The first reply is correct for Unix servers. My reply is only for Windows.
The default location of an init.ora file is %ORACLE_HOME%\database. For example, your database might use file c:\oracle\ora920\database\initSID.ora.
I keep the init.ora files in the same folder tree as my other admin files. For example, under folder "c:\oracle\admin\SID" I would create a minimum of four folders bdump, pfile, pwfile, and udump. The location of folders bdump and udump is identified in your initSID.ora file. The location of the pfile and pwfile folders is managed by the Windows registry. For example, I create registry entry HKLM/software/oracle/home0/ora_SID_pfile with a value of c:\oracle\admin\SID\pfile\initSID.ora and I create registry entry HKLM/software/oracle/home0/ora_SID_pwfile with a value of c:\oracle\admin\SID\pwfile\pwdSID.ora
SQL*Plus from the DOS command line behaves differently from the SQL*Plus GUI, when it comes to issuing the startup commands. Try both ways of starting the database before and after adding the pfile registry entry. Neat stuff.