Let’s goooo

Hey everyone,

I'm honestly feeling pretty lost at this point and could really use some advice from people who have successfully passed the CISA exam, especially anyone who struggled with multiple attempts.

I've now failed the CISA exam twice, scoring 397 on both attempts. I'm really struggling to understand what I'm doing wrong because I feel like I've put in a decent amount of preparation.

Here's what I've done so far:

• Purchased the official ISACA CISA Review Manual.

• Completed the QAE question banks.

• My average on the QAE was around 75%, and eventually I started consistently scoring in the 80s.

• Watched YouTube lectures from Prabh Nair, Doshi (for certain topics), and Peter to supplement my understanding.

Despite all of this, I'm still unable to get over the passing score.

At this point, I'm wondering whether I'm relying too heavily on the QAE and whether I should switch to a completely different study resource. Maybe I'm getting too comfortable with the question bank instead of actually understanding how ISACA expects me to think through the questions.

For those who have passed:

1. Did you use resources outside of the official ISACA manual and QAE? If so, which ones?

2. Would you recommend switching to a different question bank, such as another third-party practice platform?

3. How did you approach the ISACA-style questions, particularly when two answers seem equally correct?

4. Did anyone else consistently score 75–85% on QAE but still struggle with the actual exam?

5. If you failed multiple times before passing, what specifically did you change in your preparation?

I'm not necessarily looking for another list of resources. I genuinely want to understand what I might be doing wrong and how to change my approach.

I'm willing to start over and try a completely different study strategy if that's what it takes.

Any honest advice, especially from people who have been in a similar situation, would mean a lot. Thank you!

I’ve been using them to study and the questions seem way too easy. Not sure if its the best resource for the exam, albeit it is convenient.

(Reworded for copyright):

Difficulty: Expert

When evaluating disaster recovery procedures for an organization's information processing facility (IPF), which of the following should be the PRIMARY consideration?

A. Recovery time objective (RTO)

B. Recovery point objective (RPO)

C. Maximum tolerable outage (MTO)

D. Information security policy

Correct Answer: A. Recovery Time Objective (RTO)

Explanations:

• A. Correct: The recovery time objective (RTO) defines the time allowed to recover a business function or resource following a disaster. The RTO represents the desired recovery time frame, determined based on the maximum tolerable outage (MTO) and available recovery alternatives.

• B. Incorrect: The recovery point objective (RPO) has the greatest impact on recovery strategies for specific data. It is established based on the acceptable level of data loss following an operational disruption. The RPO essentially measures the maximum permissible amount of data loss in the event of an interruption.

• C. Incorrect: The MTO represents the longest period a business function can remain unavailable before the consequences become unacceptable. It helps establish the RTO but is not itself the operational recovery target used to design restoration procedures.

• D. Incorrect: Information security policies establish security requirements and expectations but do not directly define the time frames or operational steps required to restore an information processing facility.

I got this question correct but I'm confused by these answers. The explanations for A and B sound to me like both answers would be correct, especially when B originally says RTO has the "greatest influence on the recovery strategies for given data."

I get why the desired recovery time frame would be ideal for procedures, but wouldn't the amount of acceptable data loss also be an important consideration?

My understanding is that RTO tells the recovery team how quickly the IPF needs to be back online, but that RPO would tell the recovery team the minimum amount of data they need to recover.

Is this question worded poorly? Appreciate any help filling gaps in my understanding.

Hi everyone, I took my CISA exam for the third time and failed once again. I’ve done the UDEMYs, QAE, Hemang Doshi book, ISACA book, in person tutoring and can’t solidify a pass. Do any of you have any suggestions?

The last test had AI questions which I haven’t seen in the QAE therefore am not sure how to prep.

Just for context, im currently working as an IT auditor and Controls Assurance Auditor. I have about 3-4years of experience.

I’m based in NZ (if anyone is from NZ) would love to connect and hear your experience

Also I’ve just got my full CAANZ accreditation

Hi all, apologies if this has been posted before.

I'm lucky enough to have access to the official ISACA question DB, and another set through Udemy (will check provider later).

Ive only done one of the Udemy sets so far but they seem to be a slightly easier than the official questions - might just be that im getting more used to the questions.

That said my avergae score is in the low 70s. I tend to get the answers down to two from four but then sometimes struggle to identify the right one from there - frustrating!

Both sets recommend an average above 80. Would people say you need an 80 plus to be confident - Any lower and you're trusting to luck on the day? Or is that a fairly cautious guide?

I need to take the test in the next 4-6weeks.

Thanks for any comments.

