five years from your pass date to apply for certification.
You will need general familiarity with how IT is organised and operated. You do not need to be technical, and you do not need to be able to configure anything.
The exam
The CISA is set and awarded by ISACA, and delivered at a test centre or by remote proctor.
Exam registration is purchased separately from ISACA. We arrange it on your behalf and send you the details, and you book your own exam date. Certification also requires a separate application evidencing the experience requirement, and agreement to ISACA's code of professional ethics and continuing education policy.
How we deliver it
Four days, classroom or online live, or at your office for a private group. The format is discussion-led: short teaching blocks, then audit scenarios where the group has to decide what to test, what evidence would satisfy them, and what they would put in writing. Domain checkpoints each day, and a full-length timed mock on the final afternoon, reviewed for why the wrong answers were attractive.
Mapped to the ISACA CISA exam content outline effective 1 August 2024. Taught from Hacky Security's own curriculum by instructors who hold the certification and run audit and assurance engagements for a living.
Exam & certification
- 1Train with us40 hours of instructor-led preparation, labs and practice questions.
- 2Sit the official examExam voucher sold separately. We buy it from the certification body on your behalf and send you the code — you book your own exam date.
- 3Get certifiedThe certification is awarded by ISACA when you pass their exam.
What you receive
- ISACA certification — issued by ISACA after you pass, and verifiable with them.
- Hacky Security certificate of completion — for the training itself, with a unique ID.
- Checkable by employers — anyone can confirm our certificate on the Verify page.
This course is Hacky Security’s own preparation training. The certification itself is awarded by ISACA, not by us.
Similar courses
Independent preparation training delivered from Hacky Security's own curriculum. Hacky Security is not affiliated with or endorsed by the certification body named above. Certification names and codes are the trademarks of their respective owners and are used only to describe what this course prepares you for.
