CISA Passing Score: ISACA Scaled Scoring for Auditors

Understanding the CISA Passing Score

If you're preparing for the Certified Information Systems Auditor (CISA) exam, one of the first questions you'll ask is: What is the passing score? The answer is a scaled score of 450 out of 800. But what does that actually mean in terms of questions answered correctly? And how does ISACA's scoring system work? In this article, we'll break down the CISA passing score, explain scaled scoring, and give you a strategic framework to prioritize your studies.

ISACA's Scaled Scoring: The Basics

ISACA uses a scaled scoring system for the CISA exam. Unlike a simple percentage (e.g., 70% correct), scaled scores account for variations in difficulty across different exam forms. This ensures that a score of 450 represents the same level of competency regardless of which version of the exam you take. For background on this area, read CEH Passing Score: Understanding the Pearson VUE Scaled Score.

The CISA exam consists of 150 multiple-choice questions, but only 125 of these are scored. The other 25 are pretest questions that are being evaluated for future exams and do not count toward your score. This is a crucial detail because it affects how you interpret your performance.

How Scaled Scoring Differs from Raw Percentage

In a raw percentage system, if you answered 75 out of 100 questions correctly, you'd get 75%. But ISACA's scaled score is not a direct percentage. The scaled score range is 200 to 800, with 450 as the passing threshold. The conversion from raw score (number of correct answers) to scaled score is not linear and is determined by the difficulty of the specific exam form.

This means that the number of questions you can miss and still pass varies from one exam administration to another. However, ISACA has published some guidance that helps us estimate the raw score needed to achieve a scaled score of 450.

How Many Questions Can You Miss?

ISACA does not officially disclose the exact raw score required to pass. However, based on historical data and candidate feedback, it is generally believed that you need to answer approximately 75% of the scored questions correctly to achieve a scaled score of 450. Since there are 125 scored questions, 75% translates to about 94 correct answers.

That means you can miss up to 31 scored questions and still pass, assuming the exam form is of average difficulty. But remember, this is an estimate. On a more difficult exam form, you might need a slightly higher raw score to reach 450, and on an easier form, you might need slightly fewer. We cover this in depth in CISM Passing Score: The ISACA 450/800 Threshold Unpacked.

Let's put this in perspective with a simple example. Suppose you take the exam and correctly answer 95 out of 125 scored questions. That's 76% correct. Based on typical conversion, you would likely receive a scaled score around 460–470, comfortably above the passing mark. If you answered 90 correct (72%), you might land around 430–440, which would be a failing score. So the difference between passing and failing can be just a handful of questions.

The Strategic Implications: Which Domains to Prioritize

Understanding the scoring system is not just academic—it has real strategic implications for your study plan. The CISA exam is divided into five domains, each with a different weight in the exam. Here's the breakdown:

These weights are approximate and can vary slightly, but they give you a clear picture of where to focus your efforts. Domain 4 has the highest weight (30%), meaning it contributes the most to your raw score. If you perform well in this domain, you can offset weaknesses in lower-weighted domains.

Worked Example of Domain Prioritization

Imagine you are strong in Domain 4 and can answer 90% of those questions correctly (34 out of 38). That gives you 34 correct answers from that domain. In Domain 3, which is only 12%, you might struggle and answer only 50% (8 out of 15). Even with that weak performance, you're still accumulating correct answers. Let's calculate a hypothetical total:

• Domain 1: 18 correct out of 23 (78%)
• Domain 2: 18 correct out of 23 (78%)
• Domain 3: 8 correct out of 15 (53%)
• Domain 4: 34 correct out of 38 (89%)
• Domain 5: 20 correct out of 28 (71%)

Total correct: 18+18+8+34+20 = 98 correct out of 125 (78.4%). That would likely yield a scaled score well above 450. Notice that even with a mediocre performance in Domain 3, your strength in Domain 4 pulled you through. This illustrates why you should prioritize high-weight domains to bank safe marks. If you're preparing for this exam, Azure AZ-500 Passing Score: Security Technologies Scoring Explained is essential reading.

Scaled Score vs. Percentage: A Common Misconception

Many candidates mistakenly think they need 70% or 75% to pass, and they aim for that on practice exams. While 75% is a good target, remember that the scaled score conversion can shift. Some practice exams might be harder or easier than the real thing, so don't rely solely on percentage scores. Instead, use practice exams to identify your weak areas and improve your performance in the high-weight domains.

If you want a quick check of your weak topics before a longer practice session, a free CISA readiness check can help you see where to concentrate next.

Other Factors That Affect Your Score

Beyond the number of correct answers, ISACA also considers the difficulty of the questions. Some questions are weighted more heavily? Actually, no—all scored questions carry equal weight. However, the pretest questions (the 25 unscored ones) can cause anxiety if you don't know they're there. You might spend time on a question that doesn't count, which is a strategic waste. Always answer every question, but don't get bogged down on a particularly tough one—it might be a pretest.

Final Strategy: Aim for 80% in Practice

Given the uncertainty in scaled scoring, the safest approach is to aim for 80% or higher on practice exams. This gives you a buffer. If you're consistently scoring 80% or above on well-designed practice tests, you're likely in a strong position to pass the real exam. Focus your study time on Domain 4 and Domain 5, which together account for 52% of the exam. Master these areas, and you'll be well on your way to achieving that 450.

For a schedule that fits your available time, use a free CISA study plan to organize your preparation around the official topic areas.

In summary, the CISA passing score is 450 out of 800, which typically translates to about 94 correct answers out of 125 scored questions. Scaled scoring ensures fairness across exam forms, but it also means you need a solid margin. Prioritize high-weight domains, aim for 80% in practice, and you'll maximize your chances of success.

Cement what you have learned by sitting ISACA Certified Information Systems Auditor (CISA) exam questions in one uninterrupted session.