CGRC vs CISA: Choosing Between GRC Practice and IT Audit

CGRC and CISA are both described as governance and compliance credentials, yet they train people for opposite sides of the same table: one builds and defends the control environment, the other independently tests it. ISC2's Certified in Governance, Risk and Compliance (CGRC, formerly CAP) follows a system through scoping, control selection, assessment, authorisation and ongoing compliance. ISACA's Certified Information Systems Auditor (CISA) covers the audit process itself and the IT governance, development, operations, resilience and protection areas an auditor examines. This guide compares the two on what each exam tests, experience rules, cost and renewal, the roles each one opens, where each sits in the three lines model, and how to decide. It is for GRC analysts, control assessors, IT auditors, people changing career into GRC, and the managers who write role requirements. Facts were checked on the ISC2 and ISACA websites on 14 November 2026; confirm them there before you book.

Key takeaways

• Pick by which line you work in. CGRC fits first and second line roles that own, operate or oversee controls and authorisation packages; CISA fits third line and external assurance roles that must stay independent of the controls they test.
• CGRC has the lower experience bar. ISC2 asks for two years of cumulative full-time experience in the CGRC domains; ISACA asks for five years of information systems auditing, control or security experience within the ten years before you apply.
• CISA is broader on IT operations. Over half the CISA outline (Domains 4 and 5, 26% each) covers operations, resilience and protection of information assets, while CGRC concentrates on the authorisation life cycle.
• CGRC maps to the NIST RMF, CISA to audit standards. CGRC domains track the Risk Management Framework steps used in US federal, defence and FedRAMP work; CISA holders commit to ISACA's IS Auditing Standards and Code of Professional Ethics.
• Many careers use both, in order. A common route is CGRC early in a GRC or assessor career, then CISA when moving into audit, or the reverse for auditors moving into control ownership.

The short answer

• Choose CGRC first if you prepare or manage system security plans, assessment reports and plans of action and milestones, if you work as an ISSO, ISSM, security control assessor or GRC analyst, or if your market is US federal, defence or FedRAMP, where ISC2 states CGRC is approved under DoDM 8140.03. It is also the easier credential to reach for a career changer, because the two-year experience rule and the Associate of ISC2 route lower the entry barrier.
• Choose CISA first if you work, or want to work, in internal audit, IT audit in an accounting or consulting firm, SOC 2 or ISO/IEC 27001 assurance, or a regulator's supervisory team, where the job adverts ask for an audit credential by name. ISACA describes CISA as the standard of achievement for auditing, monitoring and assessing IT and business systems.
• Plan both if you aim at head of GRC, IT audit director or a combined risk and assurance leadership role. One proves you can build an authorisable control environment, the other that you can judge one objectively.

For CGRC alone, with domain detail and a study plan, see the ISC2 CGRC Certification Guide. For CGRC and CISA alongside CRISC, CISM and other governance credentials, see the GRC and Risk Certifications Compared Guide.

Side-by-side comparison

ISACA's CISA page does not state the question count or duration, and ISC2's CGRC outline page does not state item count, duration or passing score. Get those from each body's candidate material at booking rather than from third-party sites, which often lag outline changes.

What each exam actually tests

CGRC: the authorisation life cycle

The seven CGRC domains follow one system from start to retirement. The right-hand column is our mapping to the steps of NIST SP 800-37 Rev. 2 (Prepare, Categorise, Select, Implement, Assess, Authorise, Monitor); it is not part of ISC2's outline.

Notice Domain 5. CGRC does cover assessment and audit, but from the inside: preparing the assessment plan, gathering evidence by interview, examination and test, and turning findings into risk responses and a plan of action. The emphasis is on reaching a defensible compliance decision for a system, not on running an audit function.

CISA: the audit process and the IT estate it examines

The practical difference: a CISA candidate must know how to plan an audit, choose a sample, judge evidence sufficiency and write a report, and must recognise good and poor control design across almost every IT discipline. A CGRC candidate must know how to select and tailor a baseline, document inherited and compensating controls, and keep a system's authorisation current through change.

Where each sits in the three lines model

The Institute of Internal Auditors' Three Lines Model, published in 2020 as an update to the Three Lines of Defense, describes how a governing body, management and internal audit work together on governance and risk management. Management holds first line roles (delivering services and owning risk) and second line roles (expertise, support, monitoring and challenge on risk). Internal audit holds the third line role, giving independent and objective assurance to the governing body. See the Three Lines Model for Cyber Risk Guide for how the model applies to security functions.

