r/CISA

Hey guys, Passed my ISACA AAIR exam this morning! It was pretty intense on the threat modelling and model drift side but I'm excited to have it out of the way.
My next target is lAPP AIGP. My brain is already in "study mode" so I want to keep the momentum going and dive right in.

For those of you who've done both (or just the AIGP):

How much does the AAIR IT risk knowledge transfer to the AGP privacy and governance focus?

work full time but can provide around 2-3 hours a day. Can we get through the APP syllabus and the EU Al Act frameworks in 4 weeks?

What are the best practice exams available right now? I find I learn best by asking questions based on scenarios.

Thanks for the advice in advance!

I feel the option is D, Hemang Says A, what are your thoughts and why ?

https://preview.redd.it/tujgn5uojdkh1.png?width=808&format=png&auto=webp&s=77f90496ff91088961dc09d997ff2fe1eff56067

I am confused about these 2:- Cism or crisc, which one should i pursue first, i am working in the grc domain along with tprm under the Cyber security. My role is mostly on security compliance, vendor assessment, risk and mitigation, client Security questionnaires etc..

I thought of giving crisc first then cism? Any suggestions

Hi everyone!

I’m planning to take the CISA exam and wanted to hear from people who have already gone through the process.

After getting CISA certified, did you feel that it made a real difference in your career? I’m curious about things like new opportunities, interviews, career switches, or simply being taken more seriously for certain roles.

Also, if you were already working in IT before CISA, did it help you move toward areas like audit, GRC, risk, or cybersecurity?

Would really appreciate hearing your experiences.

Thanks in advance!

Question:
Which of the following MOST effectively mitigates the risk of disclosure of sensitive data stored on company-owned smartphones?

A. Secure containers
B. Data leakage prevention (DLP) tools
C. Mobile device management (MDM)
D. Physical device tagging

Guys is option A the correct answer for this? Every AI is giving different answer.

Secure containers isolate and protect corporate data stored on smartphones, reducing the risk of unauthorized disclosure. DLP primarily controls data movement, MDM manages the overall device, and physical tagging only assists with asset identification and tracking.

Hey everyone,

I’m a Chartered Accountant (ICAI) from India currently working as a Product Manager in a SaaS-based lending/LOS platform. I have around 2 years of post-qualification experience in product management.

I’m considering pursuing CISA, but I’m trying to understand whether it would actually add meaningful value to my career rather than just being another certification on my resume.

My current role is more on the product / digital lending / technology side, but I also have a strong finance and accounting background because of my CA qualification.

My longer-term plan is to explore opportunities outside India — initially Gulf countries (UAE, Saudi, Qatar, etc.), and potentially later Europe, Australia or the US.

I’d really appreciate some honest opinions from people who have CISA or work in IT Audit, GRC, Information Security, Technology Risk, IT Controls, Cyber/Compliance, or related fields:

- Is CISA worth it for someone with my background, or is it mainly valuable for people already working in IT Audit?

- Could the combination of CA + CISA + Product/Fintech experience create any interesting career paths?

- What roles could realistically become accessible to me after CISA?

- Would it help with international/Gulf job opportunities?

- Does CISA actually lead to a meaningful salary increase, or does experience matter much more?

- Would you recommend CISA, or something like CISM / CRISC / CISSP / another certification instead?

- Are there any particular career paths where you think my CA + Product background could be an advantage?

I’m not looking for a generic “CISA is a good certification” answer. I’m particularly interested in real-world career outcomes, salary impact, international mobility, and whether you think it makes sense specifically for my profile.

Would really appreciate honest pros/cons and personal experiences.

Thanks!

I just got my preliminary pass!

Felt a bit like a traumatising experience I must say.

I took the exam online, no issues with the PSI instructor, instructions were super clear, timing was totally fine, the room check was quick, really no issues there.

But the questions … I must say it felt sometimes not super familiar (concept-wise) and really confusing (classic CISA with two choices being obviously wrong and other two being much harder to chose from). The questions were much shorter though.

My study strategy was a bit hectic and would definitely not recommend it. 😅

I started studying end of June (also had a significant number of days off in between). I carefully reviewed the CISA review manual (super dry but doable).

In parallel I did questions from the 12th edition QAE through Quizlet (found a ~1000 question database split by domains) and tried to understand where I was doing good and wrong (averaging 65% through all domains after my first pass, some with ~80%, other around 60%). Also listing in parallel some useful tips and concepts.

I ended up by doing a full practise test I found also on Quizlet, scored a bit more than 80% but I went through familiar questions so I took it with a grain of salt.

Overall, the timing was totally fine, I don’t get why they recommend more than 3 month of study. If you can free a significant amount of time, ~2 month is okay I think.

But if I would do it again (NEVER), I would get the latest QAE (the price is ridiculous though). The QAE base I used was totally fine, but I felt that some topics were not covered, obviously because it was a bit dated.

Curious to see in 10 days if it was a short pass or if my auditor brain did unexpected wonders. 😇

Hi! Will be taking the CISA exam this week, any last minute advice?

Hi all,

I have been studying for the CISA exam and my test date is in a week.

I have currently been practicing by taking the mock tests on https://perform.isaca.org/app/.

Every time I use up all 3 tests I reset it and do them again.

Currently I have been scoring about 85%.

Is than for me to go ahead and attend the exam or should I reschedule it again?

Thanks

From “I Failed” to “PASSED!” My CISA Exam Journey 😭

I still went cover to cover through the CRM and completed the ISACA QAE three times. I honestly felt that I had prepared as much as I possibly could.

