The CISA program was established by the Information Systems Audit and Control Association (ISACA) in order to standardize the knowledge and processes in the field of IT governance and to recognize professionals in the field who display sufficient knowledge.

In order to be awarded the certificate, qualified professionals must take the CISA exams, which are conducted every June, September and December of each year. The exam consists of 200 multiple choice questions with a total score of 800 points. A passing score requires 450 points. After obtaining the CISA certifications, a professional must log 20 hours of relevant training per year and at least a total of 120 hours in a three-year period in order to retain the CISA certification.