How long to study for CGEIT? Budget 100 to 130 hours and give them about 12 weeks, which works out at nine to eleven hours in a normal week. The schedule below spends 116. Where you land inside that range depends almost entirely on how much governance work already crosses your desk on a Wednesday morning.
The number matters less than the allocation. CGEIT is 150 multiple-choice questions in 4 hours across four domains that ISACA weights at 40, 15, 26, and 19 percent. Nearly every schedule you will find walks the material a chapter a week at an even pace, which hands Domain 2 as much attention as Domain 1 even though Domain 1 carries close to three times the questions. Here the weights come first and the calendar is derived from them.
How long to study for CGEIT depends on where you already sit
Certification asks for five or more years of experience managing, advising on, or otherwise supporting the governance of the IT-related contribution to an enterprise, spanning at least three of the four domains, with at least one year in Domain 1. The CGEIT requirements post covers what counts. That rule gates the credential, not the exam, so sitting before the experience is complete is normal.
It also tells you who is reading this. The typical candidate is a head of IT, a governance lead, or a CIO's deputy, someone who already loses two nights a week to a committee pack. The plan has to survive a working week with travel in it, so nothing here asks more than twelve hours of any single week.
If you already write board papers about IT value, sit on a steering committee, and argue about portfolio prioritization, much of this is vocabulary work. You do the job; the study is learning ISACA's names for it. A hundred hours is a fair target.
Coming into oversight from a technical, audit, or security role, plan for the top of the range or past it. The gap is not knowledge, it is stance. You have been trained to fix, test, or secure the thing, and CGEIT wants you to evaluate, direct, and monitor whoever fixes it. Rewiring that reflex is what most of the 130 hours buys.
Why the 12 weeks follow the 40/15/26/19 weights
Apply the weights to 150 questions and the shape of the paper is obvious. Domain 1, Governance of Enterprise IT, comes out near 60 questions. Domain 2, IT Resources, near 23. Domain 3, Benefits Realization, near 39. Domain 4, Risk Optimization, near 28. Those are our figures rather than ISACA's, which publishes the percentages and not a per-domain item count, so use them to divide your calendar and nothing else.
Domain 1 and Domain 3 together decide two thirds of the paper, so they take five of the eight domain weeks here and 56 of the 84 content hours. Domain 2 gets one week, because it is roughly 23 questions and you have finite Tuesdays. CGEIT domains explained unpacks the sub-areas behind those four numbers.
Why COBIT 2019 comes before any domain work
The first two weeks contain no domain content at all, and that is deliberate.
COBIT 2019 is the spine of this exam: the governance-versus-management split, the EDM domain against APO, BAI, DSS, and MEA, the 40 governance and management objectives, the governance system and framework principles, the seven components, the 11 design factors, and ISO/IEC 38500's Evaluate, Direct, Monitor model. Learn it once, properly, and every later chapter reads as an application of it.
Skip it and the domains sound like generic management advice, because you have no basis for elimination. A large share of CGEIT distractors are wrong only in that they describe a management action when the stem asked what the governance body should do. Without the EDM vocabulary, those options look as good as the keyed one.
The 12-week CGEIT study plan
Read on weekday evenings. Keep one longer weekend block for questions on whatever you just covered.
