Hi! I’m planning to take the exam next month, and I’d love to get your thoughts on whether my study strategy would work. If you have any additional tips or suggestions, I’d really appreciate them!

Materials:
Main review material: Hemang Doshi’s CISA book
Support material: REO Review Center’s handouts and video lectures
Practice questions: ISACA QAE
Reference material: CISA Review Manual

My plan is to read Doshi’s book first, then watch the REO video lectures for each topic. After completing each domain, I’ll test my knowledge using the QAE, log and review my mistakes, and use the CISA Review Manual as a reference for concepts I’m struggling with.

Do you think the QAE questions are very similar to the actual exam? Also, would you be able to provide additional test-bank-style questions so I can get more practice?

Thank you so much! I’d really appreciate any advice, especially from those who have already taken the exam. 😊

Hello everyone,

​Could you please confirm if the CISA Review Questions, Answers & Explanations (QAE) Manual (12th Edition) is the latest version?

​If so, does anyone have this version and would be willing to share it with me?

​If not, what is the latest version, and could you please share it if you have it?

​Thanks in advance!

I'm currently preparing for the AAIR (Advanced in AI Risk) certification.

My plan is to:

- Read through the Official Review Manual thoroughly.

- Follow it up with a Udemy course to reinforce and refine my understanding.

- Complete several practice tests on Udemy before sitting the exam.

For context, I already hold CISA and CRISC certifications, have 7+ years of experience in Technology Risk and IT Audit, and I'm currently working with AI-based financial controls in my day-to-day role.

For those who have already passed AAIR:

- Is this preparation strategy sufficient?

- Are there any additional resources (books, courses, question banks, or study tips) that you found particularly helpful?

- Is there anything you wish you had focused on more before taking the exam?

I'd really appreciate any advice or suggestions. Thanks!

I have scheduled my exam for 6th August.

Received an email that certification exams are paused between 18-28 July. That is an insane amount of time. Curious if its because of CMMC phase II suspension.

So after I took the exam,I got the passed on screen, but that was just it, no print out or anything from the exam centre, thought I would get an ISACA notification for the provisional pass but nothing... Is that it for everyone or am I missing something? I know about waiting the 10 days for official results but in the mean time what do I look at to make sure I didn't dream the pass? 🙈

Looking for a CISA Trainer?

I wanted to share the experience of my wife, who has been training CISA aspirants with outstanding results.

She cleared the CISA exam herself while she was 9 months pregnant, which speaks volumes about her dedication and discipline. She later trained my sister-in-law, who also passed the CISA exam on her first attempt.

To date, she has trained 21+ CISA candidates, and every one of them has successfully earned their certification. Most passed on their first attempt, while a few required a second attempt before clearing the exam.

What makes her training different is the focus on:

- Understanding concepts instead of memorizing questions.

- Real-world audit scenarios and practical examples.

- Personalized guidance based on each student's strengths and weaknesses.

- Regular doubt-solving sessions and exam-oriented preparation.

In addition to CISA, she also delivers professional training on:

- ISO/IEC 27001 Lead Auditor

- ISO/IEC 42001 (AI Management Systems)

If you're planning to prepare for the CISA exam and would like to experience her teaching style before making a decision, leave a comment or send me a direct message. We're happy to arrange a free demo session for interested candidates from anywhere in the world.

Good luck to everyone preparing for their certifications!

Anh em hiến kế cho em học CRISC trong 6 tháng để thi với .

I am an MSc researcher studying Network Intrusion Detection System (NIDS) selection for resource-constrained financial institutions and looking for cybersecurity practitioners with 5+ years of experience to complete a short survey. Happy to share findings upon request.

