August 3, 2026
The 90-Day CISA Study Plan: A Working Auditor's Schedule
Most CISA study plans are written for an imaginary candidate with unlimited evenings. Working auditors do not have that. They have a demanding day job, a few usable hours on weeknights, and a weekend they would rather not spend entirely on exam prep. This 90-day CISA study plan is built for that reality: roughly three months at a sustainable weekly load, structured so the hours land where they actually change your score.
Ninety days is a deliberate choice. It is too short for someone starting from a non-IT background, who needs longer to build the technical vocabulary, and longer than a full-time studier needs. But for an auditor already fluent in audit concepts and able to give a steady ten to fifteen hours a week, three months is the point where the plan is long enough to build depth and short enough to sustain focus. The plan below assumes that profile and about fourteen hours a week.
The 90-day structure
The plan runs in three phases of roughly thirty days each, and the order matters. You build a foundation first, add depth in the heavily weighted domains second, and spend the final stretch almost entirely on timed drilling rather than new content.
- Phase 1, Foundation (days 1–30): build vocabulary and the concept base, starting with the domains closest to an auditor's existing knowledge.
- Phase 2, Depth (days 31–60): move into the technical, heavily weighted domains and start daily question drilling.
- Phase 3, Drilling (days 61–90): minimal new content, maximum timed practice, and pattern-based review.
Each phase feeds the next. Skipping the foundation makes the depth phase harder; skipping the drilling phase leaves you knowing the material but unable to apply it under timing.
Phase 1: Foundation (days 1–30)
Start where you are strongest. The first thirty days cover Domain 1 (the IS audit process) and Domain 2 (governance and management of IT) — together about 36% of the exam and the material an auditor finds most familiar. Beginning here builds momentum and lets you calibrate how the exam frames concepts you already understand.
Get comfortable with the audit-standards vocabulary, the governance frameworks, and the way the exam phrases scenario questions. Alongside the reading, start light question practice — a few hundred questions across these domains, mixed rather than domain-by-domain, to begin training recognition rather than recall. The goal of Phase 1 is not mastery; it is a solid concept base and familiarity with the question style, so the harder domains in Phase 2 have something to attach to. A reasonable end-of-phase signal is that Domain 1 and 2 questions read clearly — you understand what each is asking even when you pick wrong — rather than that your scores are high. Comfort with the format is the Phase 1 milestone; accuracy comes later.
Phase 2: Depth (days 31–60)
Phase 2 is where the exam is actually won or lost, because it covers the domains that carry the most weight and cause the most trouble: Domain 3 (acquisition and development), and especially Domains 4 (operations and resilience) and 5 (protection of information assets). Domains 4 and 5 alone are 52% of the exam, so weight your time toward them heavily — more days on 4 and 5 than on 3. The domain weighting makes the case for this allocation in detail, and this is the phase where you act on it.
Shift the balance from reading to questions in this phase. Drill daily — a sustained rhythm of questions, reviewing not just what you got wrong but why, and beginning to notice which patterns recur. Around day 60, take your first full-length, timed, 150-question mock. Do not expect a strong score; the point is to establish a pacing baseline and to generate a realistic list of weak areas heading into the final phase. That first timed mock is a diagnostic, not a verdict. Treat a mediocre day-60 result as expected and useful: the number matters far less than the weak-area list it produces, and that list becomes the agenda for Phase 3.
Phase 3: Drilling (days 61–90)
The last thirty days are almost entirely practice. New content should be minimal — by now you either know a concept or you will pick it up through questions, and re-reading has low value this late. Drill heavily, and make the review of each drill the main event: categorize your wrong answers by pattern so your remaining effort targets the mistakes actually costing you points.
Increase the timed work as you go. In the final two weeks, run two full-length timed mocks a week, spaced apart, with careful review after each. This is also where pacing has to become automatic rather than theoretical, so keep shorter timed sets in the mix to hold the rhythm. The final fortnight has its own logic worth following closely — the final two weeks plan covers exactly how to spend days 76 through 90, and it slots directly onto the end of this schedule.
Weekly time allocation for working auditors
The plan assumes about fourteen hours a week, which for most working auditors looks like two hours on each of five weeknights plus a four-hour block on the weekend. That is demanding but sustainable for three months, and it is the load the phase structure is built around.
If you have less time, cut carefully rather than uniformly. Protect the question drilling and the timed mocks, because those are the highest-yield activities; trim the reading first, since re-reading has the lowest marginal value. Ten hours a week can still work over ninety days if the hours are concentrated on questions and timed practice rather than passive review. What does not work is keeping all the reading and dropping the drilling — that produces a candidate who knows the material and cannot apply it under timing.
When you fall behind
You will fall behind at some point. A busy week at work, a personal commitment, or simple fatigue will cost you a few days, and the plan has to survive that. When it happens, do not try to recover by cramming the missed hours back in — that just moves the fatigue forward. Instead, protect the phase structure over the calendar: it is better to compress Phase 1 slightly than to arrive at Phase 3 with no time for timed mocks, because the drilling phase is what converts knowledge into a score. If you lose a week, take it out of reading and foundation, never out of the final drilling stretch. The plan is a guide, not a contract, and the milestone that matters most is entering the last two weeks with your pacing rehearsed.
Where most 90-day plans fail
Three failure modes account for most plans that do not work. The first is over-allocating to Domain 1 because it is comfortable — spending too much of the calendar on the audit-process material that reads easily, at the expense of the heavily weighted technical domains. The second is under-allocating Domain 5 because it is intimidating, deferring it until there is no time left to build real familiarity. Both are versions of studying by comfort rather than by weight.
The third is saving all the drilling for the final week. Timed practice is not a last-minute check; it is the mechanism that builds pacing and surfaces your weak patterns, and it needs weeks to do its work. A plan that front-loads reading and postpones drilling arrives at the exam with untested pacing and undiagnosed weaknesses — which is why the structure here starts questions in Phase 1 and makes them the whole of Phase 3.
If you have 60 or 120 days instead
The three-phase structure adapts to other timelines. With sixty days, compress the foundation phase to about three weeks and keep the depth and drilling phases close to full length — the foundation is the most compressible part for an experienced auditor, while the drilling phase is the least. With 120 days, extend the depth phase rather than the others; more time in Domains 4 and 5 is where the extra month pays off, not more reading of Domain 1. In every version, the drilling phase stays protected, because it is the part that determines whether you can apply what you know under exam conditions.
Independent CISA practice material. Not affiliated with ISACA. CISA, CISM, and CRISC are registered trademarks of ISACA, used here for descriptive reference only.
Anchor the plan with timed mocks
The backbone of this 90-day plan is not the reading schedule; it is the timed mocks at the Phase 2 and Phase 3 milestones. The day-60 mock sets your pacing baseline and weak-area list, and the mocks through days 76 to 90 are where pacing becomes automatic and your patterns get diagnosed and fixed. Without them, the plan is just a reading list with dates attached.
If you want full-length timed mocks at the Phase 2 and Phase 3 milestones, our free CISA mock is built for exactly this — a full 240-minute sitting with a pacing breakdown and per-question review, so each milestone mock becomes a diagnosis you can act on in the phase that follows. Read on the schedule the plan sets, but let the timed mocks tell you where the real work is. And whatever timeline you choose, calibrate the total length to your background first — the study timeline by background is the place to start, and pacing under the 240-minute clock is the skill every phase is quietly building toward.