content/blog/2021-12-04-cisa.org
206 lines · 10022 bytes
1#+date: <2021-12-04 Sat 00:00:00>
2#+title: Guidelines for Successfully Completing the Certified Information Systems Auditor Examination
3#+description: Comprehensive outline of study materials, preparation strategies, and procedural advice for passing the CISA examination on the initial attempt.
4#+slug: cisa
5#+filetags: :CISA:certification:audit:
6
7* What is the CISA?
8
9For those of you lucky enough not to be knee-deep in the world of IT/IS
10Auditing, [[https://www.isaca.org/credentialing/cisa][CISA]] stands for
11Certified Information Systems Auditor. This certification and exam are
12part of ISACA's suite of certifications. As I often explain it to people
13like my family, it basically means you're employed to use your knowledge
14of information systems, regulations, common threats, risks, etc. in
15order to assess an organization's current control of their risk. If a
16risk isn't controlled (and the company doesn't want to accept the risk),
17an IS auditor will suggest implementing a control to address that risk.
18
19Now, the CISA certification itself is, in my opinion, the main
20certification for this career. While certifications such as the CPA or
21CISSP are beneficial, nothing matches the power of the CISA for an IS
22auditor when it comes to getting hired, getting a raise/bonus, or
23earning respect in the field.
24
25However, to be honest, I am a skeptic of most certifications. I
26understand the value they hold in terms of how much you need to commit
27to studying or learning on the job, as well as the market value for
28certifications such as the CISA. But I also have known some very
29+incompetent+ /less than stellar/ auditors who have CPAs, CISAs, CIAs,
30etc.
31
32The same goes for most industries: if a person is good at studying, they
33can earn the certification. However, that knowledge means nothing unless
34you're actually able to use it in real life and perform as expected of a
35certification holder. The challenge comes when people are hired or
36connected strictly because of their certifications or resume; you need
37to see a person work before you can assume them having a CISA means
38they're better than someone without the CISA.
39
40Okay, rant over. Certifications are generally accepted as a measuring
41stick of commitment and quality of an employee, so I am accepting it
42too.
43
44* Exam Content
45
46The CISA is broken down into five sections, each weighted with a
47percentage of test questions that may appear.
48
49Since the exam contains 150 questions, here's how those sections break
50down:
51
52| Exam Section | Percentage of Exam | Questions |
53|---------------+--------------------+-----------|
54| 1 | 21% | 32 |
55| 2 | 17% | 26 |
56| 3 | 12% | 18 |
57| 4 | 23% | 34 |
58| 5 | 27% | 40 |
59| *Grand Total* | *100%* | *150* |
60
61* My Studying Habits
62
63This part is a little hard for me to break down into specific detail due
64to the craziness of the last year. While I officially purchased my
65studying materials in December 2020 and opened them to "start studying"
66in January 2021, I really wasn't able to study much due to the demands
67of my job and personal life.
68
69Let me approach this from a few different viewpoints.
70
71** Study Materials
72
73Let's start by discussing the study materials I purchased. I'll be
74referring to #1 as the CRM and #2 as the QAE.
75
761. [[https://store.isaca.org/s/store#/store/browse/detail/a2S4w000004KoCbEAK][CISA
77 Review Manual, 27th Edition | Print]]
782. [[https://store.isaca.org/s/store#/store/browse/detail/a2S4w000004KoCcEAK][CISA
79 Review Questions, Answers & Explanations Manual, 12th Edition |
80 Print]]
81
82The CRM is an excellent source of information and could honestly be used
83as a reference for most IS auditors as a learning reference during their
84daily audit responsibilities. However, it is *full* of information and
85can be overloading if you're not good at filtering out useless
86information while studying.
87
88The QAE is the real star of the show here. This book contains 1000
89questions, separated by exam section, and a practice exam. My only
90complaint about the QAE is that each question is immediately followed
91with the correct answer and explanations below it, which means I had to
92use something to constantly cover the answers while I was studying.
93
94I didn't use the online database version of the QAE, but I've heard that
95it's easier to use than the printed book. However, it is more expensive
96($299 database vs $129 book) which might be important if you're paying
97for materials yourself.
98
99In terms of question difficulty, I felt that the QAE was a good
100representation of the actual exam. I've seen a lot of people online say
101it wasn't accurate to the exam or that it was much easier/harder, but I
102disagree with all of those. The exam was fairly similar to the QAE, just
103focusing on whichever topics they chose for my version of the exam.
