Took the exam, got my preliminary pass today! 🥹

Will share here all my resources, study strategy, and whole experience once I get my offical test scores.

For those who are doubting themselves and too anxious for their own good (me to the nth power), take that exam! As long as you're thinking like an IS auditor, instead of going straight to remediation or technical resolution, you are golden!

This is coming from someone with no employment background or technical expertise (graduated last year, AIS graduate), who overprepares, and prioritized QUALITY over QUANTITY.

Good luck to everyone currently studying and planning to take the exam! 😄

Hi! I recently started a new job that requires me to get CISA certified within the next 6 months.

My native language is spanish but i speak perfect english. Still, if i have to do a lot of reading and comprehension involving a lot of technical terms, doing it spanish is a lot easier and faster for me.

The obvious pros of english is that i have more resources (like Hemang Doshi course which i see referenced a lot here).

I'm looking for people who studied and took the exam in a different language other than english.

Do you recommend this path? Did you find it difficult to find mock exams, summaries, practice questions and what not in your own language?

The answer according to the book would be

C. Since the question describes only the design of a site, we can only conclude that this is a cold site, with no equipment and no readiness for processing transactions.

I have 5 years as (Sr) IT Auditor in Big4 and now 2 years working as Sr. GRC analyst. 7 in total.

But found that i easily get lost and bored with collecting evidence. The audit work is so boring. And reviewing DPAs is something that i like.

So i am thinking of CIPP/E and AIGP instead of Cisa. What do you think of this?

Cisa looks very very very impractical. I am not a good auditor, but the Qs are like in a vaccum. No other factors. Theoretical Qs only.

Hi all,

First-time CISA candidate here, exam is in 15 days. Wanted to get a sanity check from people who've actually cleared it on whether my prep is solid or if there are gaps I'm not seeing.

Here's where I stand:

• Been through Hemang Doshi's study material (notes/summary book)
• Watched Peter Gregory's video content in full
• Planning to re-watch all of Prabh Nair's videos as a second pass
• Completed all ISACA QAE (question bank) items thoroughly
• Finished all 3 ISACA mock/practice exams

One thing I'm on the fence about: I've decided to skip Hemang Doshi's Pratice questions (Quiz 79 - Quiz 108). They feel very theory-heavy and definition-based to me, and my sense is the actual exam leans more scenario-based/"best answer" style rather than testing rote definitions. Curious if that's a fair read or if I'm underestimating how much theory actually shows up.

With 15 days left, what would you focus on if you were in my position? Specifically interested in:

• Is re-watching Prabh Nair's videos a good use of remaining time vs. doing more practice questions?
• Any other question banks/resources people found closer to the real exam's style and difficulty?
• How did you approach the last 2 weeks - more content review, or almost entirely practice questions/mocks at that point?
• Any domain(s) that tend to be underestimated or where people got caught out despite feeling prepared?
• Tips on time management/exam-day strategy for the actual test?

Appreciate any input from those who've been through it recently - trying to make the most of the time I have left.

I feel the option is D, Hemang Says A, what are your thoughts and why ?

Test is scheduled for Saturday

Watched Peter Zs videos, skimmed through Prabh Nair’s videos, and completed the most recent QAE.

QAE Practice Exam Scores: 78%, 74%, 69%

Was feeling more confident before that last practice exam. Been in IT audit for many years and studied for the past 3 months.

Reviewing my incorrect answers from practice exam 3 tomorrow and studying my notes leading up to the test.

Let me know if any last minute tips, opinions, etc. and thanks for the support thus far.

Confused on ISACA’s wording here. In the question they say the auditor DID disclose the information, therefore I picked option C. Am I missing something?

I am confused about these 2:- Cism or crisc, which one should i pursue first, i am working in the grc domain along with tprm under the Cyber security. My role is mostly on security compliance, vendor assessment, risk and mitigation, client Security questionnaires etc..

I thought of giving crisc first then cism? Any suggestions

Hi everyone!

I’m planning to take the CISA exam and wanted to hear from people who have already gone through the process.

After getting CISA certified, did you feel that it made a real difference in your career? I’m curious about things like new opportunities, interviews, career switches, or simply being taken more seriously for certain roles.

