CISA in the UAE: IT audit certification explained

CISA, or Certified Information Systems Auditor, is designed for professionals who assess whether information systems are controlled, secure and support business objectives. For UAE candidates, the crucial distinction is between passing the exam and becoming certified: an exam pass alone does not entitle you to present yourself as a CISA holder.

Consider it if your intended work involves IT audit, technology assurance or evaluating information systems controls. It is a professional credential, not a university degree or a practical penetration-testing qualification. If you are comparing career routes, start with the wider guide to professional qualifications in the UAE.

Why UAE banks and government entities value the subject

The strongest reason to pursue CISA is a match between its content and the work you want to do, not a general promise of employability.

The Central Bank of the UAE’s internal audit standards require a bank’s internal audit team collectively to have expertise that includes information technology. They also require attention to regulatory compliance and the quality of reporting to the board and senior management. This helps explain why an employer may seek evidence of IT audit competence: a financial audit background alone does not demonstrate every relevant technology skill.

For government work, Dubai Electronic Security Center’s Information Security Regulation establishes minimum information security controls for Dubai Government Entities. Its scope includes governance, operational controls and assurance, with an emphasis on protecting information and maintaining critical business processes.

The overlap with CISA helps explain its relevance to recruitment. It does not establish a universal legal requirement for every UAE bank or government auditor to hold CISA. Dubai’s regulation should not be presented as a rule applying identically across all emirates.

When reading a vacancy, distinguish “required” from “preferred”, and check whether the employer wants active certification or accepts an exam pass. For Islamic financial institutions, also investigate the sector knowledge covered in Islamic banking and finance qualifications.

What the CISA exam covers

ISACA’s current CISA exam content outline divides the syllabus into five domains. Use it to check whether study materials cover the current examination rather than an older syllabus.

Treat these as connected areas. For example, when reviewing a new business application, an auditor might examine project approval, access permissions, migration testing and recovery arrangements rather than software functionality alone.

The exam contains 150 multiple-choice questions, with four hours allowed. The passing score is 450 on ISACA’s scaled range of 200–800. This is not a percentage pass mark and should not be converted into a claimed number of correct answers.

Experience requirements: eligibility is not certification

You can sit the examination before meeting the experience requirement. Full certification normally requires five years of professional information systems auditing, control, assurance or security experience, with qualifying work falling within the ten years before the certification application.

ISACA permits substitutions of up to three years, leaving at least two years of directly qualifying experience. Its published application lists, among other options:

• A two-year waiver for a bachelor’s degree in any field.
• A three-year waiver for a master’s degree in information systems or a related field.
• A one-year waiver for qualifying general audit or general information systems work, without reusing employment dates already claimed as direct experience.
• A two-year waiver for ACCA member status.

Do not assume that separate waivers can be added beyond the overall limit. Confirm the applicable categories in the live application, particularly where a degree’s subject classification is uncertain. Readers approaching IT audit from accountancy can compare the ACCA route in the UAE.

You must apply within five years of passing and obtain verification of your experience. Certification also involves an application fee and agreement to ISACA’s ethics, auditing standards and maintenance obligations.

Plan your evidence before booking

Record employers, employment dates, relevant responsibilities and potential verifiers. Describe the actual work rather than relying on a job title: “IT officer” or “internal auditor” does not explain which controls you evaluated.

Ask ISACA about ambiguous experience before making an expensive training commitment. If you are still building your technical foundation, compare IT and computing degrees in the UAE rather than treating CISA preparation as a substitute for broader study.

Taking the exam from the UAE

CISA is computer-based, with delivery through authorised PSI testing centres or remote proctoring. Registration is continuous, but you must check the availability of a particular UAE centre, date or remote appointment through the official scheduling process.

The current registration eligibility period is six months. Treat that booking window separately from the five-year deadline for applying for certification after passing.

A practical booking sequence is:

1. Check delivery availability before paying. For remote testing, run the required compatibility checks on the equipment you intend to use.
2. Create or update your ISACA account, ensuring the registered name matches your acceptable identification.
3. Register and pay through ISACA, then access PSI scheduling from your account.
4. Confirm the appointment time, delivery method and check-in instructions.
5. Read the identification, room, equipment and rescheduling rules again before exam day.

Remote testing is supervised, not an open-book alternative. The current rules include a room scan. If you use an employer’s laptop, check whether its security settings permit the required examination software.

ISACA currently allows penalty-free rescheduling within the eligibility period when completed at least 48 hours before the appointment. Open the official candidate guides for the full rules, including accommodations, retakes and exceptional circumstances.

Budgeting and choosing preparation

Check current member and non-member prices on ISACA’s CISA registration page. Build a budget that separates the examination, optional preparation, certification application and ongoing maintenance. If considering membership for a discount, compare the combined cost rather than the examination price alone.

Before buying a preparation course, ask:

• Which version of the exam outline does it follow?
• Are learning materials and practice-question licences included?
• Does the quoted price include the ISACA exam, or only tuition?
• Can the provider explain the instructor’s relevant audit experience?
• What are the access period, cancellation terms and arrangements for missed sessions?
• If official partner status is claimed, where can that status be verified with ISACA?

A useful study plan should include reading, practice questions and an error log explaining why an answer was wrong. Practise interpreting the question rather than memorising an answer sequence. For each scenario, identify the audit objective, the evidence needed and the risk being addressed.

Before choosing an intensive course, work out how much uninterrupted study time you can realistically protect. The guide to studying while working full-time in the UAE can help with that decision.

Keeping CISA active: CPE and annual maintenance

CISA requires continuing professional education, or CPE. Holders must earn and report at least 20 relevant CPE hours annually and 120 hours over each three-year reporting period. Completing only the annual minimum every year will not meet the three-year total.

Maintenance also requires paying the annual fee, following ISACA’s ethics and auditing standards, and supplying evidence if selected for a CPE audit. Check the current amounts and requirements on the CISA maintenance page.

Keep certificates, attendance records or other acceptable evidence. ISACA requires documentation to be retained for 12 months after the end of the relevant three-year reporting cycle. Relevant activities may count towards more than one ISACA certification where they satisfy each credential’s requirements; the overlap is not automatic.

Plan professional development alongside your work objectives. For example, choose learning that helps you assess a technology or control area you expect to audit, rather than collecting unrelated attendance hours.

Related certifications: choose by responsibility

CISA is not interchangeable with every security or governance credential. ISACA’s related certifications focus on different responsibilities:

• CISM (Certified Information Security Manager): security governance, risk, programme management and incident management. Consider it when your intended responsibility is managing security rather than independently auditing it.
• CRISC (Certified in Risk and Information Systems Control): identifying and managing enterprise IT risk and implementing or maintaining controls.
• CGEIT (Certified in the Governance of Enterprise IT): enterprise IT governance and alignment with organisational objectives.
• AAIA (Advanced in AI Audit): a specialised route focused on auditing artificial intelligence, with its own entry conditions to check.

Compare the tasks in your target role with each credential’s scope before choosing another exam. A second designation is most useful when it supports a distinct responsibility, not simply because it appears beside CISA in a course advertisement.