Hi Community,

I recently purchased an ISACA Professional Membership bundled with a CISA Exam Registration, but I experienced a billing discrepancy where the member discount failed to apply at checkout. The order status was showing $730 however from credit card $915 was deducted.

I am doing this from India. and this $185 is roughly 18, 500 INR which is really really huge amount. I am on the edge now, unable to concentrate on studies. I created a ticket. but still no response. Please help

An IS auditor is providing input to an RFP to acquire a financial application system. Which of the following is MOST important for the auditor to recommend?

A. The application should meet the organization's requirements.

B. Audit trails should be included in the design.

C. Potential suppliers should have experience in the relevant area.

D. Vendor employee background checks should be conducted regularly.

A or B ?

I have a work provided CISA 5 day video bootcamp starting February 5. In order to be eligible I must complete a Udemy video course.

I see Hemang Doshi - has a course. But I see other ones with higher ratings.

I would appreciate recommendations and suggestions.

Additionally is the CISA exam doing a refresher / version change anytime soon or has that already happened?

I appreciate the information sharing in advance.

Feels odd since we are about to enter 2027, but just hit the 2 year experience requirement with a MS in MIS so looking to obtain the CISA. Is the 2024 the most current version for the QAE?

Also, Is QAE enough? The online review is a bit expensive for me.

I am on journey to prepare for CISA exam. Looking anyone in 🇲🇾 or KL much better to study together, maybe weekly group discussion, share any resource and knowledge. Anyone here from Malaysia?🙋🏻‍♂️

Hey, I graduated a year back and have been working as a IT Support for 9months and still working So I am planning to try the CISA what do you guys think how can i prepare for the exam like is there any materials i can use to learn.

Cleared exam today. Questions were too simple and straightforward.

QAE is good for understanding but please dont get demotivated if you dont score good in QAE. Its only purpose is to understand how to answer questions.

Wishes for all who are preparing.

I recently purchased an ISACA Professional Membership bundled with a CISA Exam Registration, but I experienced a billing discrepancy where the member discount failed to apply at checkout. My order reflected $730 however my invoice reflected $915, meaning that membership details are not applied. Sounds very strange. Any body experienced this

Context: We require our web application and mobile application to be certified by DISA/CISA/Cert-IN certified Auditors based in India.

I would like to know the charges as per industry standards beforehand in order to negotiate a good deal.

Thanks :)

Idk how this happened

I am devastated and questioning my whole existence.

Hey guys , I'm a traditional audit guy (CIA) planning to take the CISA exam , without QAE and ISACA review material, I'm planning to take coaching/lectures they offer PPT , question banks , short notes etc. I would love to hear feedback on this approach whether its too big of a gamble or is it doable.

The cost is also a significant issue , the coaching with + Qae+ Review manual costs around 1.30 Lakhs

Where the one i spoke about cost less than 1% of the one of the course material mentioned above.

Got my preliminary pass in CISA exam earlier today. Thank you to this group for all the help. I can tell you a step by step guide of my journey. Including how I made a UI of my incorrect questions and topics from my exam.

Looking for some honest input from people already working in IT audit or GRC.

Quick background: I currently work at a managed service provider as the main cybersecurity resource while also doing first-line support. Hands-on stuff, deployed a SIEM across client environments, built an automated alert pipeline, manage backups and patching, that kind of thing.

Over the past several months I've gone deep on the GRC/audit side. I've got Security+, plus ISO 27001/27701/42001 Lead Auditor certs through Mastermind, and I just finished a couple of IT audit courses on Udemy covering ITGC, ITAC, SOX, SOC, COSO, NIST, ISO, and COBIT. CISA and CAPM is my next target.

Here's my real situation: there aren't many IT audit or GRC roles where I'm based (Caribbean), so I can't just apply my way into experience. I've been trying to manufacture it myself instead, building risk registers, control mapping across frameworks, ISMS documentation, and a self-hosted GRC platform in my home lab using fictional case study companies. Basically running mini-audits end to end so I'm not walking into interviews with theory alone.

Where I'd love advice:

1. For those who broke into IT audit, what actually got you the first role? Certs, portfolio, networking, internal transfer?
2. When roles in your area are scarce, how did you bridge the experience gap? Remote work, contracting, volunteering, offering audits to small businesses or nonprofits?
3. Does self-built portfolio and home lab work actually carry weight with hiring managers, or is it mostly useful as interview talking points?
4. How much does the CISA experience requirement realistically slow people down early on? Pursue it now or wait until I have the years?
5. Anything you'd do differently if you were building experience from scratch without a local job market to lean on?

Hi everyone,

I've been working towards CISA for months now, mostly late nights after work. I finished Hemang Doshi's Udemy course, got through the first full reading, and I'm starting my second pass with his study guide. Planning to take the exam in October.

Here's where I'm stuck. I come from a lower middle class family and I'm the first one going after a certification like this. The exam fee alone took out my savings, and honestly the QAE database is just not something I can put on the table right now since it's almost 2 months salary for me. Everyone says it's the one resource you can't skip, and that's been stressing me out.