| Week | Focus | Hours | What you cover |
|---|---|---|---|
| 1 | Foundations, part 1 | 6 | Governance versus management, the board and executive lens, value, risk and resource as the three outcomes, decoding BEST, MOST, and FIRST stems |
| 2 | Foundations, part 2 (COBIT 2019) | 8 | EDM against APO, BAI, DSS, MEA; the 40 objectives by purpose; governance system and framework principles; seven components; 11 design factors; ISO/IEC 38500 |
| 3 | Domain 1A (40%) | 11 | Framework components, board versus steering committee accountability, shared services alignment, strategy development and initiative prioritization, legal and regulatory compliance, culture and business ethics |
| 4 | Domain 1B | 12 | Strategy alignment and the goals cascade, evaluate-direct-monitor over strategic planning, stakeholder engagement, communication and awareness, enterprise architecture, policy versus standard versus procedure |
| 5 | Domain 1C | 11 | Information architecture, the information asset lifecycle from creation to disposal, owner versus steward versus custodian, classification and handling rules |
| 6 | Domain 2 (15%) | 12 | Sourcing and retained accountability, capacity planning, acquisition, IT resource lifecycle and asset management, competency development, contracted services and vendor governance. 60-question timed checkpoint at the end |
| 7 | Domain 3A (26%) | 11 | Performance management and the IT balanced scorecard, governance-level change management, monitoring, decision-ready reporting, quality assurance versus quality control, improvement driven by measurement |
| 8 | Domain 3B | 11 | Business case development and the four-question value test, investments across the full economic lifecycle, investment ownership, performance metrics, TCO, ROI, NPV, and payback |
| 9 | Domain 4A (19%) | 8 | Risk frameworks and standards, aligning IT and information risk with enterprise risk management, appetite versus tolerance versus capacity, who sets the thresholds |
| 10 | Domain 4B | 8 | Risk programs across IT-enabled capabilities, processes and services, translating threats into business risk for a board, the risk lifecycle, qualitative versus quantitative assessment |
| 11 | Rehearsal and repair | 12 | Full-length timed 150 on the first clear day, then nothing but review of it, plus a re-read of your weakest Domain 1 or Domain 3 block |
| 12 | Taper | 6 | Error log and decision rules only. No new material. Light review, then stop 48 hours out |
The hours lean early. Weeks 3 to 6 are the heaviest because Domain 1 is 40 percent of the paper and everything after it reads better once accountability and the goals cascade have settled. Weeks 11 and 12 are the lightest, which is also deliberate.
When should CGEIT practice questions start?
From the end of week 2, then every week after. Not in the last fortnight.
Week 1 is genuinely too early, and this is the one place I would hold a candidate back. Until you can separate a governance action from a management action, every option looks defensible and answering blind teaches you nothing. Once the EDM split lands, questions become the main event.
What you are building is a ranking instinct, and instincts come from repetition spread over weeks rather than a burst at the end. Ten to fifteen scenario items a week, drawn from whatever you just read, does the job. The rules stick when you watch a plausible wrong answer lose and read why, which is what makes explained answers worth more here than on a recall exam. Our CGEIT study guide is built that way, with per-chapter scenario sets and a full-length 150-question practice exam, every answer explained. The CGEIT practice questions walkthrough names the rules that recur and works a live item through them.
Where does the full-length 150-question rehearsal go?
Week 11, early, under exam conditions: the full 150, the full 4 hours, no pausing, nothing looked up, phone in another room. You get 96 seconds an item, which feels generous until question 120, when the stems are still five lines long and your judgment has gone flat.
Week 6 carries a smaller checkpoint: 60 questions from the Domain 1 and Domain 2 material under a 96-minute clock. It predicts nothing. It shows you at the halfway mark whether your pacing and your elimination habit work, while six weeks remain to fix them.
Budget more time reviewing the full-length run than you spent sitting it. Work through everything you missed and everything you guessed correctly, and note the reasoning rule that failed rather than the fact. Expect a handful of repeat offenders, not a long list.
Do not set a percentage target for practice runs. Scoring is scaled from 200 to 800 with 450 to pass, and nothing published maps that mark onto a number of correct items, so a practice percentage shows a trend and says nothing about your margin. How hard is the CGEIT exam covers the scoring in full.
Where CGEIT candidates overspend
Two traps, with an opinion about each.
The first is Domain 2. IT Resources is 15 percent, about 23 questions, and it is the most comfortable reading in the book for anyone who has run an IT function: sourcing models, capacity, asset lifecycle, vendor service levels. Every sentence lands first time, and that ease reads as progress. Cap it at its single week even if it feels underdone. The same warning applies to Domain 4 for risk people, where appetite and tolerance are home turf worth about 28 questions.
