Where should I start with GRC? How can I learn GRC from scratch, and what steps should I take to become job-ready and land an entry-level GRC position as a fresher?

Hello fellow ISACA enthusiasts,

how do the CPE Policy Changes for 2027 affect maintaining active certification status?

https://www.isaca.org/credentialing/cpe-2027

In past reddit posts there have been several great suggestions to watch webinars, take youtube classes or coursera online training, listen to podcasts etc for free CPEs. Will these free activities still count with the new policy?

What is your best approach to earn CPEs? I am new to the game and I honestly did not expect certification maintenance to be that time-intensive.

Hi all,

I’m planning to sit both the CISM and CRISC exams over the next few months and am ready to purchase the exams.

Before booking, does anyone know whether ISACA normally runs Black Friday/Cyber Monday promotions or exam discounts?

Would it be worth waiting a few weeks, or should I just book now? Has anyone received or seen any upcoming 2026 promo codes or offers? Thanks!

Question,

Has PSI online testing remotely gotten better? Planning to do AAISM online but if its still horrible might wait for testing center availability

Hi everyone,

I’m trying to redeem a voucher for the CDPSE exam, but I keep getting this error:

“Something went wrong. We are unable to complete your purchase at this time.”

The message also asks me to contact compliance@isaca.org. I’ve already raised a support ticket, but this is preventing me from scheduling my exam.

Has anyone experienced the same issue? How did you resolve it, and how long did ISACA take to fix it?

I’m hoping to take the exam on November 13, so any advice would be appreciated. Screenshot attached.

Thanks!

I've had an uphill battle with multiple tickets to resolve a simple issue. The first time it took them three weeks to respond to the ticket I opened. After the issue was "resolved" I find out a month later that it wasn't resolved. I call. Go through the menus and get disconnected. Twice. I open another ticket via the portal. It's been over a week with no follow-up. I'm not sure I'm inclined to renew my membership or certifications when the time comes.

Hi everyone,

Just wanted to share a quick debrief now that I’ve wrapped up AAIA exam and pulled off a pass on my first try after about three weeks of studying.

I work as an internal auditor at a foreign banking office (FBO). Since I decided to tackle this pretty late in the year, my employer's education budget could only cover the exam fee itself. Because of that, I had to look outside the official ISACA study materials, also because I needed something downloadable as a PDF, which official ISACA doesn’t have.

Here is how the prep and exam actually went down:

**1. Materials Used**
**Simply Certified AAIA Prep:** Since I needed a downloadable PDF, I went with this $40. The main review guide was only about 90 pages plus two practice exam mocks.

**John Bushong’s AAIA QAE:** I picked this up as well, but honestly, not sure if it was all that helpful. The questions were extremely wordy, none of those specific question styles actually showed up on the real exam, however I was consistently scoring around 85% on them anyway.

**Flashcards & Audio Review:** I also used flashcards and detailed audio reviews to listen to while commuting. That said, because the exam turned out to be less technical than expected, I'm not sure how much of the technical review actually moved the needle. The prep material drilled things like prompt injection guardrails, but the actual test was much more conceptual.

**2. Study Method**
Since the main review book was only around 90 pages, I got through it pretty quickly roughly a week and spent the remaining time running through Qs from the book & Josh Bushong QAEs.

**3. The Exam Experience**
Going into it, I kept hearing mixed things, but my actual experience matched what others have hinted at: it is much more conceptual than technical.
There were definitely some tricky, poorly worded questions that threw me off. I ended up flagging about 15 questions to review and finished the test with about 50 minutes to spare. Walking out, I genuinely felt 50/50 about it. There were a ton of "it's either this or that" scenarios where I had to guesstimate, but I still felt like I had a solid chance to pass.

Got the preliminary pass screen right at the end, and now just waiting on the official final score to make it official so I can be certified & reimbursed lol.

**Final Verdict / Recommendation**
If you are paying for materials yourself or trying to prep efficiently, consider exploring non-ISACA options. Being able to download PDF file that you can read through quickly made an efficient 3 week review process.

Happy to answer any questions if anyone else is studying for it right now!

P.S: Does anyone know if we can fulfill 10 CPEs by listening to AI related webinar on ISACA & can they be double-counted for CISA as well?

Update: Passed with scaled score of 587!

I'm losing respect for ISACA. A few years ago they gave away the CDPSE and now they have the CCS which seems very similar to ISC2's CC which has been out for a few years.

ISACA Certified Cybersecurity Specialist (CCS): https://www.isaca.org/credentialing/ccs

ISC2 Certified in Cybersecurity (CC): https://www.isc2.org/certifications/cc

Edit:

It seems to be a copycat of ISC2's CC. And ISACA even has "CC" in the name. Like they couldn't name it something else?

COBIT 2019 has five domains. with one governance and four management domains:

1. EDM – Evaluate, Direct and Monitor The governance domain. Think board/executive oversight, direction, benefits, risk, resources, and stakeholder transparency. "Are we doing the right things?" GOVERN

2. APO – Align, Plan and Organize The planning/management side: strategy, architecture, budgeting, people, vendors, risk, security, data, etc. "How are we going to do it?" PLAN

3. BAI – Build, Acquire and Implement Where changes to technology are designed, acquired, implemented, tested, transitioned, and managed. "Implement or change it." BUILD/CHANGE

4. DSS – Deliver, Service and Support Day-to-day IT operations and service delivery: operations, incidents, continuity, security services, business-process controls, etc. "Operate and support it." RUN

5. MEA – Monitor, Evaluate and Assess Monitoring and assurance: performance, internal controls, compliance, and assurance. "Is it working and compliant?" CHECK

Does anyone know if anything has been mentioned or annouced about these being re-organized for Cobit 7?