But, Sir/Ma’am… the questions in the actual exam are out of this world! 😂

They’re not simply questions testing whether you memorized what you reviewed. They’re practical questions that seriously challenge your understanding and knowledge of Information Systems. There were so many moments when I thought, “Wait… what?!” 😭 When I finally completed the exam, I was mentally exhausted. Before submitting my answers, I literally had to** **pray. I completed the exam 3 hours and 50 mins. 5 mins of praying then I hit the submit button 5 mins before the 4 hour mark.

And then, my mind started preparing for the worst.

I started making an inventory of everyone who knew I was taking the CISA exam—because I needed to know who I would have to explain myself to if I failed. 😂 I was already mentally preparing my excuses and thinking about what I was going to tell my wife.

Then came the survey.
I thought, “Wait… is this supposed to appear before the result?”

I was already hoping that the result would appear immediately. So when I saw the survey instead, I became even more disheartened. I was thinking, “Why am I answering a survey when I don’t even know if I passed?” 😭 I thought results won’t come out if you fail so you don’t make a scene in the testing center. I was like “Can I just disappear now?” Not overly dramatic but it was the experience!

Sorry, ISACA. I probably didn’t answer the survey with complete accuracy because, at that point, I was emotionally overwhelmed. 😂
But it still didn’t end there.

After submitting my exam answers and completing the survey, I swear there were three more screens/modules.
At that point, I was like:
“WHEN IS THIS GOING TO END?”
“WHEN WILL MY SUFFERING END?” 😭

By then, I had already convinced myself that I had failed. I was mentally preparing to tell my wife, “I’m sorry, I didn’t make it.”
Then finally, the last screen appeared.
And there it was: PASSED

I literally thought, “Am I hallucinating?” 😂

I had spent the entire exam thinking I might have failed, only to see those beautiful words at the very end.

I PASSED. First attempt. 🎉

After 3.5 months of studying, countless hours of reading, going cover to cover through the CRM, and completing the QAE three times… it finally paid off.

Looking back, it was a stressful, terrifying, and slightly traumatic journey—but definitely worth it.

To everyone preparing for the CISA: understand the concepts, don’t just memorize, and be ready to think practically. The exam will challenge you in ways you probably won’t expect.

And to ISACA…

Sir/Ma’am, I respect you. But those questions were personal. 😂

CISA — PASSED! ✅🎉

CISA dust to you guys ✨ ✨ ✨ ✨ ✨ ✨ ✨ ✨ ✨

I completed hemant doshi Udemy course and I honestly feel like I know all the topic but I am not scoring at all while trying mock questions

Ik ISACA CISA QAE is the main things that I need to do
To understand the ISACA way of thinking should I do one more video course(prabh nair)or relay on CRM ?

I honestly want this cert asap as at my current role I am in a situation where I have heard rumours about layoffs

Any actual advice on the study plan and materials would be greatly appreciated!!!

Hi! I’m a CPA with 3 years of external audit experience and I’m currently a Senior Auditor. I’m thinking about taking CISA because I’m getting interested in IT audit, IT risk, GRC, etc. The problem is I’m not 100% sure I actually want to become an IT auditor. I mainly want to move away from the traditional external audit path and explore something with better long-term career opportunities.

For anyone who has CISA: What did you actually do with it? What roles did it help you get? And would you recommend CISA for someone coming from an accounting/external audit background?

I’d also love to hear from people who got CISA and later realized they wanted to do something completely different. Was the certification still useful?

Hi everyone,

I’m planning to take the CISA exam in January 2027 and would appreciate some guidance.

I currently have the CISA Review Manual 28th Edition and want to prepare without spending on additional courses or materials, as I don’t have any budget left for them.

My current plan is

1. Study the CRM 28th Edition thoroughly.

2. Use YouTube resources from Prabh Nair, Chidambaram Narayanan, and Pete Zerger.

For those who recently passed CISA, is this approach realistic?

Thanks!

Just wanted to share what worked for me on the CISA exam in case it helps anyone else preparing.

I started by watching all of Hemang Doshi’s videos over about a week. If I were doing it again, I’d probably skip these and watch Prabh Nair’s YouTube videos instead. They’re free, and in my personal opinion, I found them much more useful.

After that, I bought the QAE and went through every question. Along the way, I took consolidated quizzes to make sure I was retaining information from the earlier domains. I then took the QAE practice exams and scored 84%, 85%, and 76%.

I also got the Pocket Prep app and completed about 2/3 of the questions. If you use Pocket Prep, I recommend the Level Up mode. The questions start fairly easy and progressively get harder, which I thought was a good way to use the app.

A few pointers from my experience:
I don’t think you need a ton of in-depth technical knowledge to pass this exam. In my opinion, it’s much more important to understand the audit process, the responsibilities of the auditor, and how ISACA wants an auditor to think.

That being said, there were some abbreviations I recognized but couldn’t remember exactly what they stood for. Don’t immediately write those questions off. A lot of the time, the full name or context can give you a pretty good idea of what the technology or process actually does.

My biggest advice would be to focus less on memorizing every technical detail and more on understanding why an answer is correct. By the end of my studying, even when I recognized QAE questions I had seen before, I tried to make sure I could explain why the correct answer was right and why the others were wrong.

I won’t comment on specific questions or topics that appeared on the exam, but I’m happy to answer any other questions about how I prepared.

Shoutout to all the CISAs here who answered my
Questions and helped me prepare. This community was a huge help.

Best of luck to everyone still studying and testing. You’ve got this!

SW engineers with 8 yrs of experience in Full stack development but zero compliance and audit experience. Looking help from someone who made this transition on choosing certification or general path to get into this field.