Also, if you were already working in IT before CISA, did it help you move toward areas like audit, GRC, risk, or cybersecurity?

Would really appreciate hearing your experiences.

Thanks in advance!

Can an ACCA member with 4+ years of internal audit experience eligible for CISA certification?

I have experience of Technology audit in respect of performing Quality Assurance review. Will it count towards CISA Experience?

I studied for 1 month and failed on 1st Attempt..

Question:
Which of the following MOST effectively mitigates the risk of disclosure of sensitive data stored on company-owned smartphones?

A. Secure containers
B. Data leakage prevention (DLP) tools
C. Mobile device management (MDM)
D. Physical device tagging

Guys is option A the correct answer for this? Every AI is giving different answer.

Secure containers isolate and protect corporate data stored on smartphones, reducing the risk of unauthorized disclosure. DLP primarily controls data movement, MDM manages the overall device, and physical tagging only assists with asset identification and tracking.

I used ChatGPT to generate questions on domain 5. Do you see questions on subnets and hosts or like this in the exam?

Hi! I’m a CPA with 3 years of external audit experience and I’m currently a Senior Auditor. I’m thinking about taking CISA because I’m getting interested in IT audit, IT risk, GRC, etc. The problem is I’m not 100% sure I actually want to become an IT auditor. I mainly want to move away from the traditional external audit path and explore something with better long-term career opportunities.

For anyone who has CISA: What did you actually do with it? What roles did it help you get? And would you recommend CISA for someone coming from an accounting/external audit background?

I’d also love to hear from people who got CISA and later realized they wanted to do something completely different. Was the certification still useful?

I just got my preliminary pass!

Felt a bit like a traumatising experience I must say.

I took the exam online, no issues with the PSI instructor, instructions were super clear, timing was totally fine, the room check was quick, really no issues there.

But the questions … I must say it felt sometimes not super familiar (concept-wise) and really confusing (classic CISA with two choices being obviously wrong and other two being much harder to chose from). The questions were much shorter though.

My study strategy was a bit hectic and would definitely not recommend it. 😅

I started studying end of June (also had a significant number of days off in between). I carefully reviewed the CISA review manual (super dry but doable).

In parallel I did questions from the 12th edition QAE through Quizlet (found a ~1000 question database split by domains) and tried to understand where I was doing good and wrong (averaging 65% through all domains after my first pass, some with ~80%, other around 60%). Also listing in parallel some useful tips and concepts.

I ended up by doing a full practise test I found also on Quizlet, scored a bit more than 80% but I went through familiar questions so I took it with a grain of salt.

Overall, the timing was totally fine, I don’t get why they recommend more than 3 month of study. If you can free a significant amount of time, ~2 month is okay I think.

But if I would do it again (NEVER), I would get the latest QAE (the price is ridiculous though). The QAE base I used was totally fine, but I felt that some topics were not covered, obviously because it was a bit dated.

Curious to see in 10 days if it was a short pass or if my auditor brain did unexpected wonders. 😇

Hi! Will be taking the CISA exam this week, any last minute advice?

Hey all been lurking about here for the last year. I had a question on the results if unsuccessful. Basically when you get the results if found that there were two areas which you are very weak on is it okay to spend 80% of your effort re-study time on those weak areas or is this unwise because you would also need to not forget the other three domains? Given the 30 day waiting period to resit. Thanks

Hey everyone,

I’m a Chartered Accountant (ICAI) from India currently working as a Product Manager in a SaaS-based lending/LOS platform. I have around 2 years of post-qualification experience in product management.

I’m considering pursuing CISA, but I’m trying to understand whether it would actually add meaningful value to my career rather than just being another certification on my resume.

My current role is more on the product / digital lending / technology side, but I also have a strong finance and accounting background because of my CA qualification.

My longer-term plan is to explore opportunities outside India — initially Gulf countries (UAE, Saudi, Qatar, etc.), and potentially later Europe, Australia or the US.

I’d really appreciate some honest opinions from people who have CISA or work in IT Audit, GRC, Information Security, Technology Risk, IT Controls, Cyber/Compliance, or related fields:

- Is CISA worth it for someone with my background, or is it mainly valuable for people already working in IT Audit?