104
105If you understand the concepts, skim the CRM (and read in-depth on
106topics you struggle with), and use the QAE to continue practicing
107exam-like questions, you should be fine. I didn't use any online
108courses, videos, etc. - the ISACA materials are more than enough.
109
110** Studying Process
111
112While I was able to briefly read through sections 1 and 2 in early 2021,
113I had to stop and take a break from February/March to September. I
114switched jobs in September, which allowed me a lot more free time to
115study.
116
117In September, I studied sections 3-5, took notes, and did a quick review
118of the section topics. Once I felt comfortable with my notes, I took a
119practice exam from the QAE manual and scored 70% (105/150).
120
121Here's a breakdown of my initial practice exam:
122
123| Exam Section | Incorrect | Correct | Grand Total | Percent |
124|---------------+-----------+---------+-------------+---------|
125| 1 | 8 | 25 | 33 | 76% |
126| 2 | 5 | 20 | 25 | 80% |
127| 3 | 6 | 12 | 18 | 67% |
128| 4 | 10 | 23 | 33 | 70% |
129| 5 | 16 | 25 | 41 | 61% |
130| *Grand Total* | *45* | *105* | *150* | *70%* |
131
132As I expected, my toughest sections were related to project management,
133development, implementation, and security.
134
135This just leaves October and November. For these months, I tried to
136practice every few days, doing 10 questions for each section, until the
137exam. This came out to 13 practice sessions, ~140 questions per section,
138and ~700 questions total.
139
140While some practice sessions were worse and some were better, the final
141results were similar to my practice exam results. As you can see below,
142my averages were slightly worse than my practice exam. However, I got in
143over 700 questions of practice and, most importantly, /I read through
144the explanations every time I answered incorrectly and learned from my
145mistakes/.
146
147| Exam Section | Incorrect | Correct | Grand Total | Percent |
148|---------------+-----------+---------+-------------+---------|
149| 1 | 33 | 108 | 141 | 77% |
150| 2 | 33 | 109 | 142 | 77% |
151| 3 | 55 | 89 | 144 | 62% |
152| 4 | 52 | 88 | 140 | 63% |
153| 5 | 55 | 85 | 140 | 61% |
154| *Grand Total* | *228* | *479* | *707* | *68%* |
155
156* Results
157
158Now, how do the practice scores reflect my actual results? After all,
159it's hard to tell how good a practice regimen is unless you see how it
160turns out.
161
162| Exam Section | Section Name | Score |
163|--------------+------------------------------------------------------------------+-------|
164| 1 | Information Systems Auditing Process | 678 |
165| 2 | Governance and Management of IT | 590 |
166| 3 | Information Systems Acquisition, Development, and Implementation | 721 |
167| 4 | Information Systems Operations and Business Resilience | 643 |
168| 5 | Protection of Information Assets | 511 |
169
170Now, in order to pass the CISA, you need at least 450 on a sliding scale
171of 200-800. Personally, I really have no clue what an average CISA score
172is. After a /very/ brief look online, I can see that the high end is
173usually in the low 700s. In addition, only about 50-60% of people pass
174the exam.
175
176Given this information, I feel great about my scores. 616 may not be
177phenomenal, and I wish I had done better on sections 2 & 5, but my
178practicing seems to have worked very well overall.
179
180However, the practice results do not conform to the actual results.
181Section 2 was one of my highest practice sections and was my
182second-lowest score in the exam. Conversely, section 3 was my
183second-lowest practice section and turned out to be my highest actual
184score!
185
186After reflecting, it is obvious that if you have any background on the
187CISA topics at all, the most important part of studying is doing
188practice questions. You really need to understand how to read the
189questions critically and pick the best answer.
190
191* Looking Forward
192
193I am extremely happy that I was finally able to pass the CISA. Looking
194to the future, I'm not sure what's next in terms of professional
195learning. My current company offers internal learning courses, so I will
196most likely focus on that if I need to gain more knowledge in certain
197areas.
198
199To be fair, even if you pass the CISA, it's hard to become an expert on
200any specific topic found within. My career may take me in a different
201direction, and I might need to focus more on security or networking
202certifications (or possibly building a better analysis/visualization
203portfolio if I want to go into data analysis/science).
204
205All I know is that I am content at the moment and extremely proud of my
206accomplishment.