Every active Certified Information Systems Auditor (CISA) is required to earn and report continuing professional education (CPE) to keep the certification. The requirement is at least 20 CPE hours each year and at least 120 over each three-year reporting period, all tied to the CISA job practice areas. This guide covers who the rules apply to, how hours are counted, what qualifies, the evidence ISACA accepts at audit, and the status options for credential holders who step away from the field.
1. CISA CPE Requirements at a Glance
| Rule | Requirement |
|---|---|
| Who | Every CISA in Active status |
| Annual minimum | 20 CPE hours, reported each year |
| Three-year total | 120 CPE hours related to CISA |
| Content | Technical and managerial training directly applicable to the CISA job practice areas |
| Measurement | 1 CPE per 50 minutes of active participation, in quarter-hour increments |
| Annual fee | Maintenance fee due by 1 January each year |
| Ethics and standards | Comply with ISACA's Code of Professional Ethics and Information Systems Auditing Standards |
| Records | Kept for 12 months after the end of each three-year cycle |
| Audit | Random annual CPE audit; compliance required if selected |
| Non-compliance | Revocation of the CISA designation |
Each row above is a requirement, not a recommendation. Anywhere a point is guidance rather than an obligation, this article flags it.
2. Who Must Comply with ISACA's CISA CPE Requirements
The requirement attaches to the credential, not to ISACA membership. Membership changes the fee you pay. It doesn't change the CPE required.
| Your situation | Position |
|---|---|
| ISACA member | Full CPE requirement; member rate for the annual fee |
| Not an ISACA member | Full CPE requirement; non-member rate for the annual fee |
| Holding other ISACA certifications | One activity can count toward each certification where it applies to that certification's job-related knowledge |
| Out of the field, or permanently retired | Non-Practicing or Retired status may apply (covered below) |
3. How Many CPE Hours You Need, and How They're Counted
You're required to earn and report at least 20 CPE hours every year and at least 120 over each three-year reporting period, according to ISACA's CISA maintenance requirements. Annual hours have to keep your CISA knowledge, or your ability to perform CISA-related tasks, current.
The two limits work together. Twenty hours a year for three years is 60. The other 60 still has to come from somewhere in the same cycle.
How hours are calculated
Where a provider doesn't state the CPE earned, ISACA's calculation rule applies. You earn one CPE hour for each 50 minutes of active participation, excluding lunches and breaks. Hours are earned and reported in quarter-hour increments, rounded to the nearest quarter hour. ISACA's worked example:
| Schedule | Minutes |
|---|---|
| 9:00 a.m. to 5:00 p.m. | 480 |
| Less two 15-minute breaks | 30 |
| Less one-hour lunch | 60 |
| Active participation | 390 |
| CPE earned (390 ÷ 50, rounded to the nearest quarter hour) | 7.75 |
The day holds 6.5 clock hours of learning. It earns 7.75 CPE.
4. Job Practice Relevance, Ethics and Auditing Standards
ISACA doesn't split CPE into verifiable and non-verifiable, or structured and unstructured. It sets one content test: CPE is technical or managerial training directly applicable to the CISA job practice areas.
There's no ethics-hours quota. Ethics sits alongside CPE as a separate condition of holding the credential:
- Code of Professional Ethics: CISAs agree to comply with ISACA's Code of Professional Ethics, which includes maintaining competency in their fields. Failure to comply can lead to an investigation and disciplinary measures.
- Information Systems Auditing Standards: CISAs agree to abide by the auditing standards ISACA has adopted.
Both appear in ISACA's list of conditions for keeping the certification, next to the CPE hours and the annual fee.
