CISA Exam Results, Score Reports, and Retakes

What happens when you finish the CISA exam

At the end of the computer-based exam, candidates receive a preliminary pass or fail indication on screen. This first result is useful for immediate orientation, but the formal score report follows through ISACA's online account and email. The 2026 candidate guide says official score reporting generally occurs within 10 working days. Keep your account email current and check its spam or filtered folders if the expected message has not appeared.

The official report gives the total scaled score and domain-level performance information. It does not replay the questions or provide an answer key. Candidates should not expect a list of missed items or a raw count correct. The total score uses ISACA's 200-to-800 scale, and 450 is the minimum passing score. The score report's domain information is diagnostic; it does not create a separate passing threshold for each domain.

Understand pass and fail before planning a retake

A scaled score of 450 or above is a pass. A result below 450 is a fail, even if the candidate performed strongly in several domains. Because the score is scaled, a candidate should not interpret the difference between 447 and 450 as a known number of questions or a raw percentage. ISACA does not publish the conversion needed for that inference.

The report is best used as a broad diagnosis. Review domain indicators alongside your own study records, practice explanations, and exam-day observations. A relatively weak domain can point to a topic cluster for further work, but the report does not say which question was missed or what exact answer would have changed the outcome. Avoid treating one label as a complete explanation for the result.

CISA attempt limit and waiting periods

ISACA permits up to four attempts within a rolling 12-month period. After a first failure, the candidate must wait 30 days before taking the exam again. After the second and third failures, the waiting period is 90 days. These periods are measured from the relevant exam attempt, so candidates should use the account and current candidate guide to confirm when the next eligible appointment can be scheduled.

The limit is rolling rather than a fixed calendar-year allotment. It is not accurate to assume that four attempts reset on January 1. A candidate who reaches the attempt limit needs to wait until an attempt falls outside the applicable 12-month period, consistent with ISACA's administration rules. Use the dates of the actual attempts when planning rather than counting calendar years.

Each retake is a new paid registration

The candidate guide states that candidates pay the full exam fee for each attempt. A prior fee does not become a credit after a failure, and the candidate must register and schedule again within the applicable eligibility process. The fee is nonrefundable and nontransferable. Before buying another registration, check your account eligibility, the wait period, and your readiness to sit.

A candidate may also request a rescore after a fail. The request must be submitted in writing through ISACA support within 30 days and costs US$75 under the current guide. A rescore request is a review, not a guaranteed score change, extra attempt, or fee waiver. It does not remove the need to meet the retake waiting period if the candidate later chooses another administration.

A structured response to a failing result

1. Save the official report and note the total scaled score and domain feedback.
2. Compare the weaker domain indicators with the current exam content outline and the notes from your preparation.
3. Classify practice errors by cause: missing knowledge, misread qualifier, wrong audit sequence, weak evidence choice, or role confusion.
4. Build a new study cycle around the identified gaps instead of repeating the same plan unchanged.
5. Use new, original questions to check transfer of reasoning; do not memorize recalled live items.
6. Wait the required period, confirm your eligibility and appointment options, then register for another full-fee attempt when prepared.

For example, suppose the report indicates relatively weaker performance in Information Systems Operations and Business Resilience. The candidate should map that signal to the outline: operational procedures, service management, incident response, change and configuration management, backup and restoration, business impact, continuity, and recovery. A review session could then require the candidate to explain why restoring a database alone does not prove that a customer-facing service has recovered when identity or network dependencies remain unavailable.

This approach uses the score report as a guide without pretending it reveals the answer key. The candidate should also inspect broader patterns. If practice questions were untimed, pacing may have contributed. If explanations were skipped after correct answers, guessing may have hidden gaps. If study relied on memorized definitions, the next cycle should include scenarios that ask what an auditor should do first, what evidence best supports a conclusion, or which responsibility belongs to management.

Example retake schedules and budgets

A candidate failing once can sit again no sooner than 30 days later. If the candidate needs the entire interval for focused study, the new date may be several weeks or months later. A second failure creates a 90-day wait. A realistic schedule includes review, new practice, and appointment availability rather than treating the earliest legal date as the only possible date.

These are exam-fee examples only and assume the candidate can purchase at the listed 2026 rate. They do not include membership, study resources, travel, taxes, the post-pass application fee except where stated, or future maintenance. Waiting periods govern when an attempt may occur; the six-month eligibility window governs when a paid registration may be used. If eligibility expires, candidates need to understand the separate extension policy before assuming a retake can be scheduled.