Independence is the sharpest dividing line. A second line assessor who helped design a control set can later assess it for the authorising official; an internal auditor generally should not audit controls they designed or ran. If you move from GRC into audit, expect your new employer to keep you off audits of areas you recently owned.

Roles each credential unlocks

• CGRC opens: GRC analyst, compliance analyst, information system security officer (ISSO) and manager (ISSM), security control assessor, FedRAMP and federal authorisation consultant, and authorising official's support staff. ISC2's DoDM 8140.03 approval matters for US defence workforce roles; see the FedRAMP Guide for the authorisation context many of these roles sit in.
• CISA opens: IT auditor, IT audit senior and manager, technology risk assurance roles in accounting and consulting firms, SOC 2 and ISO/IEC 27001 audit staff, and supervisory examiner roles. ISACA states CISA is required by many organisations and government agencies.

For the day-to-day of the GRC route, see the GRC Analyst Career Guide. For what a security-focused audit function does, see the Internal Audit for Cybersecurity Guide.

Salary signals and employer demand

Treat published salary figures with care. ISACA's CISA page reports figures from its own holder surveys: an average annual salary of over USD 149,000, 22% of holders reporting a pay boost, 70% reporting on-the-job improvement, and more than 151,000 professionals holding the credential. These are self-reported by holders and skew towards experienced, often US-based professionals, so they describe the population that holds CISA, not the uplift you will get from passing. ISC2's CGRC pages do not publish a salary figure.

Better demand signals are local and you can collect them yourself in an afternoon:

1. Count adverts by credential name. Search your target job boards for CGRC (and the old name CAP, which adverts still use) and for CISA, filtered to your city and target titles.
2. Read the requirement wording. Distinguish "required" from "or equivalent" and "desirable". Audit roles in accounting firms and regulated banks often treat CISA as required; federal contractor roles often list CGRC among several acceptable credentials.
3. Check contract and regulatory drivers. US defence roles map to DoD 8140 qualification lists; audit firms may have internal promotion rules tied to an audit credential.
4. Ask hiring managers. One conversation with an audit manager and one with a GRC lead in your market tells you more than any national survey.

Worked scenarios

Career changer from IT support, 18 months in a compliance team. This person runs evidence collection for an ISO/IEC 27001 surveillance audit and helps update the risk register. CGRC is reachable now: the work is in the CGRC domains, and if it falls short of two years they can pass and hold Associate status while it accrues. CISA would require five years of audit, control or security experience before certification. Recommendation: CGRC first, then reassess once they know whether they prefer building controls or testing them. See the ISO 27001 Certification Guide for the framework they are already using.

Federal contractor ISSO preparing authorisation packages. The daily work is system security plans, control implementation statements, assessment support and plans of action and milestones, which is the CGRC outline almost line for line. CGRC first, and it also helps with DoD 8140 qualification.

Accounting firm associate joining the technology risk practice. The firm's engagements are SOC 2 reports and IT general controls testing for financial audits. CISA is the credential the firm, its clients and its quality reviewers recognise. CISA first. The SOC 2 Guide covers the engagement type.

Internal auditor moving into a head of GRC role. They hold CISA and now own the control framework they used to audit. CGRC fills the gap on baseline tailoring and authorisation decisions; CRISC is the alternative if the role leans towards enterprise risk reporting rather than system authorisation. See the CRISC Certification Guide.

Security control assessor wanting to stay in assessment. CGRC covers the assessment step in the authorisation context; CISA adds sampling, evidence standards and reporting discipline. Start with the one your current contract or employer recognises.

Trade-offs and common mistakes

• Treating CGRC as US-only. The RMF vocabulary is federal, but the life cycle (scope, select, implement, assess, decide, monitor) is the same one ISO/IEC 27001 and PCI DSS programmes run. Outside the US, expect to explain the credential to recruiters who know CISA better.
• Taking CISA to become a better control owner. CISA teaches you to judge controls, not to run a control programme or tailor a baseline. If you will stay in the first or second line, CGRC or CRISC usually returns more.
• Underestimating CISA's technical breadth. Domains 4 and 5 carry 52% of the weight and range from database management and job scheduling to PKI, cloud and forensics. GRC practitioners who have never worked in IT operations often find this the hardest part.
• Booking CISA without the experience plan. You can pass the exam early, but you must apply within five years of passing and your experience must fall within the ten years before applying. Map your experience before you pay.
• Ignoring the renewal cost of holding both. Each body has its own CPE cycle, fees and ethics code. Choose learning that counts towards both where each policy allows, and check ISACA's revised CPE policy before 2027.
• Using either as a substitute for evidence of judgement. Interviewers for both roles test real cases: a finding you escalated, a risk acceptance you challenged, a control you redesigned. See the GRC Analyst Interview Questions.

