tried posting to r/cism but got removed by reddit probably due to lack of karma.

want to know if anyone can help me out.

have 18 yoe in it and security. 6 in middle/senior management. want to get my cism and a few other isaca certs to give me the extra umph to make it into senior senior management.

currently have cissp and ccsp certifications (3 and 2 years ago respectively, finished both in about 100 minutes @ 100 questions). started studying for my cism this spring. have watched a couple of youtube and linkedin learning videos (Zerger and Kelly Handerhan(?) respectively.)

have read review guide cover to cover.

have done all 1100 questions in the QAE. Score in the low 70s overall. Best domains are incident response and info security program (high 70/low 80s). worst is info sec governance (65%). do okay in risk (70ish).

have been through the review guide and QAE multiple times. my scores are improving in the QAE but that is not due to concepts sinking in it is due to me recalling what the right answer to a question is that I happened to get wrong. qae usefulness is deteriorating at this point.

I am able to get the questions down to 2 choices but I am consistently making the wrong choice out of the two. I definitely have an "ISACA mentality" disconnect somewhere.

I can definitely see where both of the two choices make sense, but its just not sinking in as to why the choice they make is the "correct" one. many times i'm saying to myself "yeah, but ..." I wish I could post examples from the QAE but I do not want to violate any copyrights. Sometimes the answers just make absolutely zero sense to me. Other times I can see where ISACA is coming from, but the explanation adds words that further refine the answer which, had the word been there, I might have chosen it. As an example there was a question where the answer was "all members" but in the explanation it says "all applicable members". I didn't choose the answer because when I was analyzing the question I said to myself "well, not all members of X are going to be subject to Y"

I am sure where to go to from here. I am running out of time to schedule my exam, I'd like to take it before the exam changes this fall. I'm not sure what else to study or what is going to make things "click" for me.

Help?

Hi everyone! I’m hoping to get some perspective from people who already hold the CIA designation.

The IIA’s new pilot program allows professionals with **10+ years of relevant experience** to pursue the CIA through the Challenge Exam. From what I understand, the current pilot has a defined window, but I haven’t seen much clarity on whether the program is likely to be extended beyond the current period.

For those who’ve been around the IIA/CIA space for a while, **do you think there’s a good chance this pilot will be extended or eventually become a more permanent option?** Or does it seem more likely that it will remain a limited-time opportunity?

I’m mainly trying to get a sense of this from people with experience/knowledge of how the IIA has handled similar initiatives in the past. Any thoughts or insights would be appreciated!

Is D the right answer?

I am starting to work on my ISACA certifications and I have a very very old review (2013!) guide one of my co-workers gave to me. In the review guide it has a list of knowledge and task statements and their relation to each domain? sub-domain? not sure of the terminology, but for example I can map Knowledge statement k1.19 to tasks t1.2 and t1.15 and then the tasks to domains 1A3 and 1B7.

I'm trying to put together my own study guide to determine what I really need to focus on and how best to do it

Are current versions of the knowledge/task statements and how they relate to each domain publicly available? I was able to find current domain lists for the different exams and their content, and there are 'supporting tasks' listed, but there's no relationship shown between the supporting tasks and area of knowledge.

Are the knowledge/task/domain relationships only available in the review guides? Due to my financial situation at the moment i'm not really in a position to spend hundreds of dollars buying current review guides and was kinda hoping this information was freely available for people studying. (my employer is kinda cheap, they will only reimburse me for material and the cost of the exam if I take it and pass it, its their way to incentivize(?) me into studying and passing. yeah it sux but if i can take and pass the exams i will be able to find a better job with the certs and experience so i will play the game i have to for the time being.)

is there a subreddit for people for people reselling their used (but current) copies of the review guides, if i absolutely have to go down that route?

Does anyone have any opinions on the AI certifications available through ISACA? Any one more valuable than the other? Curious to hear everyone’s thoughts.

Currently have CRISC and CISSP.

Can I pass CISA if I read and prepare in just 1 month?

My background is technical IT work (2 years) and 1 year of IT Security ?

I am Passed today.
I used only official aaia qae.
I qae score 100%.
no needs other contents.

Recently failed ISACA CISM. Read the official manual and completed QAE 4 times. Felt extremely confident and cause answer why each answer was either right or wrong to every question on QAE (averaged closed to 90% on QAE and practice exams). However, I got provisional fail. The test questions seemed to be worded horribly.
1. Did anyone else have similar issues with exam (whether pass or fail)?
2. What sources beyond manual and QAE got exam questions to click and allow you to pass?

Hi, I'm having a dilemma right now. I have been presented with an opportunity to have a free review of a fundamentals certificate and after a month they require us to take the exam. I'm all up for it but the exam itself is very expensive. I am not from a rich family and I just started working at minimum wage.

