Is CISA certification suitable for professionals from non-auditing backgrounds, or is prior experience essential?