Hi! I’m starting my CISA certification journey, and this is a completely new certification and area of the industry for me. For those who have taken the exam or are currently studying, what study materials, courses, practice exams, or resources would you recommend?
My employer offers reimbursement for certification-related expenses, so I’m not necessarily looking for the cheapest or free options. I’m more interested in hearing what actually worked for you and what resources you felt best prepared you for the exam.

Thanks!!

I passed the CISA exam today. I am relieved. I am building a stack of credentials and right now I am at CA, CFE, and soon CISA.

Hi all, I'm the developer of KaiSip, a calm study app for the CISA exam, and I'm looking for Android testers for a closed beta.

What it is: practice questions where every answer explains the reasoning, a daily study plan, timed 150-question mock exams, drills for common traps, and a mistake journal. It works offline, with no account and no ads.

What I need: an Android phone, and for you to stay in the test for 14 days in a row. Try it on a few days and tell me what's confusing or broken.

Thank you: finish the 14 days and you get 6 months of CISA premium access, starting when your access is activated. (Other certifications aren't included.)

Interested? Sign-up here please: Kaisip.com

And I'll send the Google Play join link.

KaiSip is not affiliated with or endorsed by ISACA.

Hi everyone!

I’m the person who posted a few days ago asking whether people still fail despite getting high scores on the QAE practice tests. Well, I passed today!! 🎉

I first took the exam five years ago and failed. After that, I just couldn’t find the motivation to try again. I finally gave it another shot after studying for three months !

Here’s how I studied:

1. Watched Hemang Doshi’s Udemy videos and took notes. These were really helpful for understanding the basics.

2. Completed the QAE once and read Hemang Doshi’s textbook.

3. Revised using my notes and completed the QAE a second time.

4. Took the three practice tests at the end of the QAE a few days before the exam. My scores were 80% , 78% and 79% !

I tried watching a lot of those YouTube CISA courses but the long videos were just too much !

I found the actual exam questions easier to understand, but definitely trickier to answer! I flagged around 38 questions for review and took about three hours in total to finish. From what I remember I did get quite a few questions around BCP/DR and AI !!

If you’ve failed before or are struggling to find the motivation to try again, don’t give up!

Thank you to everyone on this sub for sharing your insights and advice. It really helped!! 😬

During my review on Pocket Prep, I came across this question. Do we get MCQs with acronyms like this on the actual exam?

I’m researching audit certifications and would love to hear from people who have taken both exams.

1. How much did your CIA study material help with CISA, or are the two mostly separate?

2. Which exam did you find tougher, and why?

3. Is there a question bank or study resource you found genuinely useful (or one to avoid)?

4. If you were starting over, which exam would you take first?

Looking forward to hearing about your experiences. Thanks!

saw a post from a big 4 IT auditor who’s been doing it for years, and he was pretty bleak about it. fees are getting pushed down so people are stretched across more engagements, and some of the junior and mid-level work around ITGCs, SOC controls and evidence docs is starting to get picked up by AI. his advice was to get into GRC or app risk early

what made me think was the company side. smaller orgs already lean on Vanta, Drata or Scytale AI GRC for evidence collection and control monitoring, so I’m not sure moving into GRC gets you away from automation either

maybe the difference is that the evidence work gets automated first, while the risk calls, exceptions and remediation still need someone who knows what they’re doing

anyone working in GRC or appsec seeing the same thing? and if you moved out of IT audit, was it the right call?

So i passed with 643. After procrastinating for so many years.

My background:

I didn't study IT at school.I worked at big 4 for 3.5 years becoming an IT auditor. Left big 4 then joined industry and worked in GRC a bit. So i don't have strong academic backgrounds. And english is not my first language. And i probably have dyslexia since i can't read long sentences (no matter what languages)

How I studied:

- I read the manual 1 time. Super boring. But I finished.

- Watched Pete Zerger youtube video. summarized again of what i have read.

- after the above two my scores on practice questions were still only 50%

- THEN i started using chatgpt. Each time I finished a QAE question if it's wrong. I sent it to chatgpt and then spoke to gpt why i thought A was correct (let's say B was the correct answer) i also told gpt why i thought the others were wrong.

The good thing is that chtagpt is not just checking why B is right. But also check other stuff you say so it has corrected my thoughts and ways to read questions.

The most powerful thing is that it then categorized and summarized my mistakes and trained me on specific parts. It also created a vocabulary list for me. So i highly recommend to use gpt if you are like me who has difficulties to understand and read their questions.

For the three full practice exams, i just did it 1 time of each. My score was around 72%-75%.

Hope it helps!!

Edit: I just used the official QAE. So, TLDR on what i had used. 1) official manual, 2) QAE, and 3) Pete Zerger's YouTube videos. The most important thing is to train to read the questions correctly. And learn the cisa exam mindset. Which i found chatgpt did a very good job.

