CISA is a judgement test, not a knowledge test

Most CISA candidates fail not because they didn't study enough. They fail because they studied the wrong way.

They memorise frameworks, definitions and domain content, then walk into the exam expecting to retrieve that knowledge and match it to questions. That approach fails, because the exam doesn't ask you to retrieve knowledge. It asks you to apply judgement. Specifically, the judgement of a senior, independent IS auditor: not an IT manager, not a security engineer, not a project manager.

The moment you understand this, the entire exam changes.

How the examiner builds a question

ISACA writes questions designed to separate candidates who understand from candidates who merely know. Every question has:

• One clearly correct answer, which requires IS auditor judgement
• One close distractor, which is technically correct but wrong in context
• Two elimination options, which are there to waste your time if you panic

The close distractor is where smart people lose marks. It looks right. It might even be right in your professional experience. But it is wrong for the IS auditor in the exam room, because it compromises independence, skips a step, or solves the wrong problem.

Your job is not to find the right answer. Your job is to understand why the other three are wrong. When you can say why each wrong answer is wrong, the correct answer is the only one left standing.

A four-step way through every question

1. Read the stem twice. What is actually being asked? What the auditor should do now, what should have been done, or what the best control is? These are different questions with different answers.

2. Find the qualifier. Words like MOST, BEST, FIRST, PRIMARY and GREATEST change the answer entirely. Underline them every time. They are not decoration; they are the question.

3. Eliminate the two obvious wrongs. One answer usually violates auditor independence. One is usually an operator's action, not an auditor's. Cross out both.

4. Put on the IS auditor lens. Of the two left, which would a senior IS auditor recommend? Which one preserves independence, relies on evidence and follows process? That's your answer.

Why your experience can work against you

Many candidates assume Domain 5, information security, will be their strongest because they work in IT. It is consistently one of the most failed domains, precisely because technical knowledge creates overconfidence. The exam doesn't test technical depth there. It tests whether you understand security from an audit and control perspective.

So before you open another chapter, practise the lens. Take any question you've already answered and explain, out loud, why each wrong option is wrong. That habit is worth more than another hundred pages of reading.