CISA Study Schedule for Working Professionals

A realistic week-by-week CISA study schedule for full-time professionals — hour budgets, a 12-week timetable, and how to adapt it when work gets in the way.

Alexander Novak25 June 2026 · 7 min read

Ask AIChatGPT Claude Gemini Copilot Perplexity Grok

Weekly calendar showing short CISA study blocks scheduled around full-time work commitments.

Picture an internal auditor with a full caseload: she can find eight, maybe ten study hours a week — two weekday mornings before work, one longer weekend session — and not an hour more during month-end. A workable Certified Information Systems Auditor (CISA) schedule for her is not the one that assumes evenings free; it is one built on a fixed weekly hour budget, a 12-week arc from first chapter to exam day, and slack weeks that absorb the inevitable work crunch.

That is the schedule this article gives you. ISACA sets no official study-hours figure, and prep literature commonly suggests two to four months part-time, so a 12-week plan at roughly 8–10 hours a week sits comfortably in that range for most working candidates. What follows assumes you know what the exam covers; if you do not yet, read the five CISA domains and their weightings first, because the timetable below leans on them.

Three scheduling principles before any timetable

Budget hours weekly, not totally

"I'll do 150 hours" is not a plan; "I'll do 9 hours a week for 12 weeks" is. Working professionals fail schedules for a predictable reason: the plan assumed an average week, and no week is average. Decide your realistic weekly number by looking at your actual calendar — commute, family, recurring work peaks — and set it slightly below what feels possible. A budget you hit for twelve straight weeks beats an ambitious one you abandon in week three.

Anchor sessions to fixed slots

Study that floats ("some time this evening") loses to whatever the day throws at you. Study that is anchored ("Tuesday and Thursday, 06:30–07:45, plus Saturday 08:00–11:00") mostly survives. Morning slots are worth trying even if you are not a morning person — they are the part of a professional's day least likely to be stolen by work. Three anchored sessions a week is enough; five short scattered ones are harder to protect.

Book the exam to create the deadline

ISACA registration is continuous — there are no fixed exam windows — and your exam eligibility runs for six months from registration, with appointments bookable up to 90 days ahead at PSI test centres or via online remote proctoring. Registering at the start of your plan and booking a date near week 12 converts your schedule from an intention into a countdown. The fee (US$575 for ISACA members, US$760 for non-members, as of 2026 — confirm current pricing on isaca.org) is non-refundable, which is exactly why paying it early works as motivation. You can reschedule free of charge during your eligibility period provided you do it at least 48 hours before the appointment, so the date is a commitment, not a trap.

The 12-week timetable

The plan below assumes 8–10 hours a week: two weekday sessions of about 75 minutes and one weekend block of 3–4 hours. Domain order and time allocation follow the official weightings — Domains 4 and 5 carry 26% each, so they get the most weeks. What each domain contains is covered in the domains explainer, not here.

Weeks	Focus	Weekday sessions	Weekend block
1–2	Domain 1 (18%)	Read review-manual sections; end each session with 10 untimed questions	Consolidate notes; 25-question domain quiz
3–4	Domain 2 (18%)	Same rhythm; keep a running list of terms that felt unfamiliar	Domain 2 quiz plus review of week 1–2 wrong answers
5	Domain 3 (12%)	One domain, one week — its weighting does not justify more	Domain 3 quiz; first look back across Domains 1–3
6–7	Domain 4 (26%)	Slower pace; this material is dense and heavily tested	Domain 4 quiz; flag topics needing a second pass
8–9	Domain 5 (26%)	Expect the longest topic list of any domain	Domain 5 quiz; update weak-topic list
10	Weak-domain repair	Revisit the two lowest-scoring domains only	Mixed 50-question quiz across all five domains
11	Full-length simulation	Light review only on weekdays	One timed 150-question, 4-hour practice exam
12	Final review	Short daily reviews of flagged topics and wrong answers	Rest; no new material in the last two days

Two design choices worth understanding. First, questions appear from week 1, not after the reading is "done" — answering questions is how the material converts into the judgement the exam tests, and it tells you immediately whether a session actually landed. Second, week 11's single full-length, four-hour simulation matters more for a working professional than for a full-time student: you need to know what 240 minutes of sustained concentration feels like after weeks of 75-minute sessions. How to sequence, score and learn from practice tests in depth is its own subject — see the CISA practice test strategy guide — and ExamPractice's timed practice-test simulation is built for exactly the week-10-to-11 benchmarking step.

