cmc/cleberg.net

  1#+date:        [2021-12-04 Sat 00:00:00]
  2#+title:       I Passed the CISA Exam
  3#+description: My take on the CISA exam: what it covers, and what it doesn't.
  4#+slug:        cisa
  5#+filetags:    :audit:
  6
  7* What is the CISA?
  8
  9For those of you lucky enough not to be knee-deep in the world of information
 10technology (IT) and information systems (IS) auditing, the [[https://www.isaca.org/credentialing/cisa][CISA]] (Certified
 11Information Systems Auditor) certification and exam are part of ISACA's suite of
 12certifications. As I often explain it to people like my family, it basically
 13means you're employed to use your knowledge of information systems, regulations,
 14common threats, risks, etc. in order to assess an organization's current control
 15of their risk. If a risk isn't controlled (and the company doesn't want to
 16accept the risk), an IS auditor will suggest implementing a control to address
 17that risk.
 18
 19Now, the CISA certification itself is, in my opinion, the main certification for
 20this career. While certifications such as the CPA (Certified Public Accountant)
 21or CISSP (Certified Information Systems Security Professional) are beneficial,
 22nothing matches the power of the CISA for an IS auditor when it comes to getting
 23hired, getting a raise/bonus, or earning respect in the field.
 24
 25However, to be honest, I am a skeptic of most certifications. I understand the
 26value they hold in terms of how much you need to commit to studying or learning
 27on the job, as well as the market value for certifications such as the CISA. But
 28I also have known some very +incompetent+ /less than stellar/ auditors who have
 29relevant certifications.
 30
 31The same goes for most industries: if a person is good at studying, they can
 32earn the certification. However, that knowledge means nothing unless you're
 33actually able to use it in real life and perform as expected of a certification
 34holder. The challenge comes when people are hired or connected strictly because
 35of their certifications or resume; you need to see a person work before you can
 36assume them having a CISA means they're better than someone without the CISA.
 37
 38Okay, rant over. Certifications are generally accepted as a measuring stick of
 39commitment and quality of an employee, so I am accepting it too.
 40
 41* Exam Content
 42
 43The CISA is broken down into five sections, each weighted with a percentage of
 44test questions that may appear.
 45
 46Since the exam contains 150 questions, here's how those sections break down:
 47
 48|  Exam Section | Percentage of Exam | Questions |
 49|---------------+--------------------+-----------|
 50|             1 |                21% |        32 |
 51|             2 |                17% |        26 |
 52|             3 |                12% |        18 |
 53|             4 |                23% |        34 |
 54|             5 |                27% |        40 |
 55| *Grand Total* |             *100%* |     *150* |
 56
 57* My Studying Habits
 58
 59This part is a little hard for me to break down into specific detail due to the
 60craziness of the last year. While I officially purchased my studying materials
 61in December 2020 and opened them to "start studying" in January 2021, I really
 62wasn't able to study much due to the demands of my job and personal life.
 63
 64Let me approach this from a few different viewpoints.
 65
 66** Study Materials
 67
 68Let's start by discussing the study materials I purchased. I'll be referring to
 69#1 as the CRM (CISA Review Manual) and #2 as the QAE (Questions, Answers &
 70Explanations).
 71
 721. [[https://store.isaca.org/s/store#/store/browse/detail/a2S4w000004KoCbEAK][CISA Review Manual, 27th Edition | Print]]
 732. [[https://store.isaca.org/s/store#/store/browse/detail/a2S4w000004KoCcEAK][CISA Review Questions, Answers & Explanations Manual, 12th Edition | Print]]
 74
 75The CRM is an excellent source of information and could honestly be used as a
 76reference for most IS auditors as a learning reference during their daily audit
 77responsibilities. However, it is *full* of information and can be overloading if
 78you're not good at filtering out useless information while studying.
 79
 80The QAE is the real star of the show here. This book contains 1000 questions,
 81separated by exam section, and a practice exam. My only complaint about the QAE
 82is that each question is immediately followed with the correct answer and
 83explanations below it, which means I had to use something to constantly cover
 84the answers while I was studying.
 85
 86I didn't use the online database version of the QAE, but I've heard that it's
 87easier to use than the printed book. However, it is more expensive ($299
 88database vs $129 book) which might be important if you're paying for materials
 89yourself.
 90
 91In terms of question difficulty, I felt that the QAE was a good representation
 92of the actual exam. I've seen a lot of people online say it wasn't accurate to
 93the exam or that it was much easier/harder, but I disagree with all of those.
