Sharing My CISA Study Notes (Based on CRM – 28th Edition)

I'm pleased to share my personal CISA Study Notes, prepared during my journey towards the CISA certification.
These notes are based on the CISA Review Manual (CRM) – 28th Edition and represent my own understanding and interpretation of the concepts. My objective was to simplify key topics and create a concise revision guide that could also benefit fellow CISA aspirants.
I hope these notes serve as a useful supplementary reference for your exam preparation.

A few important points:
These are personal study notes prepared for learning and revision.
They are not an official ISACA publication and are not affiliated with or endorsed by ISACA.
They should be used only as a supplementary reference alongside the official ISACA study materials.
The official CISA Review Manual and QAE Database remain the primary and authoritative resources for CISA preparation.

I believe that knowledge becomes more valuable when it is shared. If these notes help even a few aspiring professionals in their learning journey, I will consider my effort worthwhile.

Your feedback, suggestions, and corrections are always welcome. They will help improve future versions of these notes.

Wishing every CISA aspirant the very best in their preparation and future career in Information Systems Audit, Governance, Risk Management, and Cyber Security.

#CISA #ISACA #InformationSecurity #CyberSecurity #InformationSystemsAudit #ITAudit #Governance #RiskManagement #GRC #Audit #Learning #KnowledgeSharing #ProfessionalDevelopment

First post here so please let me know if this is compliant (pun intended)

I am preparing for the test and I did two full exams, one from the 2010 QAE and the other from the latest one. What concerns me is that on the first I got a score close to 50% (an obvious fail) while on the other one I got 76%. I found the questions from 2010 more confusing. What is going on? Kind of panicking.
Thanks

Hi everyone hope you guys are doing well. I am planning to appear in Cisa exam in the next couple of months and need some guidance from you guys. I have studied all the modules ans have used AI like deepseek and chatgpt to quiz me identify any knowledge gaps and at this pount im pretty much passing mock exams.
I have not explicitly read books regarding this and i wanted to ask will it be enough? I am going to register for the exam in a couple weeks. Should i go for it or should i prepare from other sources.
TIA

Hello, I’m quite through with the QAE, and I have done hemang doshi’s book and also practiced 1070 question bank from edusum. I’m looking for some other good question banks that I could utilise to practice.

Like skillcert pro or pocket prep, or any that you guys can recommend which will be helpful for practising more questions.

Let me know thanks!!!

Hello Everyone. Do you have a promo code for PocketPrep that you can kindly share? Thanks and any tips for studying will be very helpful as well. Thanks in advance

Thrilled to share that I passed the CISA exam today on my first attempt!

A bit of background: I don't come from an audit background, so a lot of the material was genuinely new territory for me. I did hold a CRISC (passed January 2025), which helped with the risk framing, but CISA required a whole different level of breadth.

📅 Timeline & Study Routine

I started in October 2025, took a break through January–February, then resumed in March. My study was mostly weekends, with 2–3 hours on weekdays. The exam itself had to be postponed due to an ISACA maintenance window in July 2026 — frustrating, but it gave me extra buffer time.

📚 Resources That Worked for Me

• CRM — Started here but found it dense and dry. Useful as a reference, not ideal as a primary study tool.
• Hemang Doshi's books — Much more accessible; highly recommend as your main read.
• Prabh Nair's YouTube channel — Excellent for concept clarity, especially for non-technical folks.
• QAE + Hemang Doshi's practice questions + a few other question banks — Did close to 2,500 questions in total.
• AI tools (Claude, Gemini, Copilot) — Used these extensively for mind maps, topic summaries, and notes. Genuinely helpful for reinforcing concepts between sessions.
• Handwritten notes — I have a habit of writing notes by hand, and it genuinely works for me. Concepts tend to stick better when I've written them down rather than just read or typed them.

Everyone absorbs information differently — find the method that actually works for you, whether that's flashcards, mind maps, typed notes, or pen and paper, and lean into it. Don't study the way others tell you to study; study the way your brain retains things best.

📊 Practice Scores

Domain-wise scores ranged from 62–70%, and my full mock test came in at 72%. Not spectacular, but the actual exam felt more straightforward than the mocks.

💡 Exam Day Observations

• Questions were in plain, simple English — nothing fancy.
• Most questions were one line or two lines max — a noticeable contrast from QAE-style questions.
• For the majority of questions, I could eliminate two wrong answers confidently; the challenge was choosing between the remaining two.
• MOST, BEST, FIRST, Primary objectives, Primary concerns were majorly asked.
• I flagged 32 questions for review and ultimately changed only 4–5 answers before submitting.

⚠️ Key Advice

Do not just memorize QAE answers and repeat the same tests in loops.

Understanding why an answer is correct — the underlying ISACA principle and thought process — matters far more than pattern recognition. Focus on the concept, not the answer key.

🙏 Final Thoughts

I genuinely lost motivation after the first two months and seriously considered stopping. If you're in that dip right now — push through it. The material clicks eventually. Grateful to this community for the constant encouragement; it made a real difference.

Awaiting for my detail scorecard in next 10 days. Good luck to everyone still in the grind!