Where identity fits

Both credentials spend real time on access control, and both roles hit the same weak spot in practice: non-human identities. CISA Domain 5 lists identity and access management explicitly, and in a CGRC authorisation the access control family is usually the largest block of evidence. Service accounts, API keys, workload identities and AI agent credentials are often missing from the access reviews and inventories both roles rely on. A GRC practitioner should include them in system scope and the access control implementation statements; an auditor should sample them alongside human accounts. The ISC2 CGRC Certification Guide covers how this shows up in authorisation evidence.

For hiring managers: writing the requirement

• Control ownership or authorisation roles: require CGRC or equivalent experience, accept CISA or CRISC as alternatives, and test RMF or ISO/IEC 27001 control tailoring at interview.
• Audit and assurance roles: list CISA as the preferred credential, and test audit planning, sampling and evidence judgement directly.
• Junior roles: avoid requiring CISA, whose five-year experience rule excludes most candidates; CGRC Associate status or an entry-level credential is a fairer filter.
• Write "CGRC (formerly CAP)" so that applicants and screening tools match both names.

How to approach it: a phased plan

1. Decide your line. Write down the three job titles you want in two years and place each in the three lines table above.
2. Audit your experience. Map your last five years against the CGRC domains and the CISA job practice. Note dates and a supervisor who can verify each period.
3. Check local demand. Run the advert count and one conversation with a hiring manager, as above.
4. Confirm current facts. Read ISC2's CGRC pages and exam pricing, and ISACA's CISA pages, CPE policy and candidate guide, on the day you book.
5. Prepare from the official outline. For CGRC, study against NIST SP 800-37 Rev. 2 and SP 800-53 Rev. 5 alongside the outline. For CISA, weight your time towards Domains 4 and 5 if your background is GRC, or Domains 2 and 3 if it is operations.
6. Apply promptly after passing. Submit endorsement (ISC2) or the application with verified experience (ISACA) while referees are available, and start logging CPE straight away.
7. Review after a year. If your role has shifted line, plan the second credential.

Measuring whether it paid off

• Interview conversion: share of applications to target roles that reach interview, before and after certification.
• Role scope: whether you now lead authorisation packages or audit engagements rather than supporting them.
• Finding quality: for auditors, the share of findings accepted by management without rework; for GRC staff, assessment findings closed by their plan of action due date.
• CPE health: credits logged against each body's cycle, with no lapse risk at the cycle end.
• Cost per outcome: exam, training and annual fees against salary change or promotion within 18 months.

Framework mapping

The work each credential prepares you for lines up with these framework elements.

Practitioner checklist

• Place your next target role in the first, second or third line before choosing.
• Map your experience against CGRC's two-year and CISA's five-year-in-ten rules, with dates and verifiers.
• Count local adverts for CGRC, CAP and CISA in your target titles.
• Confirm exam fee, format and window on the ISC2 and ISACA pages the week you book.
• Check ISACA's CPE policy changes effective 1 January 2027 if you will hold CISA.
• Budget annual fees and CPE for every credential you intend to keep.
• Study CGRC against NIST SP 800-37 and SP 800-53; study CISA with extra time on operations and protection domains.
• Include non-human identities in scope, access reviews and audit samples in whichever role you take.

Standards and references

• ISC2: CGRC Certified in Governance, Risk and Compliance
• ISC2: CGRC Certification Exam Outline
• ISC2: CGRC Experience Requirements
• ISACA: CISA Certified Information Systems Auditor
• ISACA: CISA Exam Content Outline
• ISACA: Get CISA Certified
• NIST: SP 800-37 Rev. 2 Risk Management Framework for Information Systems and Organizations
• The IIA: The IIA's Three Lines Model, an update of the Three Lines of Defense

Related NHI Mgmt Group resources: GRC and Risk Certifications Compared Guide, CISSP vs CISM, CISM Certification Guide, How to Read a SOC 2 Report Guide, Cybersecurity Certifications Guide.