CISA Syllabus and Domains Explained

Before diving into individual domains, it is important to understand how the exam content is distributed.

CISA Exam Domains and Weightage

1. Information System Auditing Process – 21%

2. Governance and Management of IT – 17%

3. Information Systems Acquisition, Development, and Implementation – 12%

4. Information Systems Operations and Business Resilience – 23%

5. Protection of Information Assets – 27%

Together, these five areas form the complete CISA exam topics framework.

Domain 1: Information System Auditing Process (21%)

The first domain lays the foundation for the entire certification. It focuses on the principles, standards, and practices required to conduct effective information systems audits.

Key Topics in Domain 1

• IS audit standards, guidelines, and professional ethics

• Risk-based audit planning

• Audit project management

• Audit evidence collection techniques

• Sampling methods and data analytics

• Audit reporting and communication

• Follow-up and monitoring of audit findings

This section of the CISA syllabus domains evaluates your understanding of how audits are planned, executed, and reported in real organizational environments.

Domain 2: Governance and Management of IT (17%)

This domain focuses on how organizations ensure that IT aligns with business objectives and delivers value while managing risks.

Key Topics in Domain 2

• IT governance frameworks and structures

• Strategic alignment of IT and business goals

• IT policies, standards, and procedures

• Organizational structure and roles

• IT resource management

• Performance measurement and reporting

• Risk management and compliance

In the CISA domains explained structure, this domain ensures that candidates understand how leadership and governance influence IT effectiveness.

Domain 3: Information Systems Acquisition, Development, and Implementation (12%)

This domain assesses knowledge of system development life cycles and the controls required during system changes and implementations.

Key Topics in Domain 3

• Project governance and management

• Business case development and feasibility analysis

• System development methodologies

• Application controls and testing

• Data conversion and migration

• Post-implementation review

• Change management controls

Although this domain carries a lower weightage, it remains a critical part of the CISA syllabus list, especially for candidates involved in IT projects or system implementation roles.

Domain 4: Information Systems Operations and Business Resilience (23%)

This domain focuses on the ongoing operations of information systems and the organization’s ability to maintain continuity during disruptions.

Key Topics in Domain 4

• IT operations management

• Service level management

• Incident and problem management

• IT asset management

• Capacity and performance monitoring

• Business continuity planning

• Disaster recovery planning and testing

The CISA exam topics in this domain test how well candidates understand operational risks and resilience planning in real-world environments.

Domain 5: Protection of Information Assets (27%)

The final and highest-weighted domain focuses on safeguarding organizational data and systems from internal and external threats.

Key Topics in Domain 5

• Information security governance

• Security policies and procedures

• Logical and physical access controls

• Network and infrastructure security

• Data classification and privacy

• Incident response and monitoring

• Security awareness and training

This domain forms the core of the CISA domain breakdown and requires strong conceptual clarity, especially for candidates from cybersecurity and risk backgrounds.