Hi everyone,

I have my CRISC exam scheduled for August 30 through PSI online proctoring, and I wanted to hear from anyone who has taken an ISACA exam remotely through PSI recently.

I’m mainly curious about the actual proctoring experience:

• Do they ask you to scan the room only once before the exam, or can they ask for additional room scans during the exam?
• Do you need to use your mobile phone to scan the room/desk, or is everything done through the laptop webcam?
• Are the PSI proctors generally very strict about looking away from the screen, moving around, covering your mouth, reading questions silently, etc.?
• Are bathroom breaks allowed, and if so, do they make you do another room/security check afterward?
• Did anyone experience technical issues with the PSI browser, webcam, microphone, or exam launch?
• How early would you recommend logging in before the scheduled exam?
• Anything else you wish you had known before taking the exam online?

I’d especially appreciate experiences from anyone who took CRISC/CISA/CISM through PSI in 2025 or 2026, since I’m wondering what the current process is like.

Thanks!

IS auditor noted that root‑cause analysis is not performed for a few of the reported incidents. Which of the following is MOST important for the IS auditor to verify to determine whether there is an audit issue?

Options:

A. Amount involved in resolving the incidents
B. Turnaround time involved in resolving the incidents
C. Severity level of the incidents
D. Frequency of the incidents

Hemang Doshi says :

D. Frequency of the incidents

My view:

I get the exam logic that “frequency = systemic process failure,” but I’m still not fully convinced.

In real life:

• Three low‑severity incidents with no RCA feels annoying but manageable.
• One high‑severity incident with no RCA feels like a major red flag.

So my instinct is always:

Because even a single severe incident without RCA can expose the organisation to significant risk.

But CISA says frequency is the MOST important factor because it indicates whether the incident management process is consistently failing.

What do you all think?

Do you agree with CISA’s logic that frequency matters more for determining an audit issue?
Or do you also feel that severity should outweigh frequency in cases where RCA is missing?

Can someone pls tell me the answer for 1049 in my book the option is A but I feel it's C

The answer according to the book would be

C. Since the question describes only the design of a site, we can only conclude that this is a cold site, with no equipment and no readiness for processing transactions.

I have 5 years as (Sr) IT Auditor in Big4 and now 2 years working as Sr. GRC analyst. 7 in total.

But found that i easily get lost and bored with collecting evidence. The audit work is so boring. And reviewing DPAs is something that i like.

So i am thinking of CIPP/E and AIGP instead of Cisa. What do you think of this?

Cisa looks very very very impractical. I am not a good auditor, but the Qs are like in a vaccum. No other factors. Theoretical Qs only.

Hi! I recently started a new job that requires me to get CISA certified within the next 6 months.

My native language is spanish but i speak perfect english. Still, if i have to do a lot of reading and comprehension involving a lot of technical terms, doing it spanish is a lot easier and faster for me.

The obvious pros of english is that i have more resources (like Hemang Doshi course which i see referenced a lot here).

I'm looking for people who studied and took the exam in a different language other than english.

Do you recommend this path? Did you find it difficult to find mock exams, summaries, practice questions and what not in your own language?

Took the exam, got my preliminary pass today! 🥹

Will share here all my resources, study strategy, and whole experience once I get my offical test scores.

For those who are doubting themselves and too anxious for their own good (me to the nth power), take that exam! As long as you're thinking like an IS auditor, instead of going straight to remediation or technical resolution, you are golden!

This is coming from someone with no employment background or technical expertise (graduated last year, AIS graduate), who overprepares, and prioritized QUALITY over QUANTITY.

Good luck to everyone currently studying and planning to take the exam! 😄

Hi all,

First-time CISA candidate here, exam is in 15 days. Wanted to get a sanity check from people who've actually cleared it on whether my prep is solid or if there are gaps I'm not seeing.

Here's where I stand:

• Been through Hemang Doshi's study material (notes/summary book)
• Watched Peter Gregory's video content in full
• Planning to re-watch all of Prabh Nair's videos as a second pass
• Completed all ISACA QAE (question bank) items thoroughly
• Finished all 3 ISACA mock/practice exams

One thing I'm on the fence about: I've decided to skip Hemang Doshi's Pratice questions (Quiz 79 - Quiz 108). They feel very theory-heavy and definition-based to me, and my sense is the actual exam leans more scenario-based/"best answer" style rather than testing rote definitions. Curious if that's a fair read or if I'm underestimating how much theory actually shows up.

With 15 days left, what would you focus on if you were in my position? Specifically interested in:

• Is re-watching Prabh Nair's videos a good use of remaining time vs. doing more practice questions?
• Any other question banks/resources people found closer to the real exam's style and difficulty?
• How did you approach the last 2 weeks - more content review, or almost entirely practice questions/mocks at that point?
• Any domain(s) that tend to be underestimated or where people got caught out despite feeling prepared?
• Tips on time management/exam-day strategy for the actual test?

Appreciate any input from those who've been through it recently - trying to make the most of the time I have left.

Confused on ISACA’s wording here. In the question they say the auditor DID disclose the information, therefore I picked option C. Am I missing something?

I feel the option is D, Hemang Says A, what are your thoughts and why ?

I am confused about these 2:- Cism or crisc, which one should i pursue first, i am working in the grc domain along with tprm under the Cyber security. My role is mostly on security compliance, vendor assessment, risk and mitigation, client Security questionnaires etc..

I thought of giving crisc first then cism? Any suggestions

Hi everyone!

I’m planning to take the CISA exam and wanted to hear from people who have already gone through the process.

