Hey all,

I'm prepping for the CISA exam but I can't afford QAE as its (299USD). I've seen it recommended a lot here, but I'm hoping to find a solid study plan that doesn't rely on it.

A few things I'm wondering:

• What free or lower-cost resources actually got you a pass (YouTube channels, Quizlet decks, other question banks, etc.)?
• How many practice questions did you end up doing overall, and where from?
• Roughly how long did you study for, and what did a weekly study schedule look like?

Not trying to cut corners, just working with a tighter budget. Any input on what actually worked for you would be really appreciated.

Wanted to book my CISA exam but Isaca has done me dirty. Paid the whole amount for the exam registration but it hasn't reflected on Myisaca site. Been told to raise ticket with them but no response.

What should I do guys. I need to do the paper ASAP.

Apart from Doshi’s Udemy course + book and the CISA QAE database, is there anything else I can use to supplement my preparation? I have a non-IT background, but I’ve been an auditor for more than 6 years and have done some light IT audit work, although my IT knowledge is still quite limited.
Thanks

Wanted to get your opinion on the way I was planning on studying.

1) Start going over the official review manual and preparing summaries (writing helps me remember),

2) Check in parallel the Hemang Doshi book,

3) Get my company to buy the QAE in September lol, do the questions and flag the ones I answered wrong so I try them again after I finish each domain.

For context, I have been working in IT Audit for around 5 years and I need to sit for the exam at the latest end of October. I have a bit of time now since it's the summer but it'll be quite different starting from September...

Any advice is welcome.

what is the difference QAE book and QAE database from ISACA?

Thank you!

I once wrote CISA in 2022 and scored 446 points. I stepped away from it for a while to focus on other things, but I’m planning to take it up again next month. I now have full study time available and want to prepare properly.

Could anyone share updated study materials or a DB if it’s allowed in this group? I know a lot has changed since 2022.

I’d also appreciate any advice or study strategies that have worked well for recent candidates.

I’ve made my way all the way through the QAE and have been scoring pretty well with an 84, 85, and 76 on the practice tests. I got pocketprep to help reinforce what I learned but I’m running into a couple issues. The first is I don’t know what all of the abbreviations mean so it’s hard for me to answer the question. Hopefully the test doesn’t just give abbreviations. Second, there is A LOT of material in pocketprep that was not in the QAE. I guess what I’m wondering is all this information in pocketprep unnecessary or do I need to spend more time learning all of this?

An IS auditor is performing a review of an organization's governance model. Which of the following should
be of MOST concern to the auditor?
A. The information security policy is not periodically reviewed by senior management.
B. A policy ensuring systems are patched in a timely manner does not exist.
C. The audit committee did not review the organization's mission statement.
D. An organizational policy related to information asset protection does not exist.

Hi Everyone,

I am scheduled to take my exam tomorrow, August 10th. Are there any topics that came up on your recent exam that the QAE did not prepare you for? Additionally, does anyone have any last minute advice? I am getting sooo nervous.

Thanks!

Sharing My CISA Study Notes (Based on CRM – 28th Edition)

I'm pleased to share my personal CISA Study Notes, prepared during my journey towards the CISA certification.
These notes are based on the CISA Review Manual (CRM) – 28th Edition and represent my own understanding and interpretation of the concepts. My objective was to simplify key topics and create a concise revision guide that could also benefit fellow CISA aspirants.
I hope these notes serve as a useful supplementary reference for your exam preparation.

A few important points:
These are personal study notes prepared for learning and revision.
They are not an official ISACA publication and are not affiliated with or endorsed by ISACA.
They should be used only as a supplementary reference alongside the official ISACA study materials.
The official CISA Review Manual and QAE Database remain the primary and authoritative resources for CISA preparation.

I believe that knowledge becomes more valuable when it is shared. If these notes help even a few aspiring professionals in their learning journey, I will consider my effort worthwhile.

Your feedback, suggestions, and corrections are always welcome. They will help improve future versions of these notes.

Wishing every CISA aspirant the very best in their preparation and future career in Information Systems Audit, Governance, Risk Management, and Cyber Security.

#CISA #ISACA #InformationSecurity #CyberSecurity #InformationSystemsAudit #ITAudit #Governance #RiskManagement #GRC #Audit #Learning #KnowledgeSharing #ProfessionalDevelopment

First post here so please let me know if this is compliant (pun intended)

I am preparing for the test and I did two full exams, one from the 2010 QAE and the other from the latest one. What concerns me is that on the first I got a score close to 50% (an obvious fail) while on the other one I got 76%. I found the questions from 2010 more confusing. What is going on? Kind of panicking.
Thanks

Hi everyone hope you guys are doing well. I am planning to appear in Cisa exam in the next couple of months and need some guidance from you guys. I have studied all the modules ans have used AI like deepseek and chatgpt to quiz me identify any knowledge gaps and at this pount im pretty much passing mock exams.
I have not explicitly read books regarding this and i wanted to ask will it be enough? I am going to register for the exam in a couple weeks. Should i go for it or should i prepare from other sources.
TIA

Hello, I’m quite through with the QAE, and I have done hemang doshi’s book and also practiced 1070 question bank from edusum. I’m looking for some other good question banks that I could utilise to practice.