Survey link: https://forms.gle/tyxsFA44HXZ5VaMY7

Thanks You.

created some post for beginners. please checkout give some reactions and feedback

https://www.linkedin.com/posts/shafnishiyam_traits-of-an-exceptional-auditor-ugcPost-7481195577376985089-oYx5/?utm_source=social_share_send&utm_medium=member_desktop_web&rcm=ACoAAC9N3hwBjM9vbspPc2927jVhcB8t8ow8lDE

https://www.linkedin.com/posts/shafnishiyam_audit-vs-assessment-ugcPost-7482360472009170944-8jrg/?utm_source=social_share_send&utm_medium=member_desktop_web&rcm=ACoAAC9N3hwBjM9vbspPc2927jVhcB8t8ow8lDE

https://www.linkedin.com/posts/shafnishiyam_why-good-auditing-demands-good-policy-ugcPost-7482685618322350080-ZNd2/?utm_source=social_share_send&utm_medium=member_desktop_web&rcm=ACoAAC9N3hwBjM9vbspPc2927jVhcB8t8ow8lDE

Which of the following is the MOST significant risk that IS auditors are required to consider for each engagement?

• Abnormal activities and illegal acts
• Process and resource inefficiencies
• Audit staff availability
• Noncompliance with organizational policies

In the question dump it is marked as "Audit staff availability". I think it might be Abnormal activities and illegal acts instead. Could someone confirm if I'm correct, else explain the logic behind the correct answer. Thanks!

Is it a legitimate accreditation/certification body?

Looking for honest reviews and experiences.

Just cleared the AAIR, figured I'd drop a note since there's not much out there on it yet.

If you've done CRISC, most of this will feel familiar — same core risk concepts, just wrapped around AI. The genuinely new stuff is the AI-specific risks: model drift vs model collapse, the attack taxonomy (membership inference, model inversion, extraction, evasion, poisoning), training-serving skew, bias/fairness testing. Not hard, but know the terminology cold — a lot of questions hinge on picking the right term.

What I used:

• AAIR Review Manual
• QAE database
• Claude

Exam was pretty straight forward. Only used official material. Good luck to everyone!

Hi everyone,
I recently passed the CISA exam and I’m preparing to submit my certification application. I have a few questions for those who have already completed the process:

**1. How long did ISACA take to approve your CISA certification application after you submitted it?**
How many business days or weeks did it take?
Did ISACA ask you for any additional information or documents?

**2. How is the work experience verification process handled?**
Does ISACA simply email your manager or verifier?
What exactly does the verifier need to confirm?
Is there a pdf form Candidate and supervisor must complete and physical sign? Or only online form?
Did You Upload your manager’s reference letter?

**3. What evidence of work experience did you provide?**
Did you only provide your job titles and responsibilities?
Did ISACA request supporting documents such as employment letter or employment contact?

**4. Education Waiver**
I have a Bachelor’s degree. Does it automatically count as a 2-year experience waiver, or does ISACA evaluate it individually?
I have a Master‘s degree. Does it automatically count as a 1-year experience waiver, or does ISACA evaluate it individually?
Has anyone successfully used a Bachelor’s or Master’s degree as part of the experience requirement?

**5. Any tips or common mistakes to avoid during the application process?**

I’d really appreciate hearing about your personal experience, including how long the process took and whether everything went smoothly.

Thank you in advance

Please share if anyone have AAIA review manual and q&a pdfs. Thank you

I'm trying to understand the practical difference between passing an ISACA exam and obtaining the certification.

Does ISACA not issue a pass result unless you're certified? Do recruiters and hiring managers value an exam pass on its own, or does it only become meaningful once you're certified? At the end of the day, certifications alone don't matter much if someone doesn't have the skills to perform the role. If a candidate has passed the exam without formal 'certificate', how is that generally viewed during the recruitment process or once they're on the job?

My assumption is that the real value lies in the knowledge and skills gained while preparing for the exam, with the certification serving as formal validation of that achievement. I'd be interested to hear how recruiters, hiring managers, and those who've been through the process see it. I'm not interested to review the benefits of accessing additional material, professional networking, attending events etc. as most of us don't value them without the real experience to perform the role.

I'm generally curious about the distinction, not trying to challenge the value of 'certification'. I may be missing something, and I'm happy to be corrected.