What is the retake policy for the ISACA CISA exam?

The honest answer: ISACA retakes run on windows, not on a ladder

Start by unlearning the tidy rules you may have read elsewhere. ISACA does not operate a Microsoft-style ladder of fixed waiting periods, and tidy claims like "four attempts a year, each at least 30 days apart" that circulate on study blogs are invented numbers — ISACA does not publish a policy in that form, and you should not plan around figures nobody official has stated. What ISACA actually runs is a calendar of registration and testing windows throughout the year. If you do not pass in one window, your retake means registering — and paying — for a later window. The current retake terms live in ISACA's official candidate guide for your exam period, and that guide, not any blog, is the document to confirm against before you rely on a detail.

That structure has a consequence candidates rarely appreciate until they fail: the binding constraints on a CISA retake are the window cadence and the full fee per attempt. You cannot re-sit next week on adrenaline, and every attempt costs the same as the first. Those two facts, not an attempt cap, are what pace retakes — and used well, the forced gap between windows is the most useful study time you will ever be given.

What each attempt costs

Every CISA attempt is charged at the full exam fee — there is no discounted retake tier. ISACA prices the exam differently for members and non-members (non-members pay more; confirm the current figures on ISACA's site, as fees are revised periodically), which makes membership part of the retake maths: if a second attempt is likely, the member rate plus the cost of joining can total less than two non-member registrations. Budget honestly on that basis. Two attempts means two full fees, and the expense does not end at a pass: ISACA charges a one-time application fee of $50 when you apply for certification after passing. Candidates who budget only for the exam are routinely surprised by the tail of smaller costs, so plan for the whole sequence, not the first invoice.

Read your score report before you open a book

ISACA's result report is more useful than a bare pass or fail. Your overall score is reported on a scaled range of 200 to 800, with 450 as the passing line, and the report breaks your performance down by domain on that same scale. CISA's five domains — the information systems auditing process; governance and management of IT; information systems acquisition, development and implementation; information systems operations and business resilience; and protection of information assets — contribute differently to your result, and a fail is almost never uniform. Typically one or two domains sit well below the 450 line while the rest are at or above it. That breakdown is your repair map: it tells you whether you lost the exam on audit process, on governance judgement, or somewhere narrower, and it should decide how the weeks before the next window are spent.

A repair protocol sized to the window gap

Because the next window is usually weeks to a few months away, treat the gap as a structured repair period rather than a countdown to a cram. Rebuild the weakest domain first, and rebuild it in ISACA's own style: CISA questions reward audit doctrine — risk-based judgement, what an auditor should do first, what is most appropriate — far more than technical trivia. ISACA's official review questions, answers and explanations database exists precisely to calibrate that judgement, and drilling it domain by domain is the closest legitimate rehearsal for ISACA's question-writing habits. Re-test yourself in the repaired domain until your practice results there are consistently comfortable, then take one full timed rehearsal before registering. The mistake to avoid is spending the whole gap re-reading the domains you already passed; comfort is not the same as repair.

Start that repair within days of the result, while the sitting is still fresh. Sit down and write out every topic you remember struggling with — the stems you guessed on, the questions where two options both looked defensible — before the memory fades, then map each note to one of the five domains and check it against your score report. Where your memory and the report agree, you have found your study list. Then work backwards from the testing dates of the window you intend to target: pick the date, register for it, and let a fixed deadline discipline the weeks in between, instead of drifting towards an unscheduled "when I feel ready" that quietly never arrives.

Passing starts a second clock: the application

Passing the exam does not make you a CISA. Certification requires a separate application in which ISACA verifies your experience — five years of professional information systems audit, control or security work experience, with limited substitutions and waivers available (framework level; confirm the current requirements on ISACA's site) — and that application must be submitted within ISACA's stated period after your pass date, currently five years. A retake therefore carries a hidden cost beyond fees: every failed window delays not just the credential but the point at which your certification timeline starts, which matters if you were counting on certifying by a particular date. When you do pass, file the application promptly rather than letting the documentation age.

The short version

There is no published number of CISA attempts to memorise, because that is not how ISACA's policy works. Fail, and you register for a later window at the full fee; the window calendar sets your earliest realistic retry, and your domain-level score report should set your study plan. Confirm the current terms in ISACA's candidate guide, budget for two full fees plus the $50 application fee if a retake becomes necessary, and use the forced gap to repair a named domain rather than to re-read everything. When you want to check whether a weak domain has genuinely recovered before paying for another window, timed, domain-scored free practice tests are available on Study4Pass. If you are still sizing up the exam itself, knowing how difficult the CISA exam is and following the CISA exam roadmap will shape your first attempt, not just a retake.