The official ISACA Review Manual for CISA runs well over a hundred dollars, and the official question manual costs more still. Together they are a sizeable fraction of the exam fee, and neither one is written to teach you the material. The Review Manual is a reference. The question manual is a bank of drills. Read either cold and you will learn what is on the exam without learning how any of it works.
That is the first thing to understand before you spend anything on Certified Information Systems Auditor prep. The second is quieter and more expensive to get wrong. ISACA updated the CISA job practice on 1 August 2024, and it moved real weight onto operations, resilience, and protecting information assets. Several of the cheapest, most reviewed CISA books on Amazon still teach the 2019 job practice, and nothing on the front cover warns you. As of September 2026 the shelf is a mix of current books, books one cycle behind, and self published titles that borrow the exam name and little else. This guide sorts the three, verified against ISACA’s exam content outline and live Amazon listings the day it was written.
If you are booking the exam this year, buy for the 2024 job practice. Everything below is judged against that first, and on price and page count second.
How to tell which job practice a CISA book teaches
CISA has no exam code to read off the cover, the way a CompTIA exam does, and the same trap plays out in our CySA+ book guide for a different reason. What changes under CISA is the job practice, updated every few years, and the current one took effect on 1 August 2024. A book built for it will say so, usually on the cover or the first page. A book on the previous cycle will either state that it covers the 2019 exam, or name no year at all, which on a book printed before mid 2024 means 2019.
| Job practice | Status | How to spot it on the cover |
|---|---|---|
| 2024 | Current | Says “2024”, or “aligned with the CISA Review Manual 2024” |
| 2019 | Superseded | Says “2019 exam”, or names no year and was printed before mid 2024 |
One line you will see on the current Sybex covers reads “covers 2024 to 2029 exam objectives”. That range is the publisher’s, not ISACA’s. ISACA states only that the job practice is effective from 1 August 2024 and revises it when it revises it. Treat the end year as marketing and the start year as the thing that matters.
What the 2024 job practice actually weights
The exam is 150 multiple choice questions in four hours, scored on a scale of 200 to 800, and you pass at 450. Where those questions come from is the job practice, five domains carrying these weights.
| Domain | Weight |
|---|---|
| Information Systems Auditing Process | 18% |
| Governance and Management of IT | 18% |
| Information Systems Acquisition, Development and Implementation | 12% |
| Information Systems Operations and Business Resilience | 26% |
| Protection of Information Assets | 26% |
Two domains carry 26% each, and together they are more than half the paper. The 2024 update is what raised them. A book that is thin on operations and resilience, or thin on protection of information assets, is thin on the majority of the exam, and that is exactly where an older book tends to be light. CISA also asks for five years of information systems audit, control, or security experience before it certifies you, with up to three years waivable through education, so treat the reading as the start of the work rather than the whole of it.
The five CISA books at a glance
These come from the four publishers that actually maintain a CISA line: ISACA, McGraw Hill, Wiley’s Sybex imprint, and Packt. Three are built for the 2024 job practice, one is an excellent explainer stranded on the 2019 one, and the last is not an exam book at all. Nothing here was lab tested, because these are books, so the honest claim is verification against publisher pages and live listings rather than benchmarking. Prices move week to week, so each figure is a band to check against the live listing.
| Book | Publisher | Job practice | Pages | What comes with it | Price band |
|---|---|---|---|---|---|
| CISA Study Guide, 3rd ed (Doshi) | Packt | 2024 | 356 | 1000+ online questions, flashcards | about $38 |
| CISA Study Guide + Practice Tests bundle | Sybex | 2024 | 832 plus tests | Sybex online test bank, 700 questions | about $63 |
| CISA Official Review Manual, 28th ed | ISACA | 2024 | 574 | Reference only | about $120 |
| CISA All-in-One Exam Guide, 4th ed | McGraw Hill | 2019 | 816 | Total Tester online, 300 questions | about $24 |
| IT Auditing, 3rd ed | McGraw Hill | Practitioner | 576 | Reference only | about $53 |
The table shows the central problem in one glance. The cheapest large book is the out of date one, and the most expensive is a reference you will not read front to back. Neither is where most people should start, so check the live price on all of them, then read on for which to actually buy.
1. CISA Study Guide, Third Edition by Hemang Doshi
Start here if you are buying one book. Hemang Doshi wrote it for the 2024 job practice, and at 356 pages it is built to be read, not shelved.
It is the most current mainstream CISA guide and the cheapest of the aligned ones. The cover states plainly that it is aligned with the CISA Review Manual 2024, and it ships with web based practice: more than a thousand questions, flashcards, and exam tips. Doshi keeps chapters short and closes them on quick reference summaries, which is the format that survives a commute. He has written across CISA, CRISC, and CISM, and it shows in how tightly the content maps to what the exam asks rather than to the subject in general.
Who it is for: anyone sitting CISA on the current job practice who wants one book that covers the ground and drills it. Skip it if you want an exhaustive standalone reference. At 356 pages it summarizes where the Review Manual and the 800 page guides expand, so a reader coming in with no audit background may want more explanation on the operations and resilience material. Around $38, check the live price.
2. CISA Study Guide and Practice Tests Bundle by Gregory and Chapple
If Doshi is the concise route, this is the thorough one. Peter Gregory and Mike Chapple wrote the current Sybex study guide, and the bundle pairs it with a separate book of practice tests.