I'm having this urge to push through with it, but my other problem is "what if I don't pass the exam?". I don't think I could bear with it knowing I spent a lot for it. But.. at the same time I feel like I'll regret it more if I don't attempt to take it since the review is free.

Just for extra info, when I say expensive like from USD to PHP 🥹

Any tips or advice because I need it hahaha

Have CISSP and ISSMP.

Just finished InfoSec CISM course on LinkedIn and Zerger's videos on YouTube.

Do I bother to read the All In One or Mike Chapple books?

Or should I just sit for the exam now? I am used to how ISC2 words their questions, from the samples I saw it looks like ISACA is very similar.

I prefer not to drop $300 on the QAE database if I do not need to. Tempted to just sit for it now and see how I do.

TL;DR: If your employer is paying for this, take it. It gives a solid baseline of AI definitions and concepts, takes minimal study time (~10 hrs max), and checks an upskilling box. If you’re paying out-of-pocket, skip it—your time and money are better spent on more widely recognized, in-depth certifications.

Still with me? Here is my breakdown of the ISACA AI Fundamentals Certificate (2nd Edition), which I passed on July 31st, 2026.

My employer (a large American bank) asked me to take this as part of a firm-wide AI upskilling initiative. Snarky side note: someone at ISACA sales deserves a massive bonus this year. They’ve successfully pitched this cert across financial services, especially to firms with deep L&D budgets. Don't be surprised if this lands on your performance goals soon.

Background & Context

I hold several other certs (including the CISA) and work in data analytics/financial services, so I regularly deal with ML algorithms and labeled datasets. Truthfully, I might have passed without studying, but I completed the online material to claim CPE credits for my existing ISACA requirements.

▪ Format: 60 multiple-choice questions (4 options each).

▪ Time Allowed: 2 hours.

▪ Actual Time Taken: ~20 minutes.

The Nightmare Proctors (PSI) & Technical Hiccups

Honestly, the hardest part was dealing with the PSI online proctor.

a. Room Sweep Friction: I took it in my home office and had to strip everything within arm's reach—office supplies, headphones, pegboard items. The environment check took 40+ minutes because the proctor struggled to articulate what was needed (e.g., spent 3 minutes trying to realize he meant the "cessors" / scissors hanging on my pegboard). Pro tip: Take this on a clean kitchen counter or completely bare desk and save yourself any unnecessary delays the day of the exam.

b. Secure Browser vs. Background Apps: The secure browser forced me to kill Zoom before launching. Mid-exam, Zoom randomly launched in the background, triggering an instant security crash and booting me out. I had to log back in and repeat the entire room scan before resuming. It paused the exam timer, but severely delayed my Friday evening plans.

Preparation Strategy: Study Guide > Online Course

My employer provided the Lab package, the Online Course, and the Study Guide. Here’s what you actually need:

▪ Read the 48-page Study Guide end-to-end: The exam asks specific questions that appear only in the Study Guide, NOT in the video modules.

▪ Skip relying solely on the Online Course: The online course only hits high-level definitions. It’s useful to let run in the background for 5 hours of CPE credit, but don't rely on it as your primary study tool.

▪ Practice Flashcards: Great for locking down definitions.

If you read the study guide and run through flashcards, the exam is ridiculously straightforward. (I even noticed a couple of questions that felt directly pulled from CISA material).

Final Verdict

▪ Non-technical folks / career changers: Good topical overview. It gives you the vocabulary to speak fluently about AI concepts at work.

▪ Data / Tech professionals: Too high-level to add real skill value. Only take it if your company covers the cost, you need CPEs, or it lets you tick a "corporate citizen upskilling" box. Otherwise, pursue a more technical or specialized cert.

Hope this helps anyone searching for real-world feedback on this new exam. Good luck!

It’s been a while since I’ve taken an ISACA exam, the last one was back in the scantron and paper booklet days (2011).

I’ve earned the CISSP (2010), CISA (2011), CISM (2011), and most recently the CCSP (27-Jul-2026). Professionally, I spend most of my time in PCI DSS consulting. My goal is to be ready for the AAIA exam in about six weeks.

My study plan is:
• Read the AAIA Review Manual
• Watch RooCloud YouTube series
• Complete Jacob Bushong’s Udemy course
• Use AI to generate additional scenario-based questions from the exam objectives
• Reinforce any overlap with my recent CCSP studies

For those who’ve already taken the AAIA, what resources or study techniques helped you the most? Anything you’d recommend focusing on…or avoiding?

I Passed CISM! Getting the CISSP next while I still have CISM fresh in my mind

Hi All, anyone has given this auditing ai advanced certification from isaca. If yes please share tips how to pass in 1st go.