| Welcome to the September 2026 edition of the Demix Monthly Newsletter |
|
| |
Have you ever invested in training only to find that the new knowledge was never applied, the skills gap remained, and little changed in practice?
Learning creates the greatest value when it is connected to real work, future capability needs, and the responsibilities people are expected to perform.
In this edition of Capability in Practice, we explore Managing the Workforce, a CMMI Capability Area that helps organisations develop, support, and empower the people needed for current and future work.
We also explain Continuing Professional Education (CPE): who needs it, what qualifies, and how Demix training can support certification maintenance and practical development. |
|
| | Why This Capability Area Matters |
|
|
The Managing the Workforce Capability Area brings together three related Practice Areas: Enabling Virtual Work – creating the conditions for effective remote or hybrid work Organizational Training – developing the skills and knowledge people need to perform effectively Workforce Empowerment – aligning people and workgroups with business objectives and enabling them to succeed
Together, they help organisations answer three important questions: Can our people work effectively wherever the work takes place? Do we understand which skills are needed—and whether our training is effective? Are people assigned, supported, and empowered in ways that align with business objectives?
Talented people can still struggle when learning, assignments, support, and authority are disconnected from business needs.
Strong workforce capability is created by connecting skills, working conditions, assignments, communication, and authority to the outcomes the organisation needs. |
|
| Common Challenges in Practice |
|
|
|
|
|
|
|
|
|
|
|
|
Training is selected without identifying the need Courses may be chosen because they are available or provide CPE—not because they address a defined capability need.
Completion is measured, but effectiveness is not Attendance is recorded, yet the organisation does not check whether learning improved knowledge, behaviour, or performance.
Skills information is disconnected from assignments Training records may exist, while staffing decisions remain based mainly on availability.
Virtual work is treated as a technology issue A collaboration platform alone does not create effective virtual work. Teams also need secure access, clear communication, role clarity, support, and continuity arrangements.
People gain knowledge but are not empowered to use it Employees may complete valuable training and return to roles where decision rights are unclear or there is no opportunity to apply their new capability. |
|
| |
Enabling Virtual Work (EVW)
Enabling Virtual Work looks beyond whether employees can join an online meeting. An effective approach considers: Which work can be performed virtually and any constraints Communication, coordination, and stakeholder needs Tools, infrastructure, secure access, and support Security, privacy, confidentiality, and information protection Delivery quality and continuity when virtual work is interrupted Whether the approach remains effective as business needs change
Practical example: A distributed audit team may need secure access to evidence, agreed collaboration channels, clear time-zone handovers, defined review responsibilities, and an alternative process for connectivity disruptions. Providing Microsoft Teams or Zoom alone would not address the complete need. |
|
|
Organizational Training (OT)
Organizational Training focuses on developing the skills and knowledge people require to perform their roles efficiently and effectively. Strong practices include: Identifying current and future training needs Connecting those needs to business objectives, roles, and projects Planning how training will be developed, obtained, and delivered Maintaining reliable participation and completion records Assessing whether the training addressed the identified need Updating the approach as capability requirements change
CPE can be an important part of this approach, especially where professionals must maintain certifications and remain current in fast-changing fields. However, collecting CPE hours alone does not prove that organisational capability has improved.
Practical example: If an audit team plans to offer AI assurance services, the organisation could define the required competencies, select relevant AAIA training, record completion, provide opportunities to apply the learning, and evaluate whether the team can perform the new work effectively. |
|
|
Workforce Empowerment (WE)
Workforce Empowerment connects organisational objectives with the people and workgroups responsible for achieving them. It includes: Understanding the competencies needed to perform the work Allocating assignments based on skills, qualifications, and experience Keeping assignments current as needs change Managing transitions into and out of roles or teams Establishing effective communication and coordination Giving teams appropriate authority and accountability Building competencies that support future objectives
Training creates potential. Empowerment enables people to use it.
Practical example: After a security professional completes CISM training, the organisation could assign relevant governance or risk responsibilities, provide mentoring, clarify decision authority, and review how the learning is applied in practice. |
|
| | CPE in Focus: Continuing Learning After Certification |
|
|
Passing an exam demonstrates knowledge at one point in time. As risks and professional practices change, certification holders must continue learning through Continuing Professional Education (CPE).
You may hear the term “CPE points,” although ISACA formally measures them as CPE hours. CPE helps professionals keep their knowledge current and maintain an active credential. |
|
| |
CPE requirements are set by the organisation that owns each certification; there is no single universal system.
Within ISACA, the requirement applies to holders of active professional certifications. It does not arise simply from being an ISACA member, attending a course, or passing an exam. |
|
|
|
Both the annual and three-year requirements must be met. A CISA holder, for example, cannot report 120 hours in one year and none in the next two.
For newly certified professionals, the annual and three-year periods begin on 1 January of the following year. Eligible CPE earned after the certification date and before 31 December may be applied to the initial reporting period.
It is also important to distinguish between an ISACA certification and a certificate. COBIT® 2019 Foundation is a certificate and does not carry the 20/120 maintenance requirement. Relevant COBIT training may, however, qualify as CPE for someone who already holds an applicable certification. |
|
| |
Under ISACA’s CPE reporting policy:
One CPE hour is earned for every 50 minutes of active participation.Lunches and breaks are excluded. CPE may be reported in quarter-hour increments and rounded to the nearest quarter hour.
