CISA is the certification most IT audit jobs in Pakistan ask for. ISACA issues it, prices it in US dollars, and includes a work-experience rule that confuses many first-time candidates. This guide explains what CISA costs in rupees in 2026, who can sit the exam, how the five-year experience rule works, and how to prepare in Karachi.
What is CISA?
CISA stands for Certified Information Systems Auditor. ISACA, a global association for IT audit, risk, and security professionals, awards it to people who pass the CISA exam and prove five years of relevant work experience.
The credential shows you can plan and run an IT audit, judge whether IT controls work, and report on risk to management. It is not a hacking or engineering certification. CISA holders review systems; they do not usually build or attack them.
Who hires CISA holders in Pakistan?
- Banks and microfinance banks. Banks run IS audit teams that review core banking, digital channels, and IT controls.
- Audit and consulting firms. IT general controls testing is part of most financial statement audits, and firms need staff who can do it.
- Telecom operators, insurers, and fintechs. Large IT estates and regulator scrutiny create steady demand for internal IT auditors.
- Government and public sector bodies. IT audit and compliance roles are growing as more services move online.
CISA is a common next step for internal auditors and ACCA or CA professionals moving into IT audit, and for system administrators and network engineers moving into risk and compliance.
CISA certification cost in Pakistan (2026)
ISACA charges in US dollars. The rupee amounts below use about PKR 278 per dollar, the open market rate in early October 2026. Your card or bank will add its own conversion charges, so treat these as estimates.
| Item | USD | Approx. PKR |
| CISA exam registration, ISACA member | $575 | 160,000 |
| CISA exam registration, non-member | $760 | 211,000 |
| ISACA membership, first year (global dues $135 + $10 new member fee, plus chapter dues) | $145 + chapter dues | 40,300 + chapter dues |
| Certification application fee (paid once, after passing) | $50 | 13,900 |
| Annual maintenance fee, member | $45 | 12,500 |
| Annual maintenance fee, non-member | $85 | 23,600 |
Member or non-member? Joining ISACA costs $145 plus chapter dues in the first year and saves $185 on the exam. Membership also lowers the yearly maintenance fee and gives discounts on official study material. If you plan to keep the credential, joining before you register usually works out cheaper. Pakistan has ISACA chapters in Karachi, Lahore, and Islamabad; pick one when you join.
Retakes cost the full fee. If you fail, you pay the registration fee again for the next attempt. Missing your appointment, or cancelling within 48 hours of it, also forfeits the fee.
A realistic first-year budget. Training at Sherdil (PKR 75,000 lump sum), the non-member exam fee, and the application fee come to roughly PKR 300,000. The member route lands in a similar range once chapter dues are added, with lower costs in later years.
CISA eligibility: can you sit the exam without experience?
Yes. Anyone can register for and take the CISA exam. There is no degree requirement, and no experience check at the exam stage.
Experience matters at the next step. To be awarded the certification, you need:
- A passing score on the CISA exam.
- Five years of work experience in information systems audit, control, assurance, or security, verified by your employer.
- An application within five years of passing. If you do not apply in that window, the passing score lapses and you would need to sit the exam again.
The experience has to fall within the 10 years before you apply, or within five years after you pass. ISACA allows up to three of the five years to be substituted through education and related experience, but at least two years must be direct IS audit, control, assurance, or security work. ISACA decides which waivers apply to your degree.
In practice, this means a fresh graduate or junior auditor can pass the exam now, keep working, and apply once the experience adds up.
CISA exam format
| Detail | Value |
| Questions | 150 multiple-choice |
| Time | 4 hours |
| Scoring | Scaled from 200 to 800 |
| Passing score | 450 |
| Language | English |
| Delivery | PSI test centre or online remote proctoring |
The questions are scenario-based. Most ask what an auditor should do first, or which control best fixes a problem, rather than testing definitions.
The five CISA domains
| Domain | Exam weight |
| 1. Information Systems Auditing Process | 18% |
| 2. Governance and Management of IT | 18% |
| 3. Information Systems Acquisition, Development and Implementation | 12% |
| 4. Information Systems Operations and Business Resilience | 26% |
| 5. Protection of Information Assets | 26% |
Domains 4 and 5 make up over half the exam, so they deserve the most study time.
How to register and sit the exam from Pakistan
- Create an account on isaca.org. Join as a member first if you want the member exam price.
- Register and pay for the exam. Payment is in US dollars by card. Check your card’s international transaction limit before you pay.
