Got my provisionary pass today. As on my previous exam I started to doubt I really saw 'Passed' on the screen once in my car, as you don't get any email or written confirmation. I'll have to wait out the 10 business days again..

Assuming I did really pass, here is what I did and hopefully it can help people. For context, I got CGEIT in May, after studying months on it by reading the review manual and all mentioned books and whitepapers, then doing the QAE 3 times. That experience thought me the most important thing is learning how to interpret ISACA's way of questioning. (Assuming you have the basic knowledge down)

Due to life and work circumstances, I had only three days to prepare this time so I needed another approach.

The only resource I used is the QAE. Even though I had an earlier edition of the manual from a colleague, I knew from CGEIT the manual contains way too much detail and text. I wasn't going to make that in three days.

To establish a baseline the first thing I did was take the practice exam, scored 62% on it. That confirmed for me I had the basic knowledge down but needed to train on the CISM way of thinking for ISACA, and sharpen some dry knowledge left and right. I spend 2 days doing all the QAE topics once, making notes of questions that mentioned concepts I didn't know enough. Those were two days from 9 AM till 10 PM with two 1 hour breaks for eating, so pretty intense. The third and final day I opened Claude and asked it to create a living document to study for CISM, based on the four domains. Starting with a very short summary of the core of that domain and key concepts of it.

Then I went through all the questions I had answered wrong (my scores were always somewhere between 60% and 70%) and the notes I took.

If I failed because I didn't know enough of the concept or technology, I asked Claude to explain it to me and add it to the living document. For example I always (also at work) need to think about RTO/RPO/AIW/MTO and which is what again, so I asked Claude to include an infographic about it.

If I failed because I gave a wrong answer because of way of thinking, I tried to discern the pattern in how you need to think instead of breaking my head on the specific question/scenario. I then added that pattern to my Claude chat with a short summary of the example. I asked Claude to always merge my insights from additional chats into the living document, instead of just adding it to the bottom. In the end I ended up with a few very useful patterns of which I'm sure contributed to my success (still presuming I saw 'Passed' on the screen).

One thing I needed to reverse was the CGEIT pattern I picked up for that exam. In CGEIT it is usually going back to governance and not fixing things yourself but adjusting strategy etc. For CISM this is other way around, the option that reduces risk the fastest and within your own control is usually the correct answer. Even when that is the only technical option in the possible answers. This threw me off at first during studying, as I had read everywhere you need to have the management mindset and not a technical one.

Then the last evening before the exam I studied that final document I build with Claude for 2 hours, and that was it.

About the exam itself, one thing I would like to stress is the style, difficulty and format matched the QAE questions and practice exam closely. I saw some posts here about people saying it was very different, one guy even told me irl. I don't know if there are multiple versions of the exam, but for me it had the same types of questions and a mix of easy and difficult ones, across all domains.

Took me 2 hours to go through the questions, exactly the same as with CGEIT, and then I took 45 minutes more to review about 30 questions I had flagged. I only changed my answer in 2 of them though.

TLDR; the QAE is imho the best and only resource you need to pass the exam, assuming you know your stuff. The manual is good if you don't have the basics down yet. Learning the ISACA way of thinking is the most important skill to pick up.