When to request a rescore

A candidate who believes an administrative or scoring issue affected a failing result can consider the published rescore path. Submit the request in writing to ISACA support within 30 days and pay the US$75 fee. Read the instructions for the current administration and retain the request confirmation. The rescore does not provide an item-by-item review, and candidates should not delay a study plan while expecting a different result.

If there is no specific reason to request a review, the report and study evidence may be more useful for planning a retake. The exam is designed to assess applied judgment across the outline, so targeted remediation should address both knowledge and decision-making. A question can be answered incorrectly because a concept is unfamiliar, but also because the candidate ignored a qualifier such as FIRST, BEST, or MOST reliable.

Passing the exam is one step toward certification

A pass score confirms the exam requirement, but it does not automatically award the CISA designation. The candidate must submit a separate certification application, document relevant experience, pay the one-time application fee, and meet applicable professional requirements. ISACA allows five years after passing to apply. Keep the official score report and any experience evidence organized during that period.

An unsuccessful score does not prevent a candidate from continuing a career in audit or information security, and a successful score does not itself prove experience. Keep the two questions distinct: results show whether the exam standard was met; certification review determines whether the applicant satisfies the experience and application requirements. The eligibility and certification requirements articles explain those steps in detail.

A calm next-step plan

After a pass, save the official report and proceed to the certification application when ready. After a fail, note the result, review the diagnostic feedback, identify concrete study gaps, and observe the waiting period and full-fee rule. In either case, use ISACA's official account and current guide for the candidate-specific status. A score is most useful when it informs the next decision without being mistaken for a raw question count or a complete measure of professional skill.

Worked example: turning a score report into a retake plan

Suppose Jordan receives a failing result and the report indicates weaker performance in Governance and Management of IT and Operations and Business Resilience. Jordan's notes show that timed practice was completed, but many explanations were not reviewed. The next step is not to reread every chapter indiscriminately. Jordan maps the two domain indicators to the official task statements, then checks missed practice items for recurring errors: unclear accountability, failure to connect recovery objectives to business services, and acceptance of management assertions without corroboration.

Jordan then builds a six-week review cycle. The first two weeks revisit governance roles, risk ownership, supplier monitoring, service objectives, and resilience dependencies. Weeks three and four use fresh scenarios to test evidence and sequence. Week five includes mixed timed practice with all five domains. The final week reviews error notes and pacing. This is a personal example, not a required or guaranteed study duration; the schedule should match the candidate's actual gap and available time.

If this was Jordan's first failure, the 30-day waiting period sets the earliest possible retake, but an available PSI seat and eligibility status also matter. The candidate should check the six-month window attached to the registration, because a new waiting period does not automatically extend eligibility. If the current registration expires before the candidate can sit, the separate extension rule may apply. Jordan should confirm the fee and account status before purchasing another attempt.

Plan dates using three separate clocks

A retake plan has three timelines. First is the mandatory wait after a failure: 30 days after the first, then 90 days after the second and third. Second is the registration eligibility window, normally six months from payment, during which the candidate must sit the exam. Third is appointment availability, which PSI displays up to 90 days ahead. These clocks can interact. A candidate may be legally eligible to retake but need a new appointment date, or may have a seat available but an eligibility deadline approaching.

Keep the official failure date, eligibility expiration, and booked appointment in one calendar. Check rescheduling deadlines as well: an appointment change must be made at least 48 hours before the exam to avoid forfeiting the fee. If the provider cancels or a center closes, follow the official notice and preserve confirmation of the replacement arrangement. Planning from all three dates reduces the chance that a study plan is disrupted by an administrative deadline.

Avoid conclusions the report does not support

• A score three points below 450 does not mean three more raw questions would necessarily have produced a pass.
• A weak domain indicator does not identify a specific missed question or prove that every task in that domain is weak.
• A passing total does not mean each domain independently met a threshold; ISACA does not set separate domain pass marks.
• A rescore request does not suspend the retake waiting period or guarantee a different result.
• A four-attempt limit is rolling over 12 months, not four attempts per calendar year.
• A preliminary on-screen result is not the certification award; the experience application remains separate.

These distinctions keep the candidate's response grounded in the actual report. A precise interpretation supports a better plan: identify what evidence the score gives, acknowledge what it cannot reveal, and build study activity around observable gaps.