5. What Counts as CISA CPE
On-the-job work doesn't count by itself. An activity has to fall into one of ISACA's qualifying categories. Some categories carry an annual limit. The rest have none, as long as the content applies to the job practice areas.
| Activity | How CPE is earned | Annual limit |
|---|---|---|
| ISACA conferences, seminars, workshops, chapter programs and meetings | Hours of active participation; a chapter meeting earns at least 1 CPE | No limit |
| Non-ISACA training: in-house corporate training, conferences, seminars, workshops, professional meetings, certification review courses | Hours of active participation | No limit |
| University courses in related fields, including online courses | 15 CPE per semester credit hour; 10 per quarter credit hour | No limit |
| Self-study courses, including online self-study | Hours stated on the provider's certificate of completion | No limit |
| Teaching, lecturing and presenting | 5× presentation time for the first delivery; actual time for the second | No limit |
| Developing or updating self-study courses | 5× the estimated course time for the first delivery; 1 CPE per hour of updating, up to twice the course time | No limit |
| Publishing or reviewing articles, monographs and books | Actual hours spent | No limit |
| Exam question development and review | 2 CPE per question accepted by an ISACA item review committee | No limit |
| Passing related professional exams | 2 CPE per exam hour | No limit |
| Vendor sales or marketing presentations related to the domains | Hours attended | 10 |
| ISACA boards, committees, task forces and chapter officer roles | 1 CPE per hour of active participation | 20 |
| Contributions to the profession, such as research, review manual development and peer reviews | Hours of work | 20 |
| Mentoring someone for an ISACA exam or their career development | 1 CPE per hour of assistance | 10 |
What doesn't count
- On-the-job activities: that don't fall into a qualifying category.
- Training in basic office productivity software: such as Microsoft Word or Excel.
- Third and later deliveries of the same presentation: unless the content is substantially modified.
- Self-study courses without a certificate of completion: stating the CPE hours.
- Activities you haven't finished: CPE is reported only after completion.
6. Online Learning, Self-Study, Webinars and On-Demand CPE
ISACA counts online learning in two ways. Live and recorded events, such as webinars, virtual conferences and online university courses, count as professional education and earn CPE for hours of active participation. Self-paced courses count as self-study.
The self-study rule is specific. A course designed for self-study counts only if the provider issues a certificate of completion that states the CPE hours earned. ISACA sets no annual limit on self-study hours. ISACA's own options fall here too: a passing score on an ISACA Journal quiz earns 1 CPE, and members earn CPE for ISACA-sponsored eLearning events such as webinars and virtual trade shows. Both count toward every ISACA certification held.
The overarching requirement is that the learning keeps your knowledge, or your ability to perform CISA-related tasks, current, and applies directly to the CISA job practice areas. For self-paced learning, ISACA's category is self-study courses, and its condition is documentary: a certificate of completion showing the CPE hours. ISACA checks compliance one credential holder and one calendar year at a time, through its audit of the activities each person reported. A certificate that names you, the session and the hours, together with a record of what the session covered, is the kind of documentation the audit asks for.
EverCPE.com offers online self-study for accountants and auditors that may help you fulfill your CPE requirements.
EverCPE.com is interactive, structured self-study rather than passive reading. Each learning session comes with:
- Content shaped around the exact accounting and auditing questions you have, instead of generic off-the-shelf courses
- Substantive material organised around clear learning objectives
- Knowledge checks with feedback as you go, so you fix any misunderstanding while you work through the learning session
- Scored multiple-choice questions that check whether you understand the material
- A certificate of completion once you complete the learning session, naming you, the session and the hours
- A full downloadable handout covering the session, its learning objectives, and its content
In short, EverCPE.com leaves you with documentation and evidence of the learning you completed.
7. Reporting CPE and the Annual Maintenance Fee
| CPE source | How it's reported |
|---|---|
| Earned through ISACA | Pre-loaded to your ISACA account; you apply it to each certification before it counts, up to the event's maximum hours |
| Earned through chapters and other sponsors | Self-reported: title or description, sponsor, start and end dates, qualifying activity category, and CPE per certification |
Report hours only once the activity is complete and you hold compliant documentation.
The annual maintenance fee is due by 1 January each year, and it keeps the certification in force through that calendar year. ISACA sends invoices by email and post from September for the following year. Members pay less than non-members, and the fee drops again for a third ISACA certification and beyond. The published amounts are on the Maintain CISA page.