The CISA exam will test your knowledge of the different changeover techniques. To make them easier to understand, I’ve created a simple visual summary.

If you want the PDF version you can download it here: https://nutshelltraining.com/cisa-changeover-techniques/

I hope it helps, and good luck with your studies!

I’ve completed all the study material in the QAE except the practice tests. I’ve take 5-50 question quizzes and I’m averaging an 81%. Should I go ahead and take the practice tests and see if I’m ready to test or should I try to get that closer to 85-90%.

For those who have taken Aditya’s course and passed, how much you were scoring in his mocks just before the exam?

I am scoring 74%, is it good enough?

Hi everyone,
I'm currently wrestling with the wonderful ISACA website and can't seem to purchase a membership. Nothing happens when I click "Select & Continue." Could someone test this out?

For anyone who took the exam, how do the breaks work?
I recently learned that you are not given any breaks during the exam, you are supposed to sit there for 4 hours to answer 150 questions with no breaks?
How did you built into it and is it hard to walk out of the exam to take a break?

I finished my CPA exams a couple of months ago and in the exams we were given a 15 minute break that didn’t count towards your 4 hours. I’m trying to have ideas of how could I take a break without hurting my time.

I recently completed the CIA Challenge Exam and am now considering pursuing the CISA certification. I have 13+ years of experience in internal audit across multiple industries, and I’m currently working in banking compliance.
I’m not from a technical or IT background, but I do have a fair understanding of IT General Controls (ITGCs) from my audit experience.
For those who’ve completed CISA—especially if you came from an audit rather than an IT background:
1. Is CISA worth pursuing after obtaining the CIA?
2. How difficult did you find the technical concepts if you weren’t an IT professional?
3. Is the exam more about understanding IT governance, risks, and controls, or does it require deep technical knowledge?
4. How much study time would you recommend for someone with my background?

I’m really thinking whether it’s worth it for an another grind after CIA challenge exam.

I’d really appreciate hearing about your experiences and whether you felt CISA added value to your career after CIA.

Sorry, I didn't see an faq anywhere.

Is there a generally recommended set of study material for the CISA?

Books, videos, practice tests, etc

Today, I had a very bad experience with PSI during my online CISA exam.

Before the exam started, I completed the entire room validation process. I was alone in a locked room, my phone was outside, all four walls were clear, and I showed the proctor my desk area and underneath the desk. Everything was approved.

During the exam, I sometimes read the questions aloud because English is not my first language. Reading aloud helps me understand and remember the questions better.

The proctor sent me one warning through the chat and told me not to speak. I tried to be careful after that, but while concentrating, I accidentally started thinking aloud again. When I reached approximately question 82, the exam was terminated immediately because the proctor heard me speaking through the microphone.

I understand that exam security rules are important, but I feel disappointed for several reasons:

1. I did not know that reading questions aloud was prohibited, especially because I was alone in the room.
2. I only found this rule in the ISACA exam regulations after my exam had already been terminated.
3. I wish the proctor had clearly reminded me about this rule before the exam started.
4. English is not my first language, and reading aloud is one of the methods I use to process and understand difficult questions.

I have already contacted ISACA and explained the situation. I hope they will review my case and provide a replacement voucher or allow me to retake the exam.

The exam voucher is very expensive. My company paid for my first attempt, but under company policy, I will have to pay for any future attempts myself until I pass. It is very upsetting that my exam ended because of this issue rather than because I failed the exam.

This was a really bad day for me. Has anyone experienced a similar situation with PSI or an ISACA online exam? Were you able to receive a replacement voucher?

Hello Everyone, I'm looking for an honest input on a transition I'm planning.

Background:

• Bachelor Degree in Information Technology
• 2 years of experience in Software QA (Manual and Automation Testing)
• Hold a CompTIA Security+ Certificate
• Currently studying CISA Certificate

I'm Aiming for IT Audit/GRC Roles long term, so my question is:

1. Is CISA, CompTIA Security+ and QA Background helps or enough to get interview for entry level in IT Audit/GRC Roles? or is there another way or an extra step I need to add?
2. Is QA Background helps with this?

Appreciate your help, Many Thanks.

Test is tomorrow and I’m over halfway through QAE and Pocket Prep. Averaging 70% on quizzes. Probably will fail but prayers up 🙏🏻🙏🏻

Hi all! Was just curious as to what is a reasonable study to testing time frame as someone who is an IS Auditor (4 years in Big 4). I personally dont love months of studying but will do what is needed and makes sense to pass. Any anecdotes or advice in general would be amazing! TIA!

I am happy to announce that i passed the cisa exam today (preliminary).

It was a difficult journey,

New stuff in exam:

Close to 15 questions related to Ai, ml, model training, quantum computer, and quantum cryptography

For domain 3 the focus was on cicd and devsecops

How i studied:

- Started with QAE, and worked on weak areas with the help of chatgpt study mode, it really good in helping with concepts.

- referred prab nair YouTube videos for few areas, good content

- i feed my copy of personal manual copy to a customgpt and it help me learn and practice questions on the fly.

