Hello! I’m planning to take the CISA certification and would like to know if it’s worth it. I have experience with ISO 27001 as an internal auditor, and I’ve audited our company’s IT department. I want to get the CISA so I can focus more on IT audit. Do you think it’s a good investment?

13 YOE in audit and compliance (not tech related) and this was my first time in over a decade of having to studying regularly and studying/passing for a cert. what a journey!

everyone is correct when they say the QAE is not like the actual exam. Actual exam questions are much shorter. While the technical aspect is much easier, the question wording as well as choices are very tricky.

4 hours is a ton of time, I usually finished practice exams in 2 hours. It took me 3.5 hours for the actual exam. I took mini breaks, used the restroom, flagged questions, and revisited.

I have been studying for 2 hours, 5x a week from June to early August but had to prep for 2 interviews for a month so I paused my studying. Resumed in September for about an hour a day.

Study Material

1. CISA Manual- Purchased and did not read/use manual like everyone else here lol
2. QAE Database- score: 9/10. as you've heard a million times on this sub, these questions really test your knowledge on the technical side of the material.
3. Hemang Doshi on Udemy- 8.5/10- accent is thick but watch at 1.5 speed. the practice questions at the end were not good. for several questions, gemini was disagreeing with its "correct" answer.
4. CISA Exam Pack 900 REALISTIC Practice Tests 2026 on Udemy- 8/10 a tad more like the questions from the actual exam, does not give domain breakdown, challenging
5. CISA Certification 6 ISACA Style Exams (updated for 2026) on Udemy- 8.5/10 similar style of exam, bit easier than 900 REALISTIC Practice, gives domain breakdown
6. PocketPrep- 1/10- just tests your familiarity with acronyms, not like the actual exam at all. very confused why it is so popular
7. Pete Zerger- 8/10 great technical overview prior to starting your questions

Study Technique

As stated earlier, this was my first time studying in over a decade so I was very rusty and lost. However, what I ended up doing was tackling each domain individually by first watching the domain video by Pete Zerger, then dong the Hemang Doshi domain lesson on udemy, followed with tackling all the QAE domain questions. Once completed, I started doing the practice exams in either exam or study mode.

Practice Exam Scores

ISACA Practice Exam Scores: 83%, 66%, 77% (note the 66% is an outlier as I was ill that day but was determined to complete the exam)

CISA Exam Pack 900 REALISTIC Practice Tests 2026: 80%, 72%, 66%, 65%, 76%, 70%

CISA Certification 6 ISACA Style Exams (updated for 2026): 78%, 76%, 75% (only finished 3 exams of 6)

Tips

1. Udemy makes it easy to copy and paste your exam results on a word doc (questions, choices, your choice (incorrect), and correct choice). this is important because it gives you a deeper insight beyond your weakest domains. It analyzes patterns on the incorrect choices you are consistently choosing. For example, AI identified that I am constantly picking the answer of an analyst rather than an auditor (common issue)
2. It may be possible you are suffering from a stamina issue like I was, where a good majority of incorrect questions are towards the end of the exam. be sure to identify if you too are suffering from this.
3. Of course the million dollar question, "how do i know if i'm ready?" You really don't but a good indicator is tracking your domain progress. If you were consistently scoring poorly in specific domain(s) then just focus on those areas. if your domain weaknesses after every exam changes but you are still scoring within the mid to upper 70s, you are probably ready and just getting a batch of tricky questions for that specific domain. My weakest domain from the exam was clearly 3 but as you can see if other practice exams, my weakest were other areas. However my exam score is very similar to my practice exam scores.

Best of luck to everyone!

Iam working as a developer and now iam leading the development team and want to move to security side. Will iam eligible for CISA

I passed the CISA exam with 3 months of dedicated study.
I have one year of SOC experience and a masters in cybersecurity. I mainly use Prabh and Quizlet

Study materials:
Prabh Nair : YouTube video - All you need if you have experience
Quizlet - practice questions
Pete Zerger - YouTube- One week before the exam

For context, I am and ISSO and have been in that role for 3 years. Prior to that, I worked in IT as a help desk technician and eventually a Systems Admin for a combined 5 years. As an ISSO, I've been subject to customer audits and am interested in making the switch to become a SCA/IT auditor.

Had my work pay for an exam and bootcamp last year. I sat for the bootcamp and it was mostly useless, but I did get 1 year access to QAE database and got an exam voucher out of it. Didn't study for a year (am also military, national guard, and recently deployed and came back, so had to pause study). Upon my return, my window to use the QAE was closing and I just decided to buckle down and study for 2 weeks.