 94The exam was fairly similar to the QAE, just focusing on whichever topics they
 95chose for my version of the exam.
 96
 97If you understand the concepts, skim the CRM (and read in-depth on topics you
 98struggle with), and use the QAE to continue practicing exam-like questions, you
 99should be fine. I didn't use any online courses, videos, etc. - the ISACA
100materials are more than enough.
101
102** Studying Process
103
104While I was able to briefly read through sections 1 and 2 in early 2021, I had
105to stop and take a break from February/March to September. I switched jobs in
106September, which allowed me a lot more free time to study.
107
108In September, I studied sections 3-5, took notes, and did a quick review of the
109section topics. Once I felt comfortable with my notes, I took a practice exam
110from the QAE manual and scored 70% (105/150).
111
112Here's a breakdown of my initial practice exam:
113
114|  Exam Section | Incorrect | Correct | Grand Total | Percent |
115|---------------+-----------+---------+-------------+---------|
116|             1 |         8 |      25 |          33 |     76% |
117|             2 |         5 |      20 |          25 |     80% |
118|             3 |         6 |      12 |          18 |     67% |
119|             4 |        10 |      23 |          33 |     70% |
120|             5 |        16 |      25 |          41 |     61% |
121| *Grand Total* |      *45* |   *105* |       *150* |   *70%* |
122
123As I expected, my toughest sections were related to project management,
124development, implementation, and security.
125
126This just leaves October and November. For these months, I tried to practice
127every few days, doing 10 questions for each section, until the exam. This came
128out to 13 practice sessions, ~140 questions per section, and ~700 questions
129total.
130
131While some practice sessions were worse and some were better, the final results
132were similar to my practice exam results. As you can see below, my averages were
133slightly worse than my practice exam. However, I got in over 700 questions of
134practice and, most importantly, /I read through the explanations every time I
135answered incorrectly and learned from my mistakes/.
136
137|  Exam Section | Incorrect | Correct | Grand Total | Percent |
138|---------------+-----------+---------+-------------+---------|
139|             1 |        33 |     108 |         141 |     77% |
140|             2 |        33 |     109 |         142 |     77% |
141|             3 |        55 |      89 |         144 |     62% |
142|             4 |        52 |      88 |         140 |     63% |
143|             5 |        55 |      85 |         140 |     61% |
144| *Grand Total* |     *228* |   *479* |       *707* |   *68%* |
145
146* Results
147
148Now, how do the practice scores reflect my actual results? After all, it's hard
149to tell how good a practice regimen is unless you see how it turns out.
150
151| Exam Section | Section Name                                                     | Score |
152|--------------+------------------------------------------------------------------+-------|
153|            1 | Information Systems Auditing Process                             |   678 |
154|            2 | Governance and Management of IT                                  |   590 |
155|            3 | Information Systems Acquisition, Development, and Implementation |   721 |
156|            4 | Information Systems Operations and Business Resilience           |   643 |
157|            5 | Protection of Information Assets                                 |   511 |
158
159Now, in order to pass the CISA, you need at least 450 on a sliding scale of
160200-800. Personally, I really have no clue what an average CISA score is. After
161a /very/ brief look online, I can see that the high end is usually in the low
162700s. In addition, only about 50-60% of people pass the exam.
163
164Given this information, I feel great about my scores. 616 may not be phenomenal,
165and I wish I had done better on sections 2 & 5, but my practicing seems to have
166worked very well overall.
167
168However, the practice results do not conform to the actual results. Section 2
169was one of my highest practice sections and was my second-lowest score in the
170exam. Conversely, section 3 was my second-lowest practice section and turned out
171to be my highest actual score!
172
173After reflecting, it is obvious that if you have any background on the CISA
174topics at all, the most important part of studying is doing practice questions.
175You really need to understand how to read the questions critically and pick the
176best answer.
177
178* Looking Forward
179
180I am extremely happy that I was finally able to pass the CISA. Looking to the
181future, I'm not sure what's next in terms of professional learning. My current
182company offers internal learning courses, so I will most likely focus on that if
183I need to gain more knowledge in certain areas.
184
185To be fair, even if you pass the CISA, it's hard to become an expert on any
186specific topic found within. My career may take me in a different direction, and
187I might need to focus more on security or networking certifications (or possibly
188building a better analysis/visualization portfolio if I want to go into data
189analysis/science).
190
191All I know is that I am content at the moment and extremely proud of my
192accomplishment.