Scaled Score and Preliminary Status

Scaled Score and Preliminary Status

CISM scoring confuses candidates because it does not work like a school test. ISACA reports a scaled score from 200 to 800, and 450 is the minimum passing score. The scale is produced by psychometric equating, which adjusts for the difficulty of the particular form you sat so that 450 means the same level of competency no matter which questions you received. Because of equating, you cannot translate a raw "number correct" or a practice-test percentage into a scaled score -- there is no published formula, and 450 is not 56%, 70%, or any fixed fraction of 150.

Why equating matters

Different exam forms are not identical in difficulty. Equating means that if your form happened to include harder items, the raw-to-scaled conversion is adjusted in your favor, and a slightly easier form is adjusted the other way. The practical consequence for study is that chasing a target percentage is meaningless; what you control is consistent mastery across the blueprint. Two candidates who answer the same number of items correctly on different forms can receive different scaled scores, and both can be correct.

What happens at the end of the exam

The on-screen result is preliminary because ISACA still runs quality and scoring reviews before confirming it. In normal cases the preliminary and official results agree, but the official report in your ISACA dashboard is the authoritative one. ISACA does not release your answers or which individual questions you missed -- only the total scaled score and a breakdown by domain so you can see relative strength.

Reading the domain feedback correctly

The domain breakdown is diagnostic, not a per-domain pass/fail. There is no rule that you must clear each domain separately; you pass on the single total scaled score. Use the breakdown to guide a retake or ongoing learning, not to second-guess a pass. A common misread is treating a weak domain percentage as if it knocked points off in a way you could reverse-engineer -- it does not. If you fail, the breakdown is genuinely useful: a low score in Program (33%) or Incident (30%) is far more consequential to fix than a low score in Governance (17%), because those domains carry more of the total.

If you do not pass

• You may attempt the exam up to 4 times in a rolling 12-month period.
• Wait 30 days after the first attempt before retaking; 90 days after the second and third attempts.
• Each attempt requires paying the full registration fee again (US$575 member / US$760 nonmember).

These waits compound: if you fail your first attempt, the earliest a fourth attempt could occur is roughly 30 + 90 + 90 days after the first, even before scheduling availability. So a retake plan should treat each sitting as a real, well-prepared attempt rather than a cheap probe of the question pool.

Trap to avoid: do not chase a high practice-test percentage as if it equals the scaled score. Practice averages are useful for finding weak domains and pacing, but a "75% practice average" does not map to a passing 450. Aim instead for consistent mastery across all four current domains, weighting toward Program and Incident, which together dominate the blueprint. A second trap is over-reading the preliminary result: it is reliable in the vast majority of cases, but you are not formally certified -- and should not announce a final score -- until the official report posts.

What a scaled score is, in plain terms

A scaled score is a transformation of your raw performance onto a common ruler. Think of it like converting temperatures: 0 and 100 on the Celsius scale always mean freezing and boiling regardless of the thermometer used, even though the underlying measurement varies. The 200-800 CISM scale works the same way -- 450 always marks the competency boundary, and ISACA's equating model maps each form's raw scores onto that fixed ruler. This is why two forms with different question difficulty can both fairly use 450 as the cut.

How to use practice scores correctly

Because you cannot convert a practice percentage into a scaled score, use practice differently:

A defensible readiness signal is scoring comfortably above your bank's stated passing threshold across several full-length mocks, with no single domain dragging -- especially Program and Incident, which together dominate the blueprint. One strong mock is noise; a stable trend across the four domains is signal. And remember the equating point one more time: aim for genuine mastery, not a target percentage, because the percentage is not what ISACA reports and not what determines your result.