How CertArc creates and reviews exam content
CertArc creates original practice scenarios for CISSP, CISM, CISA, AAISM and AAIA and maps them to each certifying body's published exam outline. Content is checked for source accuracy, decision logic for the role, product truth and compliance boundaries before publication. CertArc does not copy official exam questions, publish brain dumps, or promise exam outcomes.
How original scenarios are created
A scenario begins with a decision pattern for the role the exam tests, not a recalled exam item. The writer defines the accountable role, the objective, the risk, the constraints and plausible actions. Explanations then show why one option is the stronger answer for that role and why the alternatives remain tempting. Each program's review explains the decision through its own Lens.
How content maps to each official outline
Domain labels and coverage statements are checked against the published outline for each program. CertArc uses the outline to organise study content; it does not claim that its wording or scenarios come from the certifying body.
CISSP · ISC2 · 8 domains
Security decisions across the domains. The CISSP Lens coaches the decision level.
Outline: ISC2 CISSP Certification Exam Outline · CISSP preparation
The CertArc CISSP Lens · Example learner CISM · ISACA · 4 domains
Managerial judgment. The CISM Lens coaches the management decision.
Outline: ISACA CISM Exam Content Outline · CISM preparation
The CISM Lens · Example learner CISA · ISACA · 5 domains
Audit evidence and independence. The CISA Lens coaches what an auditor can defend.
Outline: ISACA CISA Exam Content Outline · CISA preparation
The CertArc CISA Lens · Example learner AAISM · ISACA · 3 domains
AI security management decisions. The AAISM Lens coaches the owner, life-cycle stage and oversight each AI use needs.
Outline: ISACA AAISM Exam Content Outline · AAISM preparation
The CertArc AAISM Lens · Example learner AAIA · ISACA · 3 domains
AI audit evidence and independence. The AAIA Lens coaches what an auditor can evaluate, evidence and report, while management owns the AI system and the risk.
Outline: ISACA AAIA Exam Content Outline · AAIA preparation
The CertArc AAIA Lens · Example learner
How questions are reviewed before release
Structural checks, role-alignment review and coaching gates run before a question is promoted. Missing evidence fails closed.
How factual claims are sourced
Exam dates, policies, scoring facts, experience requirements, and official preparation-material details are linked to the relevant primary source. Community estimates are not presented as official facts. Product statements are checked against features that are currently available.
What practitioner review means
A named practitioner review means the person reviewed the final public claims and reasoning on the pages where that attribution appears. It does not imply that the reviewer wrote every page or reviewed pages without a visible attribution. The current named reviewer is listed on the practitioner profile.
How AI-assisted drafting is handled
AI tools may assist with drafting, classification, or consistency checks. Public facts, product claims, and practitioner attribution still require source review and human approval. AI output is not treated as a source.
Corrections and update cadence
Pages with volatile claims are rechecked when an authoritative source changes and on their scheduled review date. Readers can report an issue at support@certarc.com, or report a question from inside its review. A correction is assessed against the source and applied to every affected page.
What CertArc will not publish
- Copied, recalled, or reconstructed exam questions.
- Claims of access to confidential exam material.
- Unqualified pass-rate or outcome guarantees.
- Credentials or reviewer relationships that have not been approved.
- Product capabilities that are planned but not available.
To see how these standards show up in practice, from the three-tab review to the readiness formula, read why CertArc is different.