For example, an event running from 09:00 to 17:00 with a one-hour lunch and two 15-minute breaks provides 390 active minutes:
390 minutes ÷ 50 minutes = 7.8, rounded to 7.75 reportable CPE hours. The final figure should therefore reflect the actual learning agenda and verified attendance—not simply the advertised number of course days. What Activities Can Qualify?Depending on relevance to the certification, CPE may be earned through: Instructor-led training, review courses, workshops, conferences, and webinars Structured self-study or online courses with completion evidence Teaching, lecturing, presenting, or publishing relevant professional content Developing or reviewing certification exam questions Passing a related professional examination Eligible professional research, peer review, committees, mentoring, or volunteering
Can One Activity Support More Than One Certification?Yes, if the learning is relevant to each credential. A five-CPE information-security governance activity could, for example, be applied as five hours to both CISA and CISM. It does not become ten hours within either certification.
The certification holder remains responsible for mapping the activity correctly and retaining evidence for an audit.
Certification Training and CPE Are Not the SameTraining completed to prepare for a first certification does not later become maintenance CPE for that same credential simply because the learner passes the exam.
However, relevant training may qualify when: The learner already holds another applicable certification An existing certification holder completes it to refresh or extend relevant knowledge A newly certified professional earns eligible hours after the certification date and before year-end
First identify which credential you are maintaining. Then confirm that the learning is relevant to it.Reporting CPE and Retaining EvidenceCertification holders can report and manage CPE through MyISACA: Open Certifications & CPE Management. Select Report and Manage CPE for the relevant certification. Apply eligible pre-loaded CPE or add a new record. Enter the activity, provider, dates, category, and applicable hours. Allocate the hours to each relevant certification and save the record.
Record learning promptly and retain supporting evidence. ISACA may select certification holders for a CPE audit.
What Changes in 2027?ISACA’s revised policy takes effect on 1 January 2027. The total requirements do not increase: CISA, CISM, CRISC, CGEIT, CDPSE, and CCOA remain at 20 CPE annually and 120 over three years. At least 90 of the 120 must align with the certification’s Exam Content Outline; up to 30 may cover broader professional development. AAIA, AAISM, and AAIR remain at 10 CPE annually and 30 over three years. All 30 must align with the relevant Advanced certification’s Exam Content Outline. Holding multiple certifications does not automatically increase the total hours required when learning maps appropriately to each credential. Vendor sales or product demonstrations will no longer qualify, although educational case studies may still count.
No system changes apply to the 2026 reporting cycle. |
|
| | |
As an ISACA Accredited Training Organisation and CMMI Partner, Demix delivers live virtual programmes using official materials, experienced instructors, practical discussion, and exam support.
For eligible certification holders, relevant Demix training can also provide reportable CPE based on verified active attendance: |
|
|
|
The “up to” figures assume full attendance and qualifying active instructional time, excluding lunches and breaks. Certification holders must confirm that the content is relevant to the credential against which it is reported. Demix can provide attendance evidence to support the CPE record.
The goal is not simply to collect points. It is to choose learning that keeps both your certification and your capability current. |
|
| | |
We are pleased to share our upcoming training programmes designed to build capability across governance, audit, security, and organisational performance. |
|
|
CISA® – Certified Information Systems Auditor |
|
| Upcoming (Virtual): 14-18 September 2026 (09:00-16:00 GMT+2) 12-16 October 2026 (09:00-16:00 GMT+2) 16-20 November 2026 (09:00-16:00 GMT+2)
Includes: 5-day live virtual training Official CISA Review Manual Official CISA Exam 1000+ QAE-style practice questions Exam registration assistance Expert mentorship
Ideal for IT auditors, risk professionals, compliance teams, and internal control specialists. |
|
| |
CISM® – Certified Information Security Manager |
|
|
Upcoming (Virtual): 21-24 September 2026 (09:00-16:00 GMT+2) 19-22 October 2026 (09:00-16:00 GMT+2) 23-26 November 2026 (09:00-16:00 GMT+2)
Includes: 4-day live virtual training Official CISM Review Manual Official CISM Exam 1000+ QAE-style practice questions Exam registration assistance Expert mentorship
Well suited for security managers, risk leaders, and professionals on a CISO pathway. |
|
| |
AAIA™ – ISACA Advanced in AI Audit |
|
|
Upcoming (Virtual): 7-9 September 2026 (09:00-16:00 GMT+2) 5-7 October 2026 (09:00-16:00 GMT+2) 9-11 November 2026 (09:00-16:00 GMT+2)
Includes: 3-day live virtual training Official AAIA Review Manual Official AAIA Exam 1000+ QAE-style practice questions Exam registration assistance Expert mentorship
Designed for experienced auditors seeking specialisation in AI governance and AI risk. |
|
| | | Includes: 2-day live virtual training Official COBIT materials Official COBIT 2019 Foundation Exam 4 mock exams Exam registration assistance Expert mentorship
Valuable for executives, IT leaders, auditors, and governance professionals seeking structured IT governance implementation. |
|
| |
CMMI® Building Organizational Capability (BOC) |
|
|
Upcoming (Virtual): 21-23 September 2026 (09:00-16:00 EST)
Includes: 3-day live virtual instructor-led training Access to entire CMMI Model Practitioner Exam included Tools for building capability improvement roadmaps Access to course materials Expert instructor support
Ideal for process leaders, capability practitioners, coaches, and organisational improvement teams. |
|
| | |
|
|
|
|
|
|
|
|
|
| | Not sure which programme best aligns with your role, certification, or CPE plan? Schedule a meeting with us to explore how Demix can guide you. |
|
|
| |
|
|
|
|
|
|
|
|
| | | | | P: +27 82 590 3660 E: info@demix.org www.demix.org |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
|