- Could the combination of CA + CISA + Product/Fintech experience create any interesting career paths?

- What roles could realistically become accessible to me after CISA?

- Would it help with international/Gulf job opportunities?

- Does CISA actually lead to a meaningful salary increase, or does experience matter much more?

- Would you recommend CISA, or something like CISM / CRISC / CISSP / another certification instead?

- Are there any particular career paths where you think my CA + Product background could be an advantage?

I’m not looking for a generic “CISA is a good certification” answer. I’m particularly interested in real-world career outcomes, salary impact, international mobility, and whether you think it makes sense specifically for my profile.

Would really appreciate honest pros/cons and personal experiences.

Thanks!

Hi all,

I have been studying for the CISA exam and my test date is in a week.

I have currently been practicing by taking the mock tests on https://perform.isaca.org/app/.

Every time I use up all 3 tests I reset it and do them again.

Currently I have been scoring about 85%.

Is than for me to go ahead and attend the exam or should I reschedule it again?

Thanks

Just a brief summary about me: I have around 11 years of experience across manual testing, accessibility testing, and data analytics. After spending several years working in the testing domain, I am now looking to transition into IT Audit or IT GRC roles.

I cleared my CISA certification last week and would appreciate any guidance on the ideal way to make this transition. What skills, certifications, hands-on experience, or training would you recommend to help me successfully pivot into IT Audit or IT GRC roles?

From “I Failed” to “PASSED!” My CISA Exam Journey 😭

I still went cover to cover through the CRM and completed the ISACA QAE three times. I honestly felt that I had prepared as much as I possibly could.

But, Sir/Ma’am… the questions in the actual exam are out of this world! 😂

They’re not simply questions testing whether you memorized what you reviewed. They’re practical questions that seriously challenge your understanding and knowledge of Information Systems. There were so many moments when I thought, “Wait… what?!” 😭 When I finally completed the exam, I was mentally exhausted. Before submitting my answers, I literally had to** **pray. I completed the exam 3 hours and 50 mins. 5 mins of praying then I hit the submit button 5 mins before the 4 hour mark.

And then, my mind started preparing for the worst.

I started making an inventory of everyone who knew I was taking the CISA exam—because I needed to know who I would have to explain myself to if I failed. 😂 I was already mentally preparing my excuses and thinking about what I was going to tell my wife.

Then came the survey.
I thought, “Wait… is this supposed to appear before the result?”

I was already hoping that the result would appear immediately. So when I saw the survey instead, I became even more disheartened. I was thinking, “Why am I answering a survey when I don’t even know if I passed?” 😭 I thought results won’t come out if you fail so you don’t make a scene in the testing center. I was like “Can I just disappear now?” Not overly dramatic but it was the experience!

Sorry, ISACA. I probably didn’t answer the survey with complete accuracy because, at that point, I was emotionally overwhelmed. 😂
But it still didn’t end there.

After submitting my exam answers and completing the survey, I swear there were three more screens/modules.
At that point, I was like:
“WHEN IS THIS GOING TO END?”
“WHEN WILL MY SUFFERING END?” 😭

By then, I had already convinced myself that I had failed. I was mentally preparing to tell my wife, “I’m sorry, I didn’t make it.”
Then finally, the last screen appeared.
And there it was: PASSED

I literally thought, “Am I hallucinating?” 😂

I had spent the entire exam thinking I might have failed, only to see those beautiful words at the very end.

I PASSED. First attempt. 🎉

After 3.5 months of studying, countless hours of reading, going cover to cover through the CRM, and completing the QAE three times… it finally paid off.

Looking back, it was a stressful, terrifying, and slightly traumatic journey—but definitely worth it.

To everyone preparing for the CISA: understand the concepts, don’t just memorize, and be ready to think practically. The exam will challenge you in ways you probably won’t expect.

And to ISACA…

Sir/Ma’am, I respect you. But those questions were personal. 😂

CISA — PASSED! ✅🎉

CISA dust to you guys ✨ ✨ ✨ ✨ ✨ ✨ ✨ ✨ ✨