8. Records and the Annual CPE Audit
Keeping records
Keep documentation for 12 months after the end of each three-year reporting cycle. Per ISACA's audit requirements, each document shows:
- your name as attendee or presenter
- the sponsoring organization
- the activity title and description
- the activity date
- the CPE hours awarded, or the detailed event duration
- a verifier signature, stamp or other third-party attestation of completion
Accepted and rejected evidence
| Accepted | Not accepted |
|---|---|
| ISACA's Verification of Attendance form, signed by the sponsor or someone aware of your attendance, such as your manager | Event registration information or receipts |
| Certificate of completion or attendance | Calendar invites or screenshots |
| Verified confirmation letter | Slide presentations |
| Independent proof of completion | Email attendance confirmations without the duration or CPE hours |
The annual CPE audit
- ISACA audits CPE every year, selecting credential holders at random, regardless of how many hours or which categories they reported.
- Being selected in an earlier year doesn't exclude you from later selection.
- Holders who retired their certification during the audited year are waived.
- If you're selected, you provide documentation for every activity reported in the calendar year under audit.
- Undocumented hours are removed. If that leaves you short of the annual or three-year requirement, the certification is subject to revocation.
- Not complying with the audit leads to revocation.
9. Non-Practicing Status, Retired Status and Revocation
ISACA doesn't grant exemptions from the requirement. It offers two alternative statuses:
| Status | Who qualifies | Key conditions |
|---|---|---|
| Non-Practicing | Unemployed or disabled (short or long term); no longer working in the field but considering a return; other extenuating circumstances approved by the Certification Working Group | Takes effect on 1 January of the year you became unable to meet the CPE requirement; can be held indefinitely while the annual fee is paid |
| Retired | Over 55 and permanently retired from the profession; or unable to perform specific job functions due to permanent disability | Permanent from the day of the request; no CPE and no annual fee |
Returning to Active status
| Time since Non-Practicing status took effect | Requirement to return |
|---|---|
| Fewer than two calendar years | Documentation of 20 CPE hours earned within the past calendar year |
| Two or more calendar years | Documentation of 120 CPE hours earned within the past three consecutive years, plus at least one year back in the field, verified by a manager, supervisor or colleague |
Retired status can't be reversed through CPE. Returning to Active means retaking the exam and reapplying for certification.
Revocation and reinstatement
A CISA who doesn't comply with the CPE requirements has the designation revoked. The certificate must be destroyed, the holder can no longer present themselves as a CISA, and the revocation is reported on certification verification requests.
A revoked holder can appeal for reinstatement in writing. The appeal includes a detailed explanation and CPE documentation from the time of revocation to the current year. If the appeal is approved, outstanding maintenance fees are paid before reinstatement, and a reinstatement fee may apply. If it's refused, returning to Active means retaking the exam and reapplying with the required experience.
10. Official ISACA Sources and Credential Holder Responsibility
This article sets out ISACA's published rules as at the research date in the verification log below. It doesn't replace ISACA's CPE Policy, ISACA's own guidance, or advice about your situation.
Research verified: 1 October 2026, against the CISA CPE requirements published on ISACA's certification maintenance, CPE and audit pages.
| Source | What it supports | Verified |
|---|---|---|
| Maintain CISA Certification | 20 and 120 CPE requirement; job-related relevance; multi-certification counting; fee due date, invoicing and member rates; ethics and auditing standards conditions; record retention; pre-loaded and self-reported CPE; revocation and appeals | 1 Oct 2026 |
| How to Earn CPE | Content test; qualifying categories, earning rules and annual limits; on-the-job and office software exclusions; self-study certificate rule; ISACA Journal quiz and eLearning | 1 Oct 2026 |
| How to Report CPE | 50-minute rule; quarter-hour rounding; worked example; self-reporting fields | 1 Oct 2026 |
| Annual CPE Audit | Documentation content; accepted and rejected evidence; Verification of Attendance form; audit selection and waivers; reporting after completion; shortfall consequences | 1 Oct 2026 |
| Certification Status Options | Non-Practicing and Retired status; return to Active; reinstatement appeal outcomes | 1 Oct 2026 |
| Code of Professional Ethics | Ethics condition; competency principle; disciplinary measures | 1 Oct 2026 |
Disclaimer: CPE requirements can depend on individual certification status, professional circumstances, jurisdiction and other factors. Requirements may also change over time. Credential holders are responsible for confirming their current CPE obligations directly with ISACA and, where applicable, their local jurisdiction, employer, regulator or other relevant authority. EverCPE.com does not guarantee that completion of any particular course will satisfy a credential holder's individual CPE requirements.