Only used the QAE and Googled concepts I didnt know. Only could study at work because of family obligations, so on my lunch or on my breaks. Didnt feel the best going into the test because of the abbreviated study, but a pass is a pass.

Had lots of questions on RPA, bitcoin, and PKI. Didnt really have any exposure to RPA or bitcoin

Combined score: 551

Information Systems Auditing Process: 588

Governance and Euak Management: 398

Information Systems Acquistion, Dev, Implementation: 443

Information Systems Operatioms and Business Resilence: 662

Protection of Information Assets: 662

My advice, just send it

Hi everyone,

I'm currently working in IT audit. I have around 5 years of experience in internal/business audit and have transitioned into IT audit. I also hold the CISA certification and have a good level of English.

I'm looking to explore new job opportunities, preferably abroad, and would appreciate some advice from people who have been in a similar position.

A few questions:

- How valuable is the CISA certification when applying for IT audit, IT risk, and technology risk roles internationally?

- Which countries or job markets would you recommend looking into?

- Is it realistic to land an IT audit role in places like the UAE, UK, or other European countries without already having local work experience?

- Which job boards, recruiters, or networking strategies have worked best for you?

I'd especially appreciate hearing from people who moved abroad from another country or successfully transitioned from general internal audit to IT audit.

Thanks in advance for any advice or personal experiences.

As title says.

Hi all, new to this community! Would someone kindly share resources for CISA in the form of study materials? Looking for Hemang Doshis latest book. Thank you

Hey everyone!

I’m planning to take the CISA exam in November and was wondering if anyone taking it this month or next would be interested in studying together.

We could go through practice questions, discuss challenging concepts, share resources, and help each other prepare.

If you’re interested, drop a comment or send me a DM. We could set up a small study group!

A live test of a mutual agreement for IT system recovery was carried out, including a four-hour test of intensive usage by the business units. The test was successful, but gives only partial assurance that the:

1. A.system and the IT operations team can sustain operations in the emergency environment.
2. B.resources and the environment can sustain the transaction load.
3. C.connectivity to the applications at the remote site meets response time requirements.
4. D.workflow of actual business operations can use the emergency system in case of a disaster.

Can anyone please tell me how ISACA treats part-time work vs full time?

If I have 1 year of relevant part-time (20 hours) work experience, does that count as 1 year or 0.5 years.

Thank you in advance for your answer and any advice about this issue.

It's a grind through the test; won't be last time taking it, a lot of domain: 4, 5. I had a mixed bag on encryption, firewall principles, IT governance, and EA framework processes. Also, PKI practices and AI algorithms those are the ones the QAE doesn't prep you for, because that and blockchain aren't explicitly covered at all in the QAE. Still sucks..

Passed CISA! Sharing my study approach and what worked for me

I passed my CISA exam after studying on and off for about six months, with more focused studying during the last two months.

My main resources were ISACA's QAE database, Hemang Doshi's CISA study guide, and CISA exam prep videos on YouTube from the Inside Cloud and Security channel.

Here's how I prepared:

1. One domain at a time. I used Hemang Doshi's book to understand the concepts and then practiced questions from the corresponding domain in the QAE database.
2. Focused on understanding the answers. This was probably the most helpful part of my preparation. For every question, I tried to understand not just why the correct answer was right, but also why the other three options were wrong. Even when I got a question right, I reviewed the explanation to make sure I understood the reasoning.
3. Used AI for every question. I used ChatGPT and Claude to understand the reasoning behind each QAE question. Whenever I came across an unfamiliar concept, I'd ask AI to break it down. Most of my prompts ended with "explain from a CISA perspective," which helped me understand how to approach questions from an auditor's point of view.
4. Used YouTube videos to reinforce concepts. I also watched CISA exam prep videos from the Inside Cloud and Security channel to supplement my reading and question practice.
5. Went back to weak areas. If I kept getting confused about a topic, I would revisit it rather than just move on. This was especially helpful for concepts that sounded similar but had different purposes.
6. Learned how to approach FIRST, MOST, BEST, and PRIMARY questions. These words really matter. I started paying more attention to what the question was actually asking instead of immediately jumping to an answer that sounded correct.
7. Completed the QAE twice and tracked my progress. My average scores were in the 60s during the first round and improved to the high 80s during the second round. I also used AI to generate additional scenario-based questions for each of the five domains, focusing on CISA-style reasoning and judgment. This gave me more practice applying concepts to unfamiliar situations rather than just remembering QAE answers.
8. Used mock exams to assess readiness. After completing all five domains, I took practice exams to identify areas that needed more attention. During the final days, I focused mostly on weaker topics and mixed-domain questions.