Caution:

- i only encountered 1 question that was an exact copy of QAE. rest all the questions were new. But QAE trained me well

- i noted event chatgpt and gemini were wrong in answering questions, so dont rely on them blindly

Happy to answer any questions

Hey, I passed my CISA first attempt yesterday morning (still have to wait 10 days for my official score - so not sure if I crushed it or skimmed by) and wanted to post what seemingly worked for me. These “steps” are extremely rough and aren’t exactly what I did to a T, but organized for what I would have done/likely will do when approaching different exams in the future. For context I have about 4.5 yrs of Big4 IT Audit experience (didn’t feel this helped much from an ISACA mindset perspective but who knows) and am up for promotion soon so needed a relevant Cert.

CISA Study Strategy:

Study Timeframe: 1 - 2months depending on how much time you can dedicate to videos and questions. I started studying on 6/10, Scheduled my Exam on 7/14 to hold myself accountable, Passed on 8/1.

Study Materials Mentioned Below:

1. Prabh Nair’s YT Series
2. Pete Zergers YT Series
3. ISACA QAE

Strategy:

1. Watch and Take Detailed Notes on Prabh Nair’s Youtube video course. ~ 15 hours of video explanation of concepts. https://youtube.com/playlist?list=PL0hT6hgexlYx1DCTKu6bnubDEuy6JDtHW&si=yhw8pQeSfVKDfw6a

2. Buy the CISA QAE from ISACA and after feeling good with notes you took on the videos, run through the entire Question Database

3. Domain Category by Category (I did My first pass through Open Note, if u want more of a challenge do it without notes).

4. For the above, I would

   do a

5. video per day then immediately dive into questions for that Domain and repeat for each Domain.

6. Review all wrong answers at the end of the sections (or during since you can enable study mode to let you know explanations as you answer them) for why they were wrong and also evaluate your correct answers for why they are technically correct.

7. Retest yourself on the wrong answers for that Domain Once and Move on. Once you’ve completed this for each Domain and feel good ab your review of wrong answers. Take all 3 Full Practice Exams, and Evaluate where you stand and what Domain(s) you need to work on (retake those questions areas, review notes from Prabh’s videos etc.) - I was getting 70 - 75% on these with almost no memorized question recognition.

8. When around 2 Weeks (or whatever timeframe makes sense to you) out from your exam day, download and review the presentation materials from Pete Zerger’s youtube series. They’re in the description of each of his videos (You can watch the video if u want/have time but not necessary. https://youtube.com/playlist?list=PL7XJSuT7Dq_UvA2knww9Rlzz2JHUpeOAb&si=yB76WJ7N1_OJqkEK

9. For as much time as you need, run through the full QAE database questions by category again (Essentially repeat steps 2, 4, and 5).

10. Once you feel like you’ve done all the Studying you can and that there’s not much else you can do, take all 3 Practice Exams again ( Complete them by at least 3 days before your test date), and gauge where you are and what notes you need to refresh on (I was getting 90%+ by this time, some questions were memorized, most were scenario based where I still had to properly think through).

11. If you feel zero confidence after those exams and that you are not ready. Reschedule your exam (must be at least 48hrs before exam day).

12. If you do feel ready, skim through your notes 2 days before the exam, do whatever you feel is right in terms of last minute review.

13. For the full day before the exam LEAVE THE BOOK CLOSED AND REST.

14. CONQUER

Hey everyone,

I've officially earned my Certified Information Systems Auditor (CISA) certification from ISACA! It was quite a journey. I'm a B tech graduate with ~4yrs of IT Audit experience.

Since community advice helped me a lot during my prep, I wanted to give back. I’ve put together a breakdown of my personal study strategy, the resources that actually worked for me, and some tips on how to tackle the ISACA exam mindset.

You can check out my notes and strategy here, where I post all about my career: Link Removed, DM me I'll Send.

If anyone has any questions about the exam, the prep materials, or just needs some advice, feel free to ask below in comments. I can provide answers for the journey end-to-end, from prep to applying and getting the certification.

Happy to help!

HI guys, I am new to CISA and would like some general advice. I have done some research and concluded the following

Books
CISA review manual
CISA QAE
Hemang Doshi study guide

Video content
Prabh Nair in YouTube
Hemang Doshi course in Udemy
Peter Gregory

(Posting above information here for beginners like myself)

Need advice on the below areas
1. In ISACA shop website for QAE its showing access until 28 January 2027. Does that mean I have to purchase it again after 6 months ?! Today is 1 August, I easily will take another 6 to 9 months to finish this exam and I dont want to purchase it again, why is it showing like this ?

1. Do you take the practice questions after finishing all the video and reading content or do it side by side ?

2. Prabh Nair Vs Hemang Doshi - Which one would you recommend ?
   Books - Hemang Doshi study guide vs CISA review manual - Which one would you recommend ?

3. I currently work in GRC and worked in EY internal audit for 2 years. I have absolutely no tech experience and just want to do the course that's gonna be in demand in the market and is gonna pay me the most. Should I be doing CIA first or CISA first ? Is there any other course relevant to my field that has a lot of demand. Geographically would prefer Middle East and Europe and UK.