CISA Roadmap: Is the Exam Retiring? Exam, Experience, CPE

Is CISA going to retire? No — and here is why the question comes up

Let us answer the retirement half of this question first, because it shapes everything else: ISACA has announced no retirement for CISA. The Certified Information Systems Auditor credential is ISACA's flagship certification and one of the most widely held audit credentials in the industry. There is no published end date, no announced successor credential, and no migration programme — the things that always accompany a genuine retirement. If you have been planning your CISA timeline around a rumoured shutdown, you can stop: plan around your own readiness instead.

The confusion comes from something real that looks similar from the outside: ISACA regularly updates CISA. That update cycle, explained next, is a refresh — the opposite of a retirement.

Refresh versus retirement: how ISACA maintains CISA

Every few years, ISACA runs a job practice analysis: it studies practising information systems auditors to establish what their work actually involves now, then rewrites the exam's domain structure and weightings to match. The most recent cycle produced the 2024 job practice, and the live exam is built on it. The credential keeps the same name, the same standing, and the same holders — only the content blueprint moves, so the exam tests today's audit work, including cloud environments, modern resilience expectations, and current privacy concerns, rather than the work of a decade ago.

A retirement would look completely different: ISACA would announce a final exam date, stop accepting new candidates, and explain what happens to existing holders. None of that has happened for CISA.

What a refresh means for you depends on where you are:

• Starting prep: study only materials aligned to the current job practice. A second-hand review manual from before the 2024 update teaches to a blueprint that no longer exists.
• Mid-prep when a refresh lands: your fundamentals still count — auditing principles change slowly — but you must re-map your study plan to the new domain weightings and pick up any newly emphasised topics.
• Already certified: nothing happens to your credential. Refreshes affect future candidates, not existing holders, who simply keep up their continuing education, covered below.

The roadmap, step 1: the exam itself

The CISA exam is 150 multiple-choice questions in 4 hours, delivered at test centres or via remote proctoring. Four hours sounds generous until you do the arithmetic: roughly a minute and a half per question, and CISA questions are famously wordy scenario items where you must choose the best answer among several defensible ones. The exam is organised into five domains; ISACA publishes the exact weightings for the current job practice, and the emphasis below is approximate:

• Domain 1 — Information Systems Auditing Process: planning audits, assessing risk, and executing engagements to professional standards.
• Domain 2 — Governance and Management of IT: how organisations direct and control IT, and the auditor's view of that governance.
• Domain 3 — Information Systems Acquisition, Development and Implementation: auditing projects, system development, and go-live controls.
• Domain 4 — Information Systems Operations and Business Resilience: day-to-day operations, incident and problem management, and continuity arrangements.
• Domain 5 — Protection of Information Assets: security controls, access management, and the protection of data and infrastructure.

Passing the exam, however, does not by itself make you a CISA. That is step 2 — and its order surprises people.

Step 2: pass first, then apply — the experience requirement

You may sit the CISA exam before you meet the experience requirement, and many candidates do exactly that while working in audit, control, or security roles. But the credential is awarded only after you apply and ISACA verifies that you have five years of professional experience in information systems auditing, control, assurance, or security work.

Five years is not always five literal years in an audit chair. ISACA allows substitutions that waive part of the requirement: certain university degrees and some other professional experience or credentials can substitute for a portion of it, subject to an overall cap. The current substitution table is printed on the application form — check it before assuming you are years away, because a relevant degree can shorten the wait considerably.

The application itself involves:

• Submitting within the application window ISACA allows after your passing exam date — passing and then forgetting about it indefinitely is not an option.
• Documenting your experience across the job practice areas, in roles ISACA can verify.
• Having that experience confirmed by a verifier, typically a supervisor or manager, who attests to the work you describe.
• Agreeing to ISACA's code of professional ethics and to the continuing education policy that keeps the credential active.

Step 3: keeping the credential — continuing professional education

CISA is not a pass-once, keep-forever credential. To remain certified you must complete at least 20 CPE hours every year, and at least 120 hours across each three-year cycle, and report them to ISACA. Most working auditors accumulate these hours naturally through training, conferences, chapter events, and relevant professional activity — the real discipline is recording them, not earning them. Let your CPE lapse and the credential can be revoked, which is realistically the only way people lose a CISA. Retirement of the certification itself is not on the table.

A sensible end-to-end timeline

Putting the roadmap together, a workable path for most candidates looks like this:

• Preparation: structured study mapped to the five current domains, using review material aligned to the 2024 job practice and question practice that explains why the best answer wins — ISACA's wording is a skill in itself, and it is learned by reviewing explanations, not just scores.
• The exam: sit it when your practice results are consistently strong across all five domains rather than excellent in two and weak in the rest; the score is a single overall result built from all five.
• After passing: file the certification application as soon as your experience, counting any substitutions, is complete — and line up your verifier early, because chasing a former manager is the most common cause of delay.
• Ongoing: log CPE hours as you earn them, year by year, instead of reconstructing three years of activity at the deadline.

The bottom line: CISA is not retiring; it is being actively maintained, which is exactly what you want from a career credential. The roadmap is exam first, then application with verified experience, then CPE maintenance — in that order, with no shutdown clock ticking over any of it. One format question worth settling early is whether the exam includes live labs or performance-based tasks at all. Two practical questions complete the picture before you book: what the exam costs and which languages it is offered in, and - if a first attempt goes wrong - how the CISA retake policy works.