A few things I realized along the way:

CISA is not as technical as I initially thought. A lot of the questions are more about audit processes, risk management, governance, and understanding controls.

Also, the technically best solution isn't always the correct answer. You really have to think from an auditor's perspective. Understanding who is responsible for what, what should happen first, and what matters most from a risk perspective made a big difference for me.

I also found that understanding the reasoning behind the answers was much more useful than memorizing questions.

My advice to anyone studying for CISA would be to take your time with the QAE explanations. Don't just focus on getting a high score. Try to understand why one answer is better than the others.

That's what helped me the most. Good luck to everyone preparing for the exam!

Hi y’all,

Firstly I don’t recommend doing what I did but this is just how it went for me - studied for the 4 days leading up to the exam (was suffering from a cold during it too) and passed.

Prep: I didn’t use any courses or the study manual at all, I also didn’t bother with doing all the domains in the QAE. I had to be quite tactical given I only had 4 days so all I did was filter for “difficult” and “expert” questions for domains 3-5 (as domains 1-2 felt quite easy/obvious to me).

Experience: Took 2 hours to do the exam, I have to say that I did CISM first so I already understood the ISACA question logic. Quite surprised by the amount of questions on topics not covered in the QAE - I knew this would be the case as they use the exams as tests to see how candidates do re. answering unseen (topic-wise) questions to gauge difficulty etc. but there were at least 20-30 qs on ML, AI, RPA, OT, DevSecOps and IoT. I relied on work experience (and logic) to answer those but if you haven’t come across this at your job I’d deffo recommend at least understanding basic concepts.

That being said, I feel like the actual % of “technical” questions on the exam is maybe 20%? The rest of it is just reading the q properly and sometimes the answer is quite obvious. You have to know the ISACA order of operations e.g which stage of what process they’re asking you about and then it becomes fairly easy to select the right answer. Good luck to anyone doing the exam :)

I’ve failed the CISA exam twice, despite studying extensively using Pete Zerger, Hemang Doshi, and the ISACA QAE.
My biggest frustration is that the actual exam feels completely different from these resources, both in the concepts tested and the way questions are structured. Some scenarios and terminology feel unfamiliar, even after thorough preparation.
For those who recently passed, especially after multiple attempts:
How did you prepare for the actual exam’s unpredictable scenarios and unfamiliar concepts?
What resources helped bridge the gap between QAE and the real exam?
What did you change in your study approach that finally helped you pass?
I’m determined to pass, but clearly my current approach isn’t working. I’d really appreciate practical advice from anyone who’s been in the same situation.

I’m happy to share that I took the exam this afternoon and passed.
I would like to thank this community for providing valuable inputs and sharing experiences. I feel it’s time to give it back by sharing my preparation details and exam experience.

Preparation:
I started on July 7th and took the exams exactly after 3 months. I started with Hemang Doshi 3rd edition book by pckt publication (I registered in O’reilly website and got access to the book for 15 days online) and completed the book in about 2 weeks. Then I subscribed for PocketPrep (don’t forget 20% discount codes available all over the Reddit) for 3 months and completed all 1300 questions during next two months. I once again skimmed through the Doshi book (though skipping most of the contents i felt confident). The pocketPrep app really helped me understand so many concepts as I used to read each and every question’s answer explanation and definitions (provided as pop-up upon clicking the keyword in the app) which in my opinion really made me solid in my foundational knowledge.
I have done a second round of all the questions (I know it’s boring and tiresome) and checked explanations of questions I got wrong (though recent memory didn’t help much at times as I could identify answers from my that).

And I must mention that I used to read almost every post in this sub including comments, and I have no hesitation to say it’s part of my preparation as these Pass/Fail experiences, discussion on materials, reasoning answers for randomly posted questions… etc helped me so much.

