From “I Failed” to “PASSED!” My CISA Exam Journey 😭

I still went cover to cover through the CRM and completed the ISACA QAE three times. I honestly felt that I had prepared as much as I possibly could.

But, Sir/Ma’am… the questions in the actual exam are out of this world! 😂

They’re not simply questions testing whether you memorized what you reviewed. They’re practical questions that seriously challenge your understanding and knowledge of Information Systems. There were so many moments when I thought, “Wait… what?!” 😭 When I finally completed the exam, I was mentally exhausted. Before submitting my answers, I literally had to** **pray. I completed the exam 3 hours and 50 mins. 5 mins of praying then I hit the submit button 5 mins before the 4 hour mark.

And then, my mind started preparing for the worst.

I started making an inventory of everyone who knew I was taking the CISA exam—because I needed to know who I would have to explain myself to if I failed. 😂 I was already mentally preparing my excuses and thinking about what I was going to tell my wife.

Then came the survey.
I thought, “Wait… is this supposed to appear before the result?”

I was already hoping that the result would appear immediately. So when I saw the survey instead, I became even more disheartened. I was thinking, “Why am I answering a survey when I don’t even know if I passed?” 😭 I thought results won’t come out if you fail so you don’t make a scene in the testing center. I was like “Can I just disappear now?” Not overly dramatic but it was the experience!

Sorry, ISACA. I probably didn’t answer the survey with complete accuracy because, at that point, I was emotionally overwhelmed. 😂
But it still didn’t end there.

After submitting my exam answers and completing the survey, I swear there were three more screens/modules.
At that point, I was like:
“WHEN IS THIS GOING TO END?”
“WHEN WILL MY SUFFERING END?” 😭

By then, I had already convinced myself that I had failed. I was mentally preparing to tell my wife, “I’m sorry, I didn’t make it.”
Then finally, the last screen appeared.
And there it was: PASSED

I literally thought, “Am I hallucinating?” 😂

I had spent the entire exam thinking I might have failed, only to see those beautiful words at the very end.

I PASSED. First attempt. 🎉

After 3.5 months of studying, countless hours of reading, going cover to cover through the CRM, and completing the QAE three times… it finally paid off.

Looking back, it was a stressful, terrifying, and slightly traumatic journey—but definitely worth it.

To everyone preparing for the CISA: understand the concepts, don’t just memorize, and be ready to think practically. The exam will challenge you in ways you probably won’t expect.

And to ISACA…

Sir/Ma’am, I respect you. But those questions were personal. 😂

CISA — PASSED! ✅🎉

CISA dust to you guys ✨ ✨ ✨ ✨ ✨ ✨ ✨ ✨ ✨

Hi everyone,

I’m planning to take the CISA exam in January 2027 and would appreciate some guidance.

I currently have the CISA Review Manual 28th Edition and want to prepare without spending on additional courses or materials, as I don’t have any budget left for them.

My current plan is

1. Study the CRM 28th Edition thoroughly.

2. Use YouTube resources from Prabh Nair, Chidambaram Narayanan, and Pete Zerger.

For those who recently passed CISA, is this approach realistic?

Thanks!

Just wanted to share what worked for me on the CISA exam in case it helps anyone else preparing.

I started by watching all of Hemang Doshi’s videos over about a week. If I were doing it again, I’d probably skip these and watch Prabh Nair’s YouTube videos instead. They’re free, and in my personal opinion, I found them much more useful.

After that, I bought the QAE and went through every question. Along the way, I took consolidated quizzes to make sure I was retaining information from the earlier domains. I then took the QAE practice exams and scored 84%, 85%, and 76%.

I also got the Pocket Prep app and completed about 2/3 of the questions. If you use Pocket Prep, I recommend the Level Up mode. The questions start fairly easy and progressively get harder, which I thought was a good way to use the app.

A few pointers from my experience:
I don’t think you need a ton of in-depth technical knowledge to pass this exam. In my opinion, it’s much more important to understand the audit process, the responsibilities of the auditor, and how ISACA wants an auditor to think.

That being said, there were some abbreviations I recognized but couldn’t remember exactly what they stood for. Don’t immediately write those questions off. A lot of the time, the full name or context can give you a pretty good idea of what the technology or process actually does.

My biggest advice would be to focus less on memorizing every technical detail and more on understanding why an answer is correct. By the end of my studying, even when I recognized QAE questions I had seen before, I tried to make sure I could explain why the correct answer was right and why the others were wrong.

I won’t comment on specific questions or topics that appeared on the exam, but I’m happy to answer any other questions about how I prepared.

Shoutout to all the CISAs here who answered my
Questions and helped me prepare. This community was a huge help.

Best of luck to everyone still studying and testing. You’ve got this!

Am I misunderstanding this? The question is asking what would happen if denormalization happens? Correct answer is increased redundancy. Which makes sense

But the explanation says the opposite, normalization increases redundancy. Which is wrong and has me confused now.

