CISA Experience Substitutions: Using Education to Qualify
Learn how educational qualifications and other certifications can substitute for CISA work experience requirements.
Reducing the Experience Requirement
ISACA recognizes that formal education and certain professional certifications provide knowledge that complements professional experience. Through its experience substitution policy, ISACA allows candidates to reduce the five-year experience requirement by up to three years, bringing the minimum to two years of qualifying work experience. Understanding these substitution options can help you earn your CISA certification sooner.
Educational Substitutions
University Degrees
Certain academic qualifications can substitute for up to three years of the CISA experience requirement.
- Up to one year: A two-year associate degree or 60 completed university semester hours can substitute for one year of experience.
- Up to two years: A four-year bachelor's degree can substitute for up to two years of experience, regardless of the field of study.
- Up to one additional year: A master's degree in information security, IT, or a related field can substitute for one additional year beyond the bachelor's degree substitution, for a total of up to three years.
Important Notes on Educational Substitutions
The total substitution from all educational sources cannot exceed three years. The educational institution must be accredited or recognized by an appropriate authority. ISACA evaluates educational credentials on a case-by-case basis, particularly for international degrees. Keep official transcripts available for verification purposes.
Certification-Based Substitutions
Holding certain professional certifications can substitute for up to one year of CISA experience. Qualifying certifications include, but are not limited to, the following.
- CIA (Certified Internal Auditor)
- CPA (Certified Public Accountant) or equivalent national designation
- CISSP (Certified Information Systems Security Professional)
- Other credentials that ISACA recognizes as demonstrating relevant competency
Only one year of substitution is allowed from professional certifications, regardless of how many qualifying certifications you hold. This substitution can be combined with educational substitutions up to the three-year maximum.
Teaching and Research Experience
Full-time university teaching experience in relevant fields (information systems, auditing, computer science, or accounting) can substitute for the experience requirement at a rate of one year of teaching for one year of experience, up to a maximum of two years. The teaching must be at the post-secondary level and in a discipline related to CISA domains.
Combining Substitutions
You can combine multiple substitution categories, but the total reduction cannot exceed three years. For example, a candidate with a bachelor's degree (two-year substitution) and a CIA certification (one-year substitution) has the maximum three years covered through substitutions and needs only two years of qualifying work experience. A candidate with only a bachelor's degree needs three years of qualifying experience.
Applying Substitutions
When submitting your CISA certification application, you will indicate which substitutions you are claiming and provide supporting documentation. Include copies of diplomas, transcripts, and certification credentials. ISACA reviews each application individually to verify that substitution claims meet their requirements. Plan ahead by gathering your documentation before submitting your application to avoid processing delays.