Exam Tactics & Question Strategy
Read this once in Week 1 and again in Week 11. It is not about knowledge — it is about converting the knowledge you have into marks.
1. The single biggest reason people fail CISA
It is almost never a knowledge gap. It is that they answer as an IT professional instead of as an IS auditor.
The exam asks: "What should the IS auditor do?" Most candidates answer: "What would I do to fix this?"
Those are different questions, and only one of them scores.
| The IT professional's instinct | The IS auditor's answer |
|---|---|
| Fix the control | Assess and report the control |
| Design a better process | Evaluate the process against criteria |
| Tell them which firewall to buy | Recommend a risk-based control objective |
| Escalate to my manager | Report to the audit committee / those charged with governance |
| Investigate the fraud | Preserve evidence, escalate, involve legal and specialists |
| Accept the risk | Note that risk acceptance is the business owner's decision |
| Implement the tool | Verify the tool is configured, used, and monitored |
Memorise this: the IS auditor evaluates, advises, and reports. The IS auditor does not design, implement, operate, approve, or own anything. Every time you are stuck between two answers, ask which one keeps the auditor in the auditor's seat.
2. The seven rules that resolve most ambiguous questions
When two options both look defensible, run them through this list in order. The first rule that separates them usually gives you the answer.
- Auditor ≠ doer. Eliminate any option where the auditor implements, designs, configures, approves or owns. "The auditor should design the control" is always wrong.
- Risk first. If one option is "perform a risk assessment" or "assess the risk" and the question is about a new technology, new regulation, or a decision point, that is very often the answer. You cannot control what you have not assessed.
- Strategy before tactics. Governance/direction/approval options beat operational/technical options when the question is at a management or board level. Read the level of the question.
- Report, don't act. If something is wrong and the auditor has already identified it, the answer is usually to report it (to management, then the audit committee), not to personally intervene.
- The business owns risk; IT owns systems; audit owns assurance. Match the owner to the question. The BIA owner is the business. The risk owner is the business. The data owner is the business.
- Prevention is cheaper than detection, but detection is better than nothing. If a question asks for the best control rather than a control, preventive generally beats detective, and detective beats corrective — unless the risk is unavoidable or the cost is prohibitive, in which case compensating/detective wins.
- The most complete answer, not the most technical. ISACA rewards the option that covers governance + people + process + technology, or that addresses root cause rather than symptom.
3. Decoding the question stem
The stem tells you what kind of answer is wanted. Train yourself to spot these phrases.
| Stem wording | What it wants | Your move |
|---|---|---|
| "The FIRST step / BEST action / MOST important" | A single winner; three options must be defensible-but-inferior | Rank them. Don't stop at "this one is true" |
| "PRIMARY purpose / MAIN objective" | The core reason, not a side benefit | Kill the secondary-benefit distractors |
| "GREATEST risk / MOST likely" | Risk ranking | Pick the one with real business impact, not the most technically exotic |
| "Should the auditor..." | Auditor role discipline | Apply Section 1 and 2 above |
| "During the planning phase..." | Phase discipline | The answer must belong to that phase. An execution-phase action is wrong here |
| "To determine whether..." | Evidence/test selection | The answer is the test that actually proves the point being asked about |
| "Adequate control / Sufficient evidence" | Judgement | Adequacy is relative to the risk and the objective — not "perfect" |
| "MOST cost-effective" | Cost-benefit | Look for the control proportional to the risk |
| A long scenario with a specific number, date or vendor name | Red herring | Only 1–2 details matter. Find the actual issue |
Scenario questions are longer for a reason: they bury the real issue. Read the last sentence of the stem first — that's where the actual question usually is.
4. The distractor patterns you will meet again and again
Learn to recognise these; they are deliberately engineered.
| Distractor pattern | Example | Why it's wrong |
|---|---|---|
| The "act, don't report" trap | "The auditor should correct the configuration" | Violates independence; the auditor reports |
| The "IT decides" trap | "The CIO should approve the risk" | Risk acceptance is a business decision |
| The "documentation as control" trap | "Update the policy to prohibit X" | A policy nobody enforces is not a control. Ask "and who monitors compliance?" |
| The "tool solves it" trap | "Deploy a DLP solution" | Tools without process, classification and ownership fail. Look for the governance option |
| The "too technical for the level" trap | A firewall rule detail in a board-level question | Wrong altitude |
| The "it's true but it's not the issue" trap | A correct statement about the wrong risk | Very common. Re-read the actual question |
| The "silver bullet" trap | "Implement 100% patch compliance" | Absolute solutions are usually wrong; risk-based is right |
| The "use production data in test" trap | "Copy production data to the test environment" | Always wrong. Mask or synthesise |
| The "developer has production access" trap | "Developers deploy their own fixes" | Always wrong. Segregation of duties |
| The "detect vs prevent" swap | Calling CCTV a preventive control | CCTV detects. Warning banners deter |
| The "auditor performs the technical test" trap | "The auditor should run the penetration test" | Independence breach. The auditor reviews it |
| The "assuming last year's answer" trap | Familiar-looking question, subtly changed | ISACA reuses stems with flipped keywords. Read every word |
If two options survive every filter and both seem right: pick the one that is broader, more governance-oriented, and addresses root cause. ISACA's answer key trends toward "assess/report/govern" over "do/patch/configure".