Adapting the plan to your situation

If you can only manage 5–6 hours a week

Stretch, don't squeeze. Take the same structure over 16–18 weeks: three weeks per heavyweight domain instead of two, and two consolidation weeks instead of one. Keep your exam date inside the six-month eligibility period with margin; a one-time US$75 extension exists, but planning to need it is planning badly.

If you have audit experience already

Experienced IS auditors can often compress weeks 1–2 into one week, because Domain 1 describes their day job. Spend the reclaimed week on whichever of Domains 4 or 5 sits furthest from your role. The reverse applies to security engineers: Domain 5 may compress, Domains 1–2 need the full allocation and more question practice, because the exam's audit-judgement framing is where technical candidates lose marks.

If work blows up mid-plan

Use a triage rule you set in advance: protect the weekend block first, drop weekday sessions second, and never let two consecutive weeks go to zero. If you lose more than two weeks, reschedule the exam early — remember the 48-hour free-rescheduling cut-off — rather than sitting underprepared. If the worst happens on results day anyway, the path back is manageable: a 30-day wait before a first retake, and our CISA retake preparation guide covers that scenario, so it needs no space in your first-attempt plan.

Common scheduling mistakes working candidates make

Treating reading as progress. Ten hours of passive reading feels productive and tests as nothing. Every session should end with questions; every week should produce a score you can compare with last week's.
Studying only at weekends. A single six-hour Saturday leaves six days for forgetting. Two short weekday sessions exist mostly to keep the material warm between weekend blocks.
Perfecting Domain 3. It is worth 12% of the exam. Working candidates short on hours should let proportionality, not completionism, allocate their time.
Skipping the full-length simulation. It is the hardest session to schedule around a job — a four-hour block plus review — and the one that most predicts exam-day performance. Book it in your calendar in week 1, like a meeting you cannot decline.
Studying new material in the final 48 hours. Late cramming trades calm for coverage at exactly the wrong moment. The last two days are for rest and light review; the practical run-up to the appointment itself is covered in the CISA exam day checklist.

Frequently asked questions

How many hours does CISA preparation take in total?

ISACA publishes no official figure. At the 8–10 hours a week this plan assumes, twelve weeks lands around 100–120 hours, which fits the two-to-four-months-part-time range commonly suggested in prep literature. Your own number depends heavily on background — how long CISA preparation takes breaks the estimates down by profile.

Can I follow this plan with zero audit or IT experience?

You can sit the exam with no experience — ISACA requires five years of relevant experience (with waivers of up to three years) only to become certified after passing, and you have five years from your pass date to apply. But a complete beginner should expect the longer 16–18-week variant and may prefer the gentler sequencing in our CISA study plan for beginners.

Should I join ISACA before registering?

Membership status at registration determines your fee: US$575 versus US$760, a US$185 difference. Whether membership pays for itself depends on current dues, which vary by chapter — check the price for your chapter on isaca.org and do the arithmetic before you register.

When in the plan should I book the actual appointment?

Immediately after registering, in week 1. Scheduling is possible as early as 48 hours after payment and up to 90 days out, so a week-12 exam date is bookable from day one — and having it in the diary is half the discipline.

Keeping the schedule honest

A working professional's CISA plan succeeds on protection, not ambition: a weekly hour budget you can defend, three anchored sessions, a booked exam date, and scores — not feelings — telling you whether the plan is working. Build the timetable above into your calendar this week, then get a baseline before your first study session: a short set of free CISA sample questions will show you which domains deserve your scarcest resource, which is not money but protected time.

Exam facts in this guide were checked against official certification-provider pages on 30 August 2026. Fees, exam codes and policies change — confirm on the provider’s own site before you book.