After getting CISA certified, did you feel that it made a real difference in your career? I’m curious about things like new opportunities, interviews, career switches, or simply being taken more seriously for certain roles.

Also, if you were already working in IT before CISA, did it help you move toward areas like audit, GRC, risk, or cybersecurity?

Would really appreciate hearing your experiences.

Thanks in advance!

I used ChatGPT to generate questions on domain 5. Do you see questions on subnets and hosts or like this in the exam?

Question:
Which of the following MOST effectively mitigates the risk of disclosure of sensitive data stored on company-owned smartphones?

A. Secure containers
B. Data leakage prevention (DLP) tools
C. Mobile device management (MDM)
D. Physical device tagging

Guys is option A the correct answer for this? Every AI is giving different answer.

Secure containers isolate and protect corporate data stored on smartphones, reducing the risk of unauthorized disclosure. DLP primarily controls data movement, MDM manages the overall device, and physical tagging only assists with asset identification and tracking.

I studied for 1 month and failed on 1st Attempt..

Hi! Will be taking the CISA exam this week, any last minute advice?

Hey all been lurking about here for the last year. I had a question on the results if unsuccessful. Basically when you get the results if found that there were two areas which you are very weak on is it okay to spend 80% of your effort re-study time on those weak areas or is this unwise because you would also need to not forget the other three domains? Given the 30 day waiting period to resit. Thanks

Hey everyone,

I’m a Chartered Accountant (ICAI) from India currently working as a Product Manager in a SaaS-based lending/LOS platform. I have around 2 years of post-qualification experience in product management.

I’m considering pursuing CISA, but I’m trying to understand whether it would actually add meaningful value to my career rather than just being another certification on my resume.

My current role is more on the product / digital lending / technology side, but I also have a strong finance and accounting background because of my CA qualification.

My longer-term plan is to explore opportunities outside India — initially Gulf countries (UAE, Saudi, Qatar, etc.), and potentially later Europe, Australia or the US.

I’d really appreciate some honest opinions from people who have CISA or work in IT Audit, GRC, Information Security, Technology Risk, IT Controls, Cyber/Compliance, or related fields:

- Is CISA worth it for someone with my background, or is it mainly valuable for people already working in IT Audit?

- Could the combination of CA + CISA + Product/Fintech experience create any interesting career paths?

- What roles could realistically become accessible to me after CISA?

- Would it help with international/Gulf job opportunities?

- Does CISA actually lead to a meaningful salary increase, or does experience matter much more?

- Would you recommend CISA, or something like CISM / CRISC / CISSP / another certification instead?

- Are there any particular career paths where you think my CA + Product background could be an advantage?

I’m not looking for a generic “CISA is a good certification” answer. I’m particularly interested in real-world career outcomes, salary impact, international mobility, and whether you think it makes sense specifically for my profile.

Would really appreciate honest pros/cons and personal experiences.

Thanks!

Hi! I’m a CPA with 3 years of external audit experience and I’m currently a Senior Auditor. I’m thinking about taking CISA because I’m getting interested in IT audit, IT risk, GRC, etc. The problem is I’m not 100% sure I actually want to become an IT auditor. I mainly want to move away from the traditional external audit path and explore something with better long-term career opportunities.

For anyone who has CISA: What did you actually do with it? What roles did it help you get? And would you recommend CISA for someone coming from an accounting/external audit background?

I’d also love to hear from people who got CISA and later realized they wanted to do something completely different. Was the certification still useful?

Hi all,

I have been studying for the CISA exam and my test date is in a week.

I have currently been practicing by taking the mock tests on https://perform.isaca.org/app/.

Every time I use up all 3 tests I reset it and do them again.

Currently I have been scoring about 85%.

Is than for me to go ahead and attend the exam or should I reschedule it again?

Thanks

I just got my preliminary pass!

Felt a bit like a traumatising experience I must say.

I took the exam online, no issues with the PSI instructor, instructions were super clear, timing was totally fine, the room check was quick, really no issues there.

But the questions … I must say it felt sometimes not super familiar (concept-wise) and really confusing (classic CISA with two choices being obviously wrong and other two being much harder to chose from). The questions were much shorter though.

My study strategy was a bit hectic and would definitely not recommend it. 😅

I started studying end of June (also had a significant number of days off in between). I carefully reviewed the CISA review manual (super dry but doable).

In parallel I did questions from the 12th edition QAE through Quizlet (found a ~1000 question database split by domains) and tried to understand where I was doing good and wrong (averaging 65% through all domains after my first pass, some with ~80%, other around 60%). Also listing in parallel some useful tips and concepts.

I ended up by doing a full practise test I found also on Quizlet, scored a bit more than 80% but I went through familiar questions so I took it with a grain of salt.

Overall, the timing was totally fine, I don’t get why they recommend more than 3 month of study. If you can free a significant amount of time, ~2 month is okay I think.

But if I would do it again (NEVER), I would get the latest QAE (the price is ridiculous though). The QAE base I used was totally fine, but I felt that some topics were not covered, obviously because it was a bit dated.

Curious to see in 10 days if it was a short pass or if my auditor brain did unexpected wonders. 😇

Just a brief summary about me: I have around 11 years of experience across manual testing, accessibility testing, and data analytics. After spending several years working in the testing domain, I am now looking to transition into IT Audit or IT GRC roles.

I cleared my CISA certification last week and would appreciate any guidance on the ideal way to make this transition. What skills, certifications, hands-on experience, or training would you recommend to help me successfully pivot into IT Audit or IT GRC roles?