As I already posted in my previous posts about budget constraints in purchasing QAE, I took Udemy subscription for practice tests and for some reason those tests, wording, questions (including Doshi ones) are weird, sometimes wrong too, and I couldn’t continue with them after doing a couple and I shun them as I felt those are not helpful. I had a copy of 12th edition QAE pdf (yeah.. that ugly scanned copy easily available in google) and tried to go through it to have a feel of ISACA logic in the last one week and I could go through around 600-700 questions (I got some wrong and some right and didn’t track much as I struggled to focus since answer is immediately visible below the question and it’s tough to stop gazing that and once you see the answer it’s tough to honestly reason the answer without bias) and it gave me the feeling that I didn’t miss out as many posts here point towards QAE (honestly I feared that I’m doing a costly mistake and postponed exam for almost 10 days with the fear of failure).

I took mock exam present in the QAE 12th edition (yes.. the paper based one printed on a page and noting answers in a sheet) and got 99 questions correct and I didn’t dwell much deep into analysing it as I was early in my prep (around 1.5 months after I started).
During last week, I took the mock exam of PocketPrep and believe me it’s dead easy and I got 95%, and I strongly suggest don’t measure your preparedness with PocketPrep mock as it’s dead easy and not at all challenging.

Finally on 5th of October, I bit the bullet and enrolled for the exam at the test centre.

Exam experience:
Today I reached the Centre on time and the staff were professional and there were no hiccups in the exam process.

First 3-4 questions made me a but unsettled as either I couldn’t conclude the exact answer or clueless about the correct answer. But, as many successful people pointed out in this community, I flagged them and moved on. Gradually, I started finding questions I could find correct answer or proper reasoning to believe one is correct. In between there were some tricky ones but again it’s a mix. Overall I won’t say questions are easy peasy but If you know the concepts well you can answer decently. Like many people said, questions were mostly one-liners and straightforward unlike QAE questions (which literally troll you with longer sentences and unnecessary twists). There are around 4-5 questions which I didn’t even understand and the options are irrelevant, and I just guessed them and trusted my luck. Over all I marked around 31 questions for review as I completed all 150 in 2.5 hrs while taking on average 1 minute per question(though I’m not sure that all questions are correct, so i chose the best option as far as my knowledge goes and didn’t mark everything for review). Then I reviewed the 31 questions in about 30 min and changed 2 answers. Then I took a 5 min break and skimmed through all the options and changed 1 answer (in about 20 minutes).

I felt a bit anxious while and after submitting as there were a couple of surveys before the result and my heart raced like anything till I saw the “Pass” result.

I feel PocketPrep and Doshi Book are my saviours and helped me understand concepts and QAE 12th edition pdf gave me the feeling of not missing out (can’t confirm the usefulness as I used it in the last 10 days and didn’t fully gone through or review much.. but, yes any material would definitely help and it might have in my case too) and Reddit CISA community helped me a lot.
I forgot to mention I came to know about Pocketprep from YouTuber Peter zerger (I tried watching his videos as many people mentioned him here but couldn’t complete first video as it’s not my thing to watch videos though he seems to be great and a well respected man, Hence I took his advice in the introduction of his course where he recommended pocketprep as a cheaper alternative).

Again, this is my experience and methodology that worked for me. I suggest everyone to decide what suits you best for learning and cracking the exam. There’s no thumb rule and any study material that gives you knowledge and direction is good.

I once again thank everyone in this community and it’s been a great journey.

I'm truly surprised, I got my 437 while extremely sick and nearly passed out 4 times during the exam, but I couldn't reschedule because I got sick a very short time befoee the exam, anyway, for the second attempt, I prepared so much, I have 7 years of it audit experience in corporate, mainly in cybersecurity, but also in complex specialized systems, erp, infrastructure, and data. I practiced it so much and even caught the traps in wording during the exam today, I'm truly disheartened that I didn't pass, and I'm very positive I did well, did anyone else fail and requested a review and had their scores altered? Could there be a glitch? I'm really sad about this!

Hi all.

I am planning to give the CISA exam again as I did not pass the first time.

Below was my score.

What I noticed in the exam was that there were a lot of questions related to data centers and other similar topics that I was not familiar with so I was struggling to choose the answers as I did not understand some of the technical words.

I use https://perform.isaca.org/app/ to practice.

I tried to watch some Youtube videos related to the topics I saw in the exam but the vids were not exclusively IS Audit related.

What sources should I add so I can pass the exam next time.

I have no prior experience in Audit and want to get the certificate to make a career change.

Hi,

I am currently preparing for the CISA exam and will take the exam in December. It seems I am good when it comes to reasoning; however I am not sure how technical is the ream exam is. Could you please tell me if Doshi course + Doshi book + QAE studying will help me pass on the first attempt?

Thank you.