43%

of digital trust professionals are highly confident they could explain a serious AI incident to leaders or regulators. ISACA AI Pulse Poll 2026.

Certified Information Systems Auditor (CISA) certification

Can You Prove It to the Regulator?

Fewer than half of organisations could confidently explain a serious AI incident to their board or regulator. CISA proves you can audit the systems, controls and evidence behind the answer.

HRD Corp claimableYayasan Peneraju: may be eligibleKL, Penang or online

Exam

ISACA CISA

Course

5 days

Course fee

RM9,500

Exam fee

Included

Next intake

14 Dec 2026

Quick answer

What is CISA?

The Certified Information Systems Auditor (CISA) is ISACA’s certification for IT audit, control and assurance professionals. It proves you can plan and run risk-based IS audits, assess governance, test controls over operations and security, and report findings. One 4-hour, 150-question exam earns it, and you need five years of relevant experience to be certified.

Exam facts verified against isaca.org on 23 Oct 2026

FOR

IT auditors, internal auditors, risk and compliance staff

ROLES

IT auditor, IS audit manager, assurance and compliance lead

SKIP IF

Your focus is managing security rather than auditing it. Look at CISM

01

The Credential

What you study, practise and sit to earn it.

Pass the CISA exam, show five years of IS audit, control or security experience, and apply to ISACA. More than 200,000 people have earned CISA since 1978.

COURSE

5 days, 5 domains

FOCUS

Auditing IT systems and controls

EXAM

150 questions, 240 min

CREDENTIAL

ISACA CISA

Awarded by

ISACA

Level

Professional; AAIA builds on it

Prerequisite

None to sit; 5 years’ experience to certify

Apply within

5 years of passing the exam

Upkeep

120 CPE hours per 3 years, 20 a year

Related

AAIA, CRISC, CISM

02

Decide in 60 Seconds

Four options people weigh against each other.

If you want to

Choose

Why

Audit IT systems, controls and governance

→

CISA

The global standard for IS audit and assurance

Identify, assess and control IT risk

→

CRISC

Risk management linked to business goals

Manage an information security programme

→

CISM

Security governance and programme management

Learn the ISMS standard auditors check against

→

ISO/IEC 27001 Foundation

Two-day grounding in ISO 27001

Exam open to all. Are you ready?
0/4

Tick what applies. 3 or 4: you are ready for this course. Fewer: start with ISO/IEC 27001 Foundation.

03

What the Exam Covers

Five domains from ISACA’s CISA exam content outline. Bars to scale.

5 domains, 150 questionsLargest: Operations and Protection, 26% each

Information Systems Operations and Business Resilience 26%
Protection of Information Assets 26%
Information Systems Auditing Process 18%
Governance and Management of IT 18%
Information Systems Acquisition, Development and Implementation 12%

Source: ISACA CISA exam content outline.

04

What the Course Covers

Five domains, each with exam-style practice.

Five days of instructor-led training that follows ISACA’s job practice domains in order, from planning an audit to protecting information assets.

Domain 1

Auditing Process

  • Planning: standards, ethics, risk-based audit planning
  • Execution: testing, sampling, evidence and data analytics
  • Reporting and quality assurance

Domain 2

Governance and Management of IT

  • IT governance and IT strategy
  • IT management

Domain 3

Acquisition, Development and Implementation

  • Acquisition and development
  • Implementation

Domain 4

Operations and Business Resilience

  • Operations
  • Business resilience
  • Security event management

Domain 5

Protection of Information Assets

  • Information asset security

150

questions on exam day, all scenario-based. Each domain ends with exam-style practice so you learn how ISACA asks.

05

Why Now

Where AI governance falls short, and why train with us.

43%

of digital trust professionals are highly confident they could explain a serious AI incident to leaders or regulators

ISACA AI Pulse Poll 2026

56%

do not know how quickly they could halt an AI system after a security incident

ISACA AI Pulse Poll 2026

20%

do not know who would be responsible if an AI system caused harm or serious error

ISACA AI Pulse Poll 2026

6 hrs

Six Hours to Report. Who’s Watching the Alerts?