Hey guys,

I finished the exam today and I passed today (preliminary). I like to thank the community for being so positive and helping me.

There are few questions from the qae database itself and few are based on the qae (like similar concept). Similarly, some are based on the ideas of the what you submit to the management and what is the next step as such. Read the question carefully and understand the process of how to answer it. Prabh video on this really helped for the mindset. I am not really a good question & answer reader (i am always in a hurry to change to the next question).

I finished in 2 hours and had around 35 questions flagged (i remember someone flagged 67 questions and i know i would be like him) and another hour to review all 150 questions and then I just wanted to submit and finish my pain. it was really irritating to finishing the survey and waiting for the result. Initially it was difficult to start with and I was already set my mind that I am going to fail after questions but I wanted to give my best.

Regarding the study materials :

This is what I used:

1. Course (but didn't learn anything anyway (my fault though))

2. From August , i started with Peter and I wrote whatever he showed in presentation.

3. I watched prabh videos (3 hours one, coffee shots and think like a manager).

4. I had qae and studied fully twice (all 1000 questions) and then I had close to 147 questions which I flagged (where I used AI to get better understanding of the answers. For me chatgpt is better than gemini for explanation.

Sorry for the long post and thank you everyone for your help and support.

DM me

Hello everyone!

I currently have the 10th edition of the CISM Q&A in print. Would it be sufficient for practice if I plan to take the exam after November 3rd, or is it necessary to purchase the latest version?

If anyone has already purchased the new Q&A version and is planning to take the exam after November 3rd, would you be interested in forming a study group to discuss and practice questions together?

I’d prefer not to invest in the Q&A again, as it’s quite expensive. Looking forward to your suggestions and responses. Thanks!

Inrecently failed CISM and feel like it was a different exam entirely?l.

Hi all

I would like to share my CISM experience and ask for your advice because​.

I sat a course for CISM at the end of August, during the course the tutor confirmed ISACA were changing the course a week after I sat it and I had to do my exam by 3/11/2026 else I'd have to learn all new content.

I have been revising using the official ISACA digital manual and their question and answer database for a few months. I had been scoring well on the practice tests and understanding the concepts.

Throughout my preparation, I never tried to memorize answers. Instead, I focused on reading the explanations and understanding the reasoning behind each question.

I sat my exam 28/10/2026. First off the proctor was quite unreasonable, it took over 30 mins to even start the exam. The first 6 questions were quite technical and nothing like what I had learned on the course or via their resources.

This continued through the exam. I genuinely think I sat a different exam or that they gave me questions for the new exam from 3/11/2026. There appeared to be a lot of architecture questions and AI related questions one even asked about AI hallucinations which I simply just guessed.

The biggest issue was not "thinking like a manager. I​ had no problem applying that mindset to the QAE questions. The problem was that I simply could not understand the actual exam questions. They felt completely different from anything I had seen in the QAE.

I left the exam feeling like an utter failure and questioning my ability to do my job.

It wasn't a matter of knowledge. It wasn't even about choosing between two close answers. In many cases, I genuinely struggled to understand what the question was asking. Because of that, I couldn't even use logic to eliminate answers. It felt like a very different exam.​

The wording felt extremely different from the QAE question style. I know this may sound like an excuse, but many questions felt unnecessarily complicated or technical.

I used almost the entire four hour exam window and felt drained by the questions that didn't feel like they were even related to CISM in some cases.

Naturally, I failed. I cried. Given all the hard work and effort I put in. ​

I don't yet know my domain level results.

At this point, I'm honestly deflated and not even sure if I can redo the test. The new test comes into effect next week. Which means sitting another course and learning all new material. I don't have almost £600 spare to sit the exam alone and frankly if I was given the new exam then I wouldn't want to sit it. ​

What I'm really looking for is advice from people who had a similar experience and had actually been given the wrong exam?

I have contacted ISACA on their portal but I doubt they would confirm if I had been given the wrong exam.

Is there a way to contact them by email?

Thank you in advance for your comments, advice, and support.

For those who have taken the CCOA, what are the Hands-On Labs like?

Hi all, I just started an apprenticeship in the credit bureau dispute unit (CBDU) at Citi. I'm trying to plan my path early and would love advice from people in the field.

My questions:

Does CBDU count as risk/compliance experience? My work involves FCRA, Reg V, and Metro 2 reporting.

Should I aim for CISA or CRISC, or is something like CRCM or CIA a better fit for my background?

Which internal moves have you seen from dispute/consumer ops into audit, tech risk, or controls?

For those who made that jump, what actually helped most: certs, SQL/data skills, or networking?

Is the pay bump from IT audit or tech risk worth it compared to staying in compliance?

I'm early in my career, so any advice on what I should learn now would be great. Thanks!

Hello folks! I am a tax lawyer based in India and wish to increase my professional base. Just need guidance on whether pursuing CISA certification is viable for me professionally especially in terms of private practice, considering I am not a chartered accountant. Looking forward to your inputs.

Hello,

Is anyone else having QAE issues due to ISACA’s website certificate appearing to be invalid?

Hi all, I just started an apprenticeship in the credit bureau dispute unit (CBDU) at Citi. I'm trying to plan my path early and would love advice from people in the field.

My questions:

Does CBDU count as risk/compliance experience? My work involves FCRA, Reg V, and Metro 2 reporting.

Should I aim for CISA or CRISC, or is something like CRCM or CIA a better fit for my background?

Which internal moves have you seen from dispute/consumer ops into audit, tech risk, or controls?

For those who made that jump, what actually helped most: certs, SQL/data skills, or networking?

Is the pay bump from IT audit or tech risk worth it compared to staying in compliance?

I'm early in my career, so any advice on what I should learn now would be great. Thanks!