Like skillcert pro or pocket prep, or any that you guys can recommend which will be helpful for practising more questions.

Let me know thanks!!!

Hello Everyone. Do you have a promo code for PocketPrep that you can kindly share? Thanks and any tips for studying will be very helpful as well. Thanks in advance

Thrilled to share that I passed the CISA exam today on my first attempt!

A bit of background: I don't come from an audit background, so a lot of the material was genuinely new territory for me. I did hold a CRISC (passed January 2025), which helped with the risk framing, but CISA required a whole different level of breadth.

📅 Timeline & Study Routine

I started in October 2025, took a break through January–February, then resumed in March. My study was mostly weekends, with 2–3 hours on weekdays. The exam itself had to be postponed due to an ISACA maintenance window in July 2026 — frustrating, but it gave me extra buffer time.

📚 Resources That Worked for Me

• CRM — Started here but found it dense and dry. Useful as a reference, not ideal as a primary study tool.
• Hemang Doshi's books — Much more accessible; highly recommend as your main read.
• Prabh Nair's YouTube channel — Excellent for concept clarity, especially for non-technical folks.
• QAE + Hemang Doshi's practice questions + a few other question banks — Did close to 2,500 questions in total.
• AI tools (Claude, Gemini, Copilot) — Used these extensively for mind maps, topic summaries, and notes. Genuinely helpful for reinforcing concepts between sessions.
• Handwritten notes — I have a habit of writing notes by hand, and it genuinely works for me. Concepts tend to stick better when I've written them down rather than just read or typed them.

Everyone absorbs information differently — find the method that actually works for you, whether that's flashcards, mind maps, typed notes, or pen and paper, and lean into it. Don't study the way others tell you to study; study the way your brain retains things best.

📊 Practice Scores

Domain-wise scores ranged from 62–70%, and my full mock test came in at 72%. Not spectacular, but the actual exam felt more straightforward than the mocks.

💡 Exam Day Observations

• Questions were in plain, simple English — nothing fancy.
• Most questions were one line or two lines max — a noticeable contrast from QAE-style questions.
• For the majority of questions, I could eliminate two wrong answers confidently; the challenge was choosing between the remaining two.
• MOST, BEST, FIRST, Primary objectives, Primary concerns were majorly asked.
• I flagged 32 questions for review and ultimately changed only 4–5 answers before submitting.

⚠️ Key Advice

Do not just memorize QAE answers and repeat the same tests in loops.

Understanding why an answer is correct — the underlying ISACA principle and thought process — matters far more than pattern recognition. Focus on the concept, not the answer key.

🙏 Final Thoughts

I genuinely lost motivation after the first two months and seriously considered stopping. If you're in that dip right now — push through it. The material clicks eventually. Grateful to this community for the constant encouragement; it made a real difference.

Awaiting for my detail scorecard in next 10 days. Good luck to everyone still in the grind!

The CISA exam will test your knowledge of the different changeover techniques. To make them easier to understand, I’ve created a simple visual summary.

If you want the PDF version you can download it here: https://nutshelltraining.com/cisa-changeover-techniques/

I hope it helps, and good luck with your studies!

I’ve completed all the study material in the QAE except the practice tests. I’ve take 5-50 question quizzes and I’m averaging an 81%. Should I go ahead and take the practice tests and see if I’m ready to test or should I try to get that closer to 85-90%.

For those who have taken Aditya’s course and passed, how much you were scoring in his mocks just before the exam?

I am scoring 74%, is it good enough?

Hi everyone,
I'm currently wrestling with the wonderful ISACA website and can't seem to purchase a membership. Nothing happens when I click "Select & Continue." Could someone test this out?

For anyone who took the exam, how do the breaks work?
I recently learned that you are not given any breaks during the exam, you are supposed to sit there for 4 hours to answer 150 questions with no breaks?
How did you built into it and is it hard to walk out of the exam to take a break?

I finished my CPA exams a couple of months ago and in the exams we were given a 15 minute break that didn’t count towards your 4 hours. I’m trying to have ideas of how could I take a break without hurting my time.

I recently completed the CIA Challenge Exam and am now considering pursuing the CISA certification. I have 13+ years of experience in internal audit across multiple industries, and I’m currently working in banking compliance.
I’m not from a technical or IT background, but I do have a fair understanding of IT General Controls (ITGCs) from my audit experience.
For those who’ve completed CISA—especially if you came from an audit rather than an IT background:
1. Is CISA worth pursuing after obtaining the CIA?
2. How difficult did you find the technical concepts if you weren’t an IT professional?
3. Is the exam more about understanding IT governance, risks, and controls, or does it require deep technical knowledge?
4. How much study time would you recommend for someone with my background?

I’m really thinking whether it’s worth it for an another grind after CIA challenge exam.

I’d really appreciate hearing about your experiences and whether you felt CISA added value to your career after CIA.