Malaysia’s Cyber Security Act 2024 (Act 854) came into force on 26 August 2024. Critical infrastructure entities must report a cyber security incident within six hours, and managed SOC monitoring services now need a licence. Auditors are the ones who check that those duties are met, and can be evidenced.

NACSA; Cyber Security (Notification of Cyber Security Incident) Regulations 2024

ISACA Accredited Elite Partner

Training aligned to ISACA’s CISA job practice

Exam included

One fee covers training and your exam

HRD Corp registered

This course is HRD Corp claimable

KL, Penang or online

Instructor-led in class or live online

06

The Cost, All In

Every figure per person, in ringgit.

Fees

Five-day courseIncluded

CISA exam registrationIncluded

Funding

HRD Corp claim for employersClaimable

Yayasan Peneraju financing (Bumiputera)May be eligible

Course with exam

RM9,500

Dates

Where

Fee

Mon 14 to Fri 18 Dec 2026

Kuala Lumpur or online

RM9,500 incl. exam

Mon 18 to Fri 22 Jan 2027

Kuala Lumpur or online

RM9,500 incl. exam

Mon 15 to Fri 19 Feb 2027

Kuala Lumpur, Penang or online

RM9,500 incl. exam

Mon 29 Mar to Fri 2 Apr 2027

Kuala Lumpur or online

RM9,500 incl. exam

Mon 12 to Fri 16 Apr 2027

Kuala Lumpur or online

RM9,500 incl. exam

Mon 10 to Fri 14 May 2027

Kuala Lumpur or online

RM9,500 incl. exam

Training a team? We run private intakes on dates that suit your organisation, with HRD Corp claims handled alongside you.

07

Exam and Renewal

What exam day looks like, and what happens after you pass.

Certification

Certified Information Systems Auditor (CISA)

Questions

150 multiple choice

Duration

4 hours

Passing score

450 on a 200 to 800 scale

Delivery

PSI test centre or remote proctoring

Eligibility window

Six months from registration

ISACA exam fee

US$575 members, US$760 non-members

Through Trainocate

Included in the course fee

KEEP IT ACTIVE

Earn 120 CPE hours

Earn 120 continuing professional education hours over each three-year cycle, with at least 20 hours every year.

ALSO REQUIRED

Ethics and annual fee

Follow ISACA’s Code of Professional Ethics and pay the annual maintenance fee through MyISACA.

FAQ

Questions People Ask

What is CISA?

The Certified Information Systems Auditor (CISA) is ISACA’s certification for IT audit, control and assurance. It covers five domains, from the audit process to protecting information assets.

At Trainocate Malaysia the five-day CISA course is RM9,500 per person, including the exam. The course is HRD Corp claimable, and Malaysian Bumiputera learners may be eligible for Yayasan Peneraju funding.

150 multiple-choice questions in four hours. You need a scaled score of 450 on a 200 to 800 scale. You can sit it at a PSI test centre or with remote proctoring.

Not to sit the exam, which is open to anyone. To be certified, you need five years of IS audit, control or security work experience gained within the ten years before you apply, and you have five years after passing to apply.

Take CISA if you audit IT systems and controls. Take CRISC if you identify, assess and manage IT risk. Many risk and audit professionals hold both.

CISA is held by IT auditors, internal audit and assurance leads, compliance managers and consultants who review IT controls.

Earn 120 CPE hours every three years, with at least 20 hours a year, follow ISACA’s Code of Professional Ethics, and pay the annual maintenance fee.

Become the Auditor They Trust

Pick an intake. An advisor confirms fees, HRD Corp claims and Yayasan Peneraju eligibility with you.

  • Next intake: 14 to 18 Dec 2026
  • RM9,500, exam included

Sources

  1. ISACA: CISA certification
  2. ISACA: CISA exam content outline
  3. ISACA: Get CISA certified
  4. ISACA: Exam Candidate Guide v1.26 (PDF)
  5. ISACA: AI Pulse Poll 2026 preview press release (23 Mar 2026)
  6. Trainocate: CISA course page
  7. NACSA: Cyber Security Act 2024 (Act 854)
  8. MAICSA: Act 854 regulations summary