5. Time management
The two-pass method
Pass 1 (about 200 minutes): answer every question. If you can't decide within ~90 seconds, flag it and move on. Do not sink 4 minutes into one question — you'll lose three easy marks elsewhere. Answer your best guess before moving; a blank flag is worse than a wrong guess.
Pass 2 (about 40 minutes): return only to flagged questions with fresh eyes. Your subconscious has often solved it. Change an answer only when you have a specific reason — first instincts are right more often than panicked second-guessing.
Pacing checkpoints
| At this point | You should be at | If you're behind |
|---|---|---|
| 1 hour | ~Q38 | Slightly behind is fine; the early questions are usually shorter |
| 2 hours | ~Q75 | Start flagging faster, don't deliberate |
| 3 hours | ~Q113 | Consider whether long scenarios warrant full reading |
| 3:40 | ~Q150, entering review | Stop re-reading word by word; only fix flagged items |
Non-negotiables
- Answer every question. No negative marking. A random guess on a 4-option question is a 25% chance versus a guaranteed zero. Over 10 blanks that's ~2.5 marks you donated.
- Use the full 4 hours if you need it. Finishing in 2 hours is not a virtue.
- Eat before, hydrate, and use the washroom before you start. Four hours is long.
6. Question-type-specific technique
"What is the FIRST thing the auditor should do?" Order the options by sequence: understand/plan → assess risk → obtain evidence → evaluate → report → follow up. The answer is the earliest step that isn't already done. If planning isn't done, planning wins.
"What is the BEST control?" Rank by: preventive > detective > corrective, and by whether it addresses the specific risk named. A detective control that directly addresses the named risk beats a preventive control aimed at a different risk.
"Which provides the GREATEST assurance / MOST reliable evidence?" Use the evidence hierarchy: auditor's direct observation and re-performance > externally generated held by the auditor > externally generated held by the client > internally generated under strong controls > internally generated under weak controls > oral/management representation. Management's written representation is always near the bottom — a favourite distractor.
"The auditor finds X. What should the auditor do NEXT?" Usually: validate the finding (confirm it's real and not a testing error), then quantify the impact, then report. Not "recommend a solution" before the finding is validated.
"Management has accepted the risk. What should the auditor do?" Document the acceptance, ensure it's held by the right level (business owner, formally, with authority), and report it to the audit committee / those charged with governance if it exceeds tolerance. The auditor does not overrule and does not silently accept.
"What is the PRIMARY purpose of a BIA / audit charter / post-implementation review?" Each has one canonical purpose. BIA = determine impact of disruption over time and set recovery objectives. Charter = establish authority, scope and independence. PIR = determine whether the business case and requirements were met.
7. Domain-specific quick reflexes
| If the question mentions... | Reach for... |
|---|---|
| Sampling, testing, evidence, findings | Domain 1 — compliance vs substantive, attribute vs variable, 5 Cs |
| Board, steering committee, COBIT, EA, ERM, privacy law, data classification | Domain 2 — governance level, business ownership |
| SDLC, testing, cutover, migration, PIR | Domain 3 — phase discipline, environment segregation |
| Availability, incident, change, patch, logs, SLA, database | Domain 4A — incident vs problem, CAB, log review |
| BIA, RTO, RPO, backup, recovery site, BCP, DR test | Domain 4B — the metric relationships and test hierarchy |
| Encryption, PKI, IAM, firewall, cloud, DLP, mobile/IoT | Domain 5A — what each control does and does not provide |
| Attack, malware, pen test, SIEM, incident response, forensics | Domain 5B — IR lifecycle, order of volatility, evidence handling |
8. The last 48 hours
Do:
- Re-read the cheat sheet (08-Rapid-Revision-Cheat-Sheet.md) twice.
- Re-read your own wrong-answer log — specifically the "rule" column.
- Re-read each domain's TRAPS and 60-second recall sections.
- Sleep properly both nights. A rested brain beats 4 extra hours of cramming, every time.
- Confirm the test-centre address, travel time, and acceptable ID. Arrive early.
Don't:
- Start a new topic. Ever.
- Do a full mock exam the day before — it will spike your anxiety without adding knowledge.
- Discuss the exam with anxious candidates in the waiting room.
- Second-guess your prep. You have done the work.
9. During the exam — a checklist
- Read the last line of the stem first on long scenario questions.
- Predict your answer before reading the options. This defeats the "sounds plausible" trap.
- Eliminate aggressively. Two clearly wrong options is usually achievable; that turns a 25% guess into a 50% choice.
- Ask the auditor question: "Is this option keeping me in the auditor's seat?"
- Flag and move at 90 seconds.
- Never leave a blank.
- In the final review, trust your first instinct unless you have a concrete reason.
- If you feel panic rising: stop, breathe, and remember that a 450/800 pass allows you to get roughly a third of the questions wrong. You do not need to be perfect — you need to be consistent.
10. The mindset in one paragraph
You are not being tested on whether you can secure a network. You are being tested on whether you think like an IS auditor: whether you assess risk before acting, evaluate against criteria rather than opinions, keep your independence by reporting instead of fixing, understand that the business owns risk while IT owns systems, choose controls that are proportionate to the risk, verify rather than assume, and communicate findings to those charged with governance. When a question confuses you, come back to that paragraph — it resolves more of this exam than any fact you can memorise.