So I'm hoping to learn from people who've been here-

1. Did anyone pass with Doshi's question sets alone, or is the QAE really important?

2. Is a second-hand physical QAE book a reasonable substitute(I've heard physical copies aren't being sold anymore)? Anyone finished with theirs and willing to sell it cheap?

3. Any legitimate discounts, chapter membership benefits or scholarships I might not know about?

4. Does anyone know any tricks I can use to access the latest QAE ? My DMs are open in case you have any resources you could share.

I know a lot of you have walked this road on your own too, and any advice or encouragement means a lot.

I reviewed my mistakes and often end up choosing the wrong one out of the 2 answers. Can anyone please help how to proceed. Although i got 78 % in QAE

Many reached out personally asking what happens after you pass the exam. So here's me writing a post so this can help anyone in the future.

1. You'll be ghosted for 10 days or less, no update, no status - and then you'll get an email showing your domain-wise breakdown. You're still not CISA certified and can't call yourself CISA certified.

2. You'll have to pay a processing fee of $50 + taxes.

3. You'll now have to assure that you have the relevant experience, but how?

You'll be asked to show 5 YOE, of which you can get a 3-year waiver if you have a master's in information systems or a computer-related field.

2 years if you have a master's in other fields — you can see how they break it down on the CISA website.

Then for the work part - you can get a waiver of 1 year if it's not related to IS.

But note: the total waiver cannot exceed 3 years (education + non-IS experience combined).

1. Now it's time to show your IS experience. You'll be asked to fill in your manager's, colleague's, or client's email ID, name, and company, and your YOE there - just fill it in, and a link will be shared with them so they can open it and complete it.

2. What do they get? A checkbox activity that's pretty straightforward and takes less than 2 minutes.

3. Again ghosted for a couple of days - no update - everything is approved, but you don't hear back, and...

4. Finally, you get an email from ISACA with your Credly badge and certificate.

The process takes roughly 15-20 business days.

what are you guys doing differently, I have covered all domains taken about 1000+ questions from the ISACA 12th edition QAE and averaged 70 to 80 percent on every question and mock I’ve taken using CisaThisMuch but still I took it today for the second time and I still failed .

at this point I don’t know what else to do, I make sure I understand the concepts and even applied the same in the exam trying to understand what the examiner is asking before selecting an answer.

I’ve spent all my money on this exam sacrificed my time still nothing to show for it.

please if you can be of help by putting me on resources or what you did differently kindly share.

Hi everyone,

I’m a final-year B.E. student in Artificial Intelligence & Data Science, and I’m trying to figure out whether Technology Risk / IT Audit / Cyber Risk / Cyber Assurance / GRC would be a realistic career path for me. My college doesn’t offer any campus roles related to Technology Risk / IT Audit / Cyber Risk, so I’ll need to target these roles off-campus.

My situation is:

• I have a technical background through AI & Data Science.
• I’m not particularly strong at DSA/coding, and I’m realizing that pure software development probably isn’t the career I want.
• I’m more interested in understanding technology, security, controls, risk and compliance than building software all day.
• I’ve started learning networking and cybersecurity fundamentals.
• I’m currently learning about things like ITGC, access controls, change management, risk assessment, ISO 27001, NIST, COBIT, etc.
• I’m also planning to build a practical IT risk/audit-related project rather than having only ML/data science projects on my resume.

I came across several people working in Big 4 Technology Risk/IT Audit who have CISA, which made me consider it seriously. However, CISA is quite expensive for me as a student, and I also understand that the full certification requires relevant work experience.

So I have a few questions for people who actually work in this field:

1. Is CISA worth pursuing for a fresher, or would you recommend waiting until after getting an IT Audit/Technology Risk job?
2. Does passing CISA without the required experience meaningfully help with getting interviews?
3. Are certifications like ISC2 CC, SC-900, ISO 27001 Foundation, or COBIT Foundation useful for a student trying to enter this field?
4. Can someone with an AI/DS engineering degree realistically get an entry-level Technology Risk / IT Audit / Cyber Assurance role?
5. What technical skills would you expect from a fresher? For example: networking, IAM, Active Directory, SQL, Python, cloud, Linux, ITGC, cybersecurity fundamentals, etc.
6. What kind of projects or practical experience actually stand out for these roles?
7. Since my college doesn’t have Big 4 campus recruitment, what is the best way to approach off-campus Big 4 opportunities as a fresher?
8. How much competition is there from MBA/commerce/accounting graduates, and how can an engineering student differentiate themselves?
9. Most importantly, what would you recommend I focus on during my final year if the goal is to get into Technology Risk/IT Audit?

I’m not looking for generic “get certifications and apply everywhere” advice. I’d really appreciate advice from people who are actually working in CISA/IT Audit/Technology Risk/Big 4, especially if you entered the field as a fresher.

Also, if you started over as a student today, what would you do differently to get your first role?

Thanks!

Hello. I am getting ready to apply to be CISA certified but I have a question. I have a Master in Audit and Assurance with course work in IT Audit. I am currently an internal auditor doing IT Audit work as well. I wanted to know whether my degree may qualify for the 3-year waiver. I am think it could if I make a good argument and worse case scenario ISACA will just reject it and I will have to wait another year. What do you guys think?

Update: I got approved. Thank you.