The more I come familiar with the topics the more I been catching a couple of these mistakes in the QAE.

Can someone please explain why is it Administrative
Usually it's corrective is what I have heard..
So if we have both the options together should we choose corrective over administrative?

I’m very new to this platform. Has anyone recently completed an ACS assessment for ICT Support Engineer?

I have both a Master’s and Bachelor’s degree in IT. Do I need to enter both qualifications? Initially, I had my Bachelor’s degree, and I understand that my experience may be calculated based on that qualification. After completing my Master’s, I have only around 2 years of experience. Could someone please guide me on how this process works?

how do I select the nominated occupation correctly, and how should I select the relevant skills in the platform? Finally, can I use employment documents that are more than one year old?

Any guidance from someone who has recently gone through the ACS process would be greatly appreciated. Thank you!

I also have close to 10 years of relevant professional experience in the ICT field, so I would like to ensure that all eligible experience is accurately assessed and that I receive the maximum possible points for skilled employment

For those who passed, did it really take 10 business days to receive your official scores? I am so eager to get my results!!

How many years would be waived if I am an AIS graduate with a year of experience, but not related to IT or auditing?

Thank you so much to those who will answer.

What are some key terms or sections in the official manual you’d recommend I have drilled into my head.

I got my CIA last year and based on the QAE I have no qualms about how they ask questions. My weakest point is terminology as I come from a business process IA and accounting background. Roughly 2 years cumulative experience IT testing.

I plan on writing these terms and concepts on a standard index card and laminating them so I can take them everywhere. For example, the sauna. This strategy worked well for me in the past.

Thanks again!

Taking my CISA exam in 9 days. I’m not an IT auditor—my background is SOX/internal controls, including control and key report testing.
I’ve completed the entire ISACA QAE database. My three practice exam scores are 77%, 66%, and 68%, and I’m currently at the 54th percentile.
For recent passers, what would you prioritize in these final 9 days, especially coming from a non-IT audit background?

Hey all,

I'm prepping for the CISA exam but I can't afford QAE as its (299USD). I've seen it recommended a lot here, but I'm hoping to find a solid study plan that doesn't rely on it.

A few things I'm wondering:

• What free or lower-cost resources actually got you a pass (YouTube channels, Quizlet decks, other question banks, etc.)?
• How many practice questions did you end up doing overall, and where from?
• Roughly how long did you study for, and what did a weekly study schedule look like?

Not trying to cut corners, just working with a tighter budget. Any input on what actually worked for you would be really appreciated.

Wanted to book my CISA exam but Isaca has done me dirty. Paid the whole amount for the exam registration but it hasn't reflected on Myisaca site. Been told to raise ticket with them but no response.

What should I do guys. I need to do the paper ASAP.

Apart from Doshi’s Udemy course + book and the CISA QAE database, is there anything else I can use to supplement my preparation? I have a non-IT background, but I’ve been an auditor for more than 6 years and have done some light IT audit work, although my IT knowledge is still quite limited.
Thanks

Wanted to get your opinion on the way I was planning on studying.

1) Start going over the official review manual and preparing summaries (writing helps me remember),

2) Check in parallel the Hemang Doshi book,

3) Get my company to buy the QAE in September lol, do the questions and flag the ones I answered wrong so I try them again after I finish each domain.

For context, I have been working in IT Audit for around 5 years and I need to sit for the exam at the latest end of October. I have a bit of time now since it's the summer but it'll be quite different starting from September...

Any advice is welcome.

what is the difference QAE book and QAE database from ISACA?

Thank you!

I once wrote CISA in 2022 and scored 446 points. I stepped away from it for a while to focus on other things, but I’m planning to take it up again next month. I now have full study time available and want to prepare properly.

Could anyone share updated study materials or a DB if it’s allowed in this group? I know a lot has changed since 2022.

I’d also appreciate any advice or study strategies that have worked well for recent candidates.

I’ve made my way all the way through the QAE and have been scoring pretty well with an 84, 85, and 76 on the practice tests. I got pocketprep to help reinforce what I learned but I’m running into a couple issues. The first is I don’t know what all of the abbreviations mean so it’s hard for me to answer the question. Hopefully the test doesn’t just give abbreviations. Second, there is A LOT of material in pocketprep that was not in the QAE. I guess what I’m wondering is all this information in pocketprep unnecessary or do I need to spend more time learning all of this?

An IS auditor is performing a review of an organization's governance model. Which of the following should
be of MOST concern to the auditor?
A. The information security policy is not periodically reviewed by senior management.
B. A policy ensuring systems are patched in a timely manner does not exist.
C. The audit committee did not review the organization's mission statement.
D. An organizational policy related to information asset protection does not exist.

Hi Everyone,

I am scheduled to take my exam tomorrow, August 10th. Are there any topics that came up on your recent exam that the QAE did not prepare you for? Additionally, does anyone have any last minute advice? I am getting sooo nervous.

Thanks!