You get 832 pages of study guide, a 700 question companion, and a year of access to the Sybex online learning environment with further practice exams, a hundred electronic flashcards, and a searchable glossary. This is Sybex’s first CISA guide under this authorship, published for the 2024 job practice. Gregory is also the author behind the McGraw Hill All-in-One further down this list, which tells you where his current work has moved. Buy the bundle rather than the two books separately when the price gap is small, and check that gap, because it shifts. The study guide has a standalone listing too, but it was on backorder when this was written, so the bundle is the reliable way to get it.
Who it is for: anyone who learns by volume and wants the study guide and a large question bank from a single publisher. Pass on it if 832 pages plus a second book is more than your timeline allows, in which case Doshi covers the same job practice in a third of the reading. Around $63 for the bundle, check the live price.
3. CISA Official Review Manual, 28th Edition
This is the source the other books are written from. The 28th edition is ISACA’s own manual for the 2024 job practice, and it is a reference first and a teacher a distant second.
It runs to 574 pages, organized to the job practice domains, and it is priced well above every other book here. It is precise, authoritative, and dry, and it assumes you already have the audit background the exam expects. What you are paying for is the definitive wording of what ISACA tests, which matters most when a third party book and your own reading disagree and you need the tie broken. ISACA prices it differently for members and non members, so check the current price on both the ISACA store and Amazon before you decide where to buy.
Who it is for: candidates whose employer is paying, and anyone who wants the canonical text on hand to settle disputes. The case against it is simple. If you are studying alone on your own money and want to be taught, a 574 page reference at this price is the wrong first purchase. Buy Doshi or the Sybex bundle, and keep the manual as the book you reach for when something does not add up. Check the live price.
4. CISA All-in-One Exam Guide, Fourth Edition by Peter Gregory
Read the caveat before the praise: this book teaches the 2019 job practice, not the current one. Its own cover says as much, in the line about complete coverage of all current domains for the 2019 exam.
With that stated, it is the best single author explanation of CISA material in print, 816 pages that expand where Doshi summarizes, backed by a Total Tester online bank of 300 questions. It is also the cheapest large book on this list. There is no fifth edition, and Gregory’s current aligned work is the Sybex guide above, so this is a teacher rather than an alignment reference. What it still does better than anything else is explain why a control exists and how an auditor reasons about it, and that reasoning did not change in the 2024 update even where the domain weights did. Buy it to understand the material, and pair it with a current question bank.
Who it is for: readers who want the deepest explanation and will supplement the parts the 2024 job practice reweighted. Skip it if you want a single book that matches the current exam out of the box, because on domain weights and the newest content it is a cycle behind. Around $24, check the live price.
5. IT Auditing: Using Controls to Protect Information Assets, Third Edition
The last pick is not an exam book, and that is the point. IT Auditing is the practitioner reference behind the job that CISA certifies you to do.
The third edition runs to 576 pages, written by working auditors, and it walks through how to audit specific technologies, from the data center to the network to the cloud, with the controls and test steps an auditor actually runs. It maps onto the exam obliquely rather than chapter by chapter, but the protection of information assets and operations domains, the two that carry 26% each, are exactly the ground it covers. It also stays on your shelf after you certify, when the study guides are ready to recycle. If you are new to audit and the exam material feels abstract, this is the book that makes it concrete.
Who it is for: candidates who want the real work behind the exam, and new auditors who will keep the book on the job. Skip it if you only have time for exam shaped material before test day, since this teaches the practice, not the question format. Around $53, check the live price.
The official question bank, and the books to leave on the shelf
Two things you will meet on Amazon deserve a warning rather than a link.
ISACA sells an official question manual alongside the Review Manual. The current one is the 13th edition, built for the 2024 job practice, and it is sold mostly through ISACA’s own store rather than Amazon. The edition you will actually find on Amazon is the 12th, which is aligned to the 2019 job practice and priced above two hundred dollars. Do not buy the 12th expecting current questions. If you want the official bank, get the 13th from ISACA. Otherwise the practice questions bundled with Doshi and the Sybex set cover the same need for far less.
The second warning is the row of cheap paperbacks with titles like CISA Study Guide 2024 to 2025 and CISA Exam Prep, priced between about fifteen and forty dollars and carrying no established publisher. ISACA, McGraw Hill, Wiley’s Sybex, and Packt are the four houses that maintain a real CISA line. A generically titled guide from none of them, printed to ride the exam’s search traffic, is not worth the saving, and Amazon has been tightening its own rules on study guide and companion titles for that reason. If you are certifying across the wider security stack, our guides to CompTIA Security+ books, Network+ study guides, and Linux+ books apply the same publisher and edition checks, and the broader cybersecurity and penetration testing reading list covers ground beyond any single certification.
Check these before the book goes in the cart
The failure mode with CISA books is not buying a bad book. It is buying a good book for the wrong job practice, or a plausible looking one from no publisher at all. Before you order, run four checks.
- The job practice year. Current is 2024. If the cover or first page says 2019, or names no year on a book printed before mid 2024, it teaches the superseded cycle.
- The publisher. ISACA, McGraw Hill, Wiley’s Sybex, or Packt. A generic imprint on a 2024 to 2025 titled paperback is the tell of a filler book.
- What comes with it. The aligned study guides bundle a real online question bank. If a listing promises hundreds of questions, confirm they are current rather than recycled from an older edition.
- The price against the job. A 574 page reference and a 356 page study guide are priced for different readers. Buy the one that matches how you study, not the one that is cheapest or most complete on paper.
Run those at the shelf and you avoid the only expensive mistake here, which is studying hard from the wrong book and finding out on exam day. Buy for the 2024 job practice, drill the questions that ship with it, and keep one practitioner reference for the parts the exam leaves abstract.