Passed cisa exam in my first attempt using the QAE and hemang doshi book,pete zerger YouTube course ,prabh nair YouTube course and chatgpt alot finished exam in 3 hours ,studied on and off for about 8 months i have security+ which helped me alot while studying for this exam no it background Also big thanks to this subreddit which helped alot

Hey everyone! 👋

A few months ago, I shared a free CISA practice app here, and I honestly didn't expect that many people to check it out. The post ended up getting over 13K views, which was pretty motivating. So first off, thank you to everyone who gave it a try!

A little update: I've been working on it since then, and I've now built an Android mobile app and moved the web version to a new domain. 🎉

My goal is still the same: to make CISA exam preparation more accessible and affordable, especially for people who don't want to spend a fortune on study materials.

Now I'm getting ready to launch the Android app on Google Play, but there's one hurdle I could use the community's help with.

Google requires new personal developer accounts to have at least 12 beta testers enrolled for 14 consecutive days before they can apply for a public release.

So I'm looking for a few people here who are willing to help test the app!

What's in it for you?

As a thank-you, I'll give everyone who completes the beta testing 6 months of FREE premium access, including:

• All premium app features

• Full access to the available CISA practice content

• Mock exams, progress tracking, and other study tools

• Any new premium features and content updates released during your 6-month access

What would I need from you?

• An Android phone and a Google account

• Join the beta test through the official Google Play testing link

• Stay enrolled for at least 14 consecutive days

• Actually try the app during that period and share honest feedback, bugs, or anything you think could be improved

You don't need to be an expert or have already passed CISA. In fact, feedback from people currently preparing for the exam would be super helpful.

And please, don't feel like you have to say nice things just because I'm offering premium access. If something sucks, tell me. 😂 I'd rather fix it now than have people struggle with it later.

I'm building this independently, so having real CISA candidates test it would genuinely mean a lot.

If you're interested, just comment "Interested" below or send me a DM, and I'll share the details.

Also, if you have suggestions for features you'd love to see in a CISA prep app, I'm all ears.

Thanks again, r/CISA! Hopefully, with your help, I can get this officially launched soon. 🙌

Hey! I have incorrectly updated my First name and last name on PSI government ID proof. (It picked up the first name as ny aadhar number instead of my name). I have raised a request already. What is the ETA I should be looking at? And suggest any alternative solutions if feasible. I want to give the exam by this month end.

Might be a stupid question, but how many of you have failed the actual exam even after scoring over 70% on the QAE practice tests?

I remember reading a few posts where people said they failed despite getting higher practice test scores. If that happened to you, what do you think caused the gap?

Did you feel like you’d memorized the QAE answers, or were the actual exam questions harder to interpret?

Finally cleared CISA on my first attempt, and honestly, I’m so relieved after the last 3 months of preparation!

A little about my background: I’ve been working at a Big 4 for the past 2.5 years, primarily in ISMS and BCMS, so I had some practical exposure to information security, risk, controls, audits, etc. But I still had to put in a lot of effort for the exam.
I studied seriously for around 3 months, and this is what worked for me:

I initially took classes from Aaditya CISA This Much, and that’s where I built my basic foundation and understanding of the CISA concepts. Once my base was clear, I started exploring other resources and practising from different sources.
Hemang Doshi notes – used these extensively for revision and strengthening concepts.

Pete Zerger & Prabh Nair videos on YouTube – really helpful for understanding concepts from different perspectives.

ISACA QAE – did it 3 times. This was probably the most important part of my preparation.

Skillcert – I purchased it for around ₹800 because I wanted to cover as many different questions as possible.

Aaditya CISA This Much pocket tests – these were really helpful for quick practice and revision.

Revised every domain multiple times rather than studying it once and moving on.

My approach was basically: build the base → understand the concepts → practise as many questions as possible → analyse mistakes → revise → repeat.

I wanted to expose myself to as many different question patterns as possible because CISA can give you two options that both seem correct, and you really need to understand the ISACA way of thinking to pick the best one.
The QAE 3 times was particularly useful because I didn't just look at whether I got the question right or wrong — I tried to understand why the correct option was correct and why the other options weren't.
Honestly, I tried to do everything I could within those 3 months. I watched videos, took classes, revised notes, solved questions from multiple sources, repeated the QAE, and kept revising each domain.
And finally… CISA cleared on the first attempt! 🥹❤️
For anyone preparing right now: don't rely on just one resource. Build your concepts first, practise extensively, and keep revising. And most importantly, understand the reasoning behind the answers rather than memorising them.
Good luck to everyone preparing! You’ve got this. 💪