More study resources

About this exam

The Certified Information Technology Professional (CITP) is an information technology credential associated with the accounting profession and offered in the AICPA & CIMA ecosystem. It is designed for professionals who bridge finance and technology - CPAs and other practitioners who audit systems, advise on IT risk, or lead technology initiatives inside accounting and finance functions. The exam's published domain structure covers information technology governance; information systems and infrastructure; information security, confidentiality, and privacy; and systems development, acquisition, and project management. That mix rewards candidates who can reason about controls, risk, and project delivery rather than recite product features.

Important caveat for anyone planning a study schedule: when this page's source was retrieved, the AICPA & CIMA credential page returned a 404 error, so current exam logistics - question count, duration, passing score, fee, format, retake policy, and validity period - could not be verified and are shown as unknown throughout this guide. The domain list and weights are likewise unverified placeholders pending review. Treat every number on this page as unconfirmed and check the official AICPA & CIMA site before booking. Preparation should focus on governance frameworks, IT general controls, security and privacy principles, and the systems development lifecycle, practiced through scenario-based questions that require judgment about risk and control design.

What you'll study

Common questions

About CITP preparation

Is this page affiliated with the AICPA or the CITP program?

No. This is an independent study resource and makes no claim of official affiliation, endorsement, or sponsorship. The credential names are used only to describe what the exam covers. Always confirm requirements, fees, and scheduling directly with the issuing organization before you register or pay.

How many questions are on the exam and how long do I get?

Unknown. The AICPA & CIMA credential page returned a 404 when retrieved, so the item count, time limit, and section structure could not be verified. This guide reports those values as null rather than guessing. Check the official site for the current blueprint before you build a timed practice plan.

What score do I need to pass, and what does it cost?

Not verified. Passing score and fee are both reported as null here because the source page was unavailable. Older figures circulate widely online and may be out of date, so do not budget or set a target score from memory or from third-party summaries. Confirm both numbers on the official AICPA & CIMA page.

What content does the exam cover?

The working outline has four areas: IT governance; information systems and infrastructure; information security, confidentiality, and privacy; and systems development, acquisition, and project management. These are unverified placeholders pending review, but they reflect the control-and-risk focus the credential is known for. Expect scenario questions that ask you to evaluate controls, not recall product menus.

How difficult is the exam, and what trips candidates up?

Candidates with audit or controls backgrounds typically find governance and security comfortable and struggle with infrastructure detail and project-management mechanics. The common failure mode is memorizing framework lists without practicing judgment: questions often present a situation where two answers are technically true and one better fits the risk. Practice explaining why each wrong option fails.

In what order should I study the four domains?

Start with governance, since it frames risk appetite and control ownership referenced elsewhere. Move to security, confidentiality, and privacy, which supply the threats and obligations the other domains respond to. Then study infrastructure, where technical vocabulary is densest, and finish with systems development and project management, which ties delivery discipline to the controls you already learned.

Can I retake the exam if I fail, and how soon?

Unknown. The retake policy, waiting period, and any attempt limits could not be confirmed because the official page was unavailable at retrieval. Policies like these change, and older descriptions are unreliable. Ask the issuing organization directly or check the current candidate handbook before assuming a cooling-off period.

How long is the credential valid, and what keeps it active?

Not verified. Validity period and any continuing-education requirement are reported as null here. Many IT credentials require annual maintenance or renewal fees, but you should not assume that applies without confirmation. Verify the current renewal terms with AICPA & CIMA so you do not let a credential lapse unintentionally.

How should I prepare in the final two weeks?

Shift from reading to retrieval. Work scenario questions under time pressure, then write a one-paragraph justification for each answer you chose and each you rejected. Revisit only the domains where your reasoning was weak. Because the exam's current format is unverified, practice both multiple-choice sets and written explanations so neither format surprises you.