- Schedule with PSI. You get a six-month window after registration to book a date, and you can schedule as early as 48 hours after paying. Choose a PSI test center or remote proctoring.
- If you choose remote proctoring, run PSI’s system check and secure browser test on the computer you will use, well before exam day.
- After passing, pay the $50 application fee and submit your experience for verification when you are eligible.
PSI has test centres in major Pakistani cities, including Karachi, Lahore and Islamabad. Confirm current locations and dates in the PSI scheduler when you book.
CISA training in Karachi at Sherdil IT Academy
Self-study works for some candidates, but many people in full-time jobs find a structured class easier to stick with. Sherdil IT Academy’s CISA course follows ISACA’s five domains in the same order as the exam.
What the course covers
- Domain 1, Auditing Process: IS audit standards and ethics, risk-based audit planning, testing and sampling, evidence collection, audit data analytics, reporting
- Domain 2, Governance and Management of IT: laws and standards, IT strategy and policies, enterprise risk management, privacy, data governance, vendor management
- Domain 3, Acquisition, Development and Implementation: project governance, business cases, development methodologies, testing, release management, data migration, post-implementation review
- Domain 4, Operations and Business Resilience: IT asset, change, patch, incident and log management, database management, business impact analysis, backup, business continuity and disaster recovery plans
- Domain 5, Protection of Information Assets: identity and access management, network and endpoint security, encryption and PKI, cloud and mobile security, security testing, incident response and forensics
Who can join: no prior audit experience is needed for the course. Basic IT knowledge, some idea of how businesses use technology, and an interest in audit or security are enough.
Course details
| Detail | Value |
| Duration | About 2 months |
| Fee, lump sum | PKR 75,000 |
| Fee, installments | PKR 90,000 in two monthly payments of PKR 45,000 |
| Extra access | Sherdil E-Learning portal (elearning.sherdil.org) |
| Location | North Nazimabad, Karachi |
The course fee covers training only. ISACA’s exam and certification fees are paid separately to ISACA.
For the next batch date, class timings, and seat availability, call +92 331 8367709 or email training@sherdil.org. You can also apply online.
A study plan that fits a full-time job
Most working candidates need 8 to 12 weeks. One way to split the time:
- Weeks 1 to 2: Domains 1 and 2. Learn how ISACA thinks about audit and governance; this shapes how you read every other question.
- Weeks 3 to 4: Domain 3.
- Weeks 5 to 7: Domains 4 and 5, which carry 52% of the marks.
- Weeks 8 onward: timed practice questions, review every wrong answer, then book the exam.
Read each question as an auditor would. The right answer is usually the one that identifies risk or checks a control, not the one that fixes the system yourself.
Keeping CISA after you earn it
- Earn at least 20 CPE hours each year and 120 hours every three years.
- Pay the annual maintenance fee: $45 for members, $85 for non-members.
- Follow ISACA’s Code of Professional Ethics and IS auditing standards.
ISACA chapter events in Karachi, Lahore, and Islamabad are one way to collect CPE hours locally.
Frequently asked questions
How much does CISA certification cost in Pakistan?
The exam costs $575 for ISACA members and $760 for non-members, about PKR 160,000 and PKR 211,000 at early October 2026 rates. Add a $50 application fee after passing, plus training if you take a course. Sherdil’s CISA course is PKR 75,000 lump sum.
Can I take the CISA exam without experience?
Yes. Experience is needed only to receive the certification. You have five years after passing to apply with five years of verified experience, and up to three years can be waived through education and related experience.
What is the CISA fee structure at Sherdil IT Academy?
PKR 75,000 paid in one go, or PKR 90,000 in two monthly installments of PKR 45,000. The course runs for about two months.
Is CISA hard to pass?
It is a judgment-based exam: 150 scenario questions in four hours, with a scaled pass mark of 450 out of 800. Candidates who study the auditor’s point of view, not just definitions, do better.
Where can I take the CISA exam in Pakistan?
At a PSI test center in a major city such as Karachi, Lahore, or Islamabad, or online through PSI remote proctoring from home.
Is CISA useful for a career in Pakistan?
Yes, especially in banking, audit firms, telecom, and fintech, where IS audit and IT risk roles commonly list CISA as a requirement or a strong preference.
Conclusion
CISA costs real money, most of it in dollars, so plan the full budget before you register. The exam is open to anyone, and the five-year experience rule gives you time to build experience after you pass. If you want a structured route through all five domains in Karachi, look at Sherdil’s CISA course.
Next batch details: call +92 331 8367709 or email training@sherdil.org.