The second trap costs more. Information governance, sub-area 1C, gets skipped because it looks like a data-management sidebar. It is one of the three sub-areas inside the 40 percent domain, and owner versus steward versus custodian, plus classification-driven handling, produce a steady supply of items where the technically capable answer is not the governed one. Week 5 stays.
How the six-month eligibility window sets your start date
Work backward. More schedules die here than on the study side.
Registration opens a six-month window to sit in. The classic failure is paying on the day the decision is made, drifting for fourteen weeks, then trying to fold 12 weeks of work into the fortnight before the window shuts. One six-month extension is available at US$75, and it is better not to need it. CGEIT exam cost and fees has the registration, extension, and retake detail.
So fix the date first: choose a target sitting, count back 12 weeks, begin on that Monday. Register when about 16 weeks of window remain and you have the 12 plus a month of margin. You will never quite feel ready, so let the booked date do that job for you.
One check before you build anything around this schedule: the 2020 CGEIT Exam Content Outline is current for 2026, but ISACA refreshes job practices periodically, so confirm it on ISACA's CGEIT Exam Content Outline page the day you register. What the CGEIT certification is covers the format and the domains.
What do you cut when a week disappears?
Something will eat a week over three months. Sacrifice in this order: the back half of week 10, then the repair reading in week 11, then the back half of Domain 2. The timed 150 and its review are the last things to go, and really they should not go at all. One properly reviewed full-length run beats a second read of every chapter. Lose more than two weeks and you move the date rather than compress the taper, because the closing fortnight earns its place even though it looks like coasting.
FAQ
How many hours do you need to study for CGEIT?
Most candidates land between 100 and 130 hours, or nine to eleven hours a week across 12 weeks. The schedule above spends 116. If you already sit in governance meetings and write board papers about IT value you may need closer to 100; arriving from a technical, audit, or security role pushes you toward the top. Set your own figure after the week 6 checkpoint, not before.
Can you study for CGEIT in four weeks?
Almost certainly not. Domain 1 alone is roughly 60 of the 150 questions and rests on COBIT 2019 vocabulary you have to build before any of it makes sense. The exam also tests a ranking instinct, and instincts do not compress. Eight weeks is the sensible floor, and only if enterprise IT governance is already your day job.
Should you study the CGEIT domains in order?
Take COBIT 2019 first, then yes. Domain 1 is both the largest at 40 percent and the one whose vocabulary the other three are tested through: accountability, the goals cascade, policies and standards, information ownership. Benefits realization reads better once you know who owns an investment, and risk optimization reads better once appetite has somewhere to sit.
How many practice exams should you take before the CGEIT?
At least one full-length 150-question run under the 4-hour clock in the final fortnight, plus weekly scenario sets from week 2 onward and a shorter timed checkpoint around week 6. On a judgment exam the count matters less than the review: what moves your score is naming the reasoning rule that failed on each missed item, then drilling it.
Do you need five years of experience before booking the CGEIT exam?
No. The five-year governance experience requirement applies to certification, not to sitting the paper, and you have five years from passing to apply. CGEIT has no general waiver or substitution scheme, unlike CISA and CISM. ISACA's support article does describe a narrow exception, saying the one year of Domain 1 experience can be waived for holders of the COBIT Design and Implementation certificate, while the Candidate Guide's summary table says CGEIT allows no waivers or substitutions. The two pages disagree, so confirm with ISACA before relying on it.
Looking for a plain-English CGEIT guide? ISACA CGEIT: Simply Certified Study Guide covers all four domains at their 40/15/26/19 weights, with a full-length 150-question practice exam, every answer explained.
Simply Certified is an independent publisher. CGEIT and ISACA are trademarks of ISACA. Our books are independent study material and are not affiliated with, endorsed by, or sponsored by ISACA.