Failed CISA (Certified Information Systems Auditor)? Here's Your Recovery Plan

Pro tip: ISACA offers a free QAE database to members.

• Answering as a practitioner instead of an auditor. Candidates from engineering and security backgrounds pick the answer that fixes the technical problem, when CISA questions usually want the auditor action: assess, evaluate, review, report, or recommend.
  Before choosing, ask what an independent auditor is permitted to do. Auditors do not implement controls or remediate findings. If an option has you configuring something, it is almost certainly wrong.
• Missing the qualifier. ISACA writes stems with BEST, MOST, FIRST, and GREATEST, and several options will be defensible. Reading past the qualifier turns a question you know into a coin flip.
  Read the last line of the stem twice and note the qualifier before looking at the options. On FIRST questions, sequence matters: risk assessment usually precedes control selection, and scoping precedes fieldwork.
• Treating the 12 percent Domain 3 as equal in effort to the 26 percent Domain 4 and Domain 5. Roughly 78 items on a 150-question form come from operations, resilience, and protection of information assets combined.
  Allocate study hours in proportion to the published weights. Domains 4 and 5 together are 52 percent of the exam, which justifies more than half your preparation time before you look at anything else.
• Leaving questions blank or dwelling on one item. There is no penalty for a wrong answer, and 240 minutes across 150 questions leaves 96 seconds each with no slack for a five-minute standoff.
  Answer everything, even a guess. Flag and move on at the two-minute mark, then use the remaining time on flagged items. ISACA scores only the total number of items answered correctly.
• Assuming a pass makes you certified. Passing the exam is one of six requirements, and the certification does not exist until you pay the US$50 application fee and get five years of experience verified by a supervisor or manager.
  Line up your experience verification before you sit the exam. Confirm which supervisors will sign, and check that the work falls within the ten-year window before the application date. You have five years from passing to apply, but chasing signatures from former employers gets harder every year.
• Letting the six-month exam eligibility lapse. Eligibility starts at registration, not at scheduling, and ISACA forfeits both the eligibility and the registration fee if you do not sit within the window.
  Schedule a date as soon as you register even if you plan to move it. Rescheduling is free more than 48 hours out. If you genuinely need longer, buy the one available six-month extension for US$75 before eligibility expires, and cancel any scheduled appointment at least 48 hours ahead first.
• Learning recovery objectives loosely. Domain 4 questions distinguish RTO, RPO, MTD, and service delivery objectives precisely, and a vague grasp turns several straightforward items into guesses.
  Write the definitions and then work numeric scenarios. Given a four-hour RTO and a one-hour RPO, be able to say exactly what backup frequency and recovery site type the organization needs, and what the auditor should test.
• Preparing entirely from a question bank. High scores on repeated QAE questions reflect memory of those items rather than command of the domain, and the real exam rephrases everything.
  Use the Review Manual as the primary source and the QAE database as diagnostic. Read the explanation for every question, including ones you answered correctly, because the reasoning is what transfers.
• Arriving without the right identification. ISACA requires a single current, valid, original government-issued ID showing name, signature, and photograph, with the name matching your registration exactly. Digital IDs and photocopies are rejected.
  Check your ISACA profile name against your passport or licence weeks in advance and update it in MyISACA if it differs. Being turned away counts as a no-show, forfeits the fee, and means paying full price again.

• Focus on IS audit process and standards
• Study IT governance and management
• Understand risk management frameworks
• Heavy focus on controls and compliance
• ISACA Review Manual is essential
• 5+ years experience recommended