CISA Study Plan: Six Weeks of Audit Practice and Review
Build a six-week CISA preparation schedule around domain coverage, evidence-based error review and timed mixed practice.
This six-week plan is an adaptable practice schedule, not an ISACA requirement or a prediction of preparation time. Extend it if audit concepts or several technology areas are unfamiliar. Begin with the official scope and reserve time for reviewing explanations, not just answering more questions.
Establish a useful baseline
Start with a mixed set in IT Mastery and record your answer before opening the explanation. For each uncertain or incorrect response, write what you believed the question was asking and the detail that changed the answer. A correct guess belongs in the review list too.
Separate three kinds of gaps: an unfamiliar concept, a misread condition, and a procedure that addresses the wrong assertion. They need different repairs. Read a short reference for a concept gap; annotate a timeline for a missed condition; compare evidence sources for an assertion gap.
Six-week preparation sequence
| Week | Main work | Evidence of progress |
|---|---|---|
| 1 | Audit purpose, independence, control design/operation, populations, sampling and reporting. | Explain why a procedure supports one assertion and not another. |
| 2 | Governance, risk ownership, policy exceptions, sourcing, data governance and performance measures. | Identify the responsible decision-maker and the limit of the auditor’s authority. |
| 3 | Business cases, requirements, development, testing, releases and conversion. | Trace an approved requirement through testing and explain a reconciliation gap. |
| 4 | Operations, availability, incidents, dependencies, backup and recovery. | Calculate a recovery result and identify business dependencies missing from a technical success report. |
| 5 | Access, physical/security controls, protection of data, monitoring and incident evidence. | Distinguish the exposure reduced by each control and the evidence needed to evaluate it. |
| 6 | Mixed timed practice, targeted repairs and a fresh attempt after a delay. | Apply the reasoning to different facts without relying on remembered answer positions. |
Every week, revisit a small selection from earlier domains. The sequence introduces areas one at a time; your later sessions should mix them because real assurance decisions connect governance, operations and protection.
Allocate practice time without neglecting a domain
Use the official 18/18/12/26/26 domain weights as a starting allocation, then add time where errors persist. For an illustrative 20-hour review block, that baseline is 3.6 hours, 3.6 hours, 2.4 hours, 5.2 hours and 5.2 hours. Those are planning proportions, not promised test-form question counts or mandatory study hours.
Keep Domain 3 in the schedule even though its published weight is lower. Release, conversion and readiness decisions connect directly to operational and security risks. Conversely, strong security knowledge does not remove the need to learn audit evidence, independence and governance responsibilities.
A repeatable study session
- Recall one distinction without notes: for example, completeness versus accuracy.
- Answer a short set with explanations hidden and note uncertainty.
- Explain the decisive evidence for each missed or guessed answer.
- Change one fact and predict whether the answer would change.
- Revisit the idea several days later through a fresh scenario.
For a 45-minute session, an editorial starting split is 5 minutes of recall, 20 of answering and 20 of review. Reduce the number of questions when the explanations expose deeper gaps. Finishing a fixed daily quota matters less than correcting the reasoning.
Make an error log that changes the next session
| Record | Useful example |
|---|---|
| My assumption | I treated a recent demonstration as evidence for the quarter. |
| Deciding fact | The assertion concerns every scheduled review during the period. |
| Better rule | Match evidence to the asserted period and population. |
| Next check | Examine a different case involving repeated backup tests. |
Do not copy an entire explanation into a log and call it learned. A brief rule plus a changed-fact example makes the distinction easier to retrieve and test.
Rehearse timing and review
The public 150-question set supports a four-hour manual practice attempt. That averages 96 seconds per question, including review time. One possible rehearsal budget is 210 minutes for a first pass and 30 for flagged items; this is a practice choice, not an official pacing rule.
During an untimed learning session, take the time needed to understand evidence. During a timed rehearsal, mark uncertainty, choose the best supported response and continue. Check current official candidate instructions for exam-day navigation and administration.
Score the public set as correct responses divided by 150. ISACA’s scaled passing score cannot be converted into a raw percentage using 450/800. Repeated attempts on a familiar set overstate readiness; use fresh cases and your error patterns when deciding what to review next.
Keep the cheat sheet for recall and the scenario guide for decisions you still cannot explain.