Certified in Risk and Information Systems Control credential artwork

Certified in Risk and Information Systems Control (CRISC) Exam Guide

Validates knowledge of IT risk governance, risk assessment, risk response and reporting, and technology controls.

CRISC tests how you identify, assess, respond to and report IT risk in business terms. Learn the four domains, then practice scenario questions and study why the best answer treats risk as a business decision.

Understand the exam

Syllabus

1Governance26%
  1. 1AOrganizational Governance
  2. 1A1Strategy, Goals, and Objectives
  3. 1A2Organizational Structure, Roles, and Responsibilities
  4. 1A3Organizational Culture and Ethics
  5. 1A4Policies and Standards
  6. 1A5Business Processes and Resilience
  7. 1A6Organizational Asset Management
  8. 1BRisk Governance
  9. 1B1Enterprise Risk Management (ERM)
  10. 1B2Lines of Defense
  11. 1B3Risk Profile
  12. 1B4Risk Appetite and Risk Tolerance
  13. 1B5Risk Frameworks, Legal, Regulatory, and Contractual Requirements

Example scenario: The board sets a low appetite for customer-data risk, but a product team wants to launch with a known gap. Who should decide, and what information do they need?

2Risk assessment22%
  1. 2ARisk Identification
  2. 2A1Risk Events
  3. 2A2Threat Modeling and Threat Landscape
  4. 2A3Vulnerability Management
  5. 2A4Risk Scenario Development and Evaluation
  6. 2BRisk Analysis
  7. 2B1Risk Assessment Concepts and Standards
  8. 2B2Business Impact Analysis (BIA)
  9. 2B3Risk Register
  10. 2B4Risk Analysis Methodologies
  11. 2B5Inherent and Residual Risk

Example scenario: A critical supplier stores your data in a region you have not assessed. How would you build and rate a risk scenario for it?

3Risk response and reporting32%
  1. 3ARisk Response
  2. 3A1Risk Response Options
  3. 3A2Risk and Control Ownership
  4. 3A3Vendor/Supply Chain Risk Management
  5. 3A4Issues, Findings, Exceptions and Exemptions Management
  6. 3BControl Design and Implementation
  7. 3B1Control Frameworks, Types, and Standards
  8. 3B2Control Design, Selection, Implementation, and Analysis
  9. 3B3Control Testing Methodologies
  10. 3CRisk Monitoring and Reporting
  11. 3C1Risk Action Plans
  12. 3C2Data Collection, Aggregation, Analysis, and Validation
  13. 3C3Risk and Control Metrics
  14. 3C4Risk and Control Monitoring Techniques
  15. 3C5Risk and Control Reporting Techniques
  16. 3C6Monitoring and Reporting of Emerging Risks

Example scenario: A risk owner wants to accept a risk that exceeds tolerance to meet a deadline. What should the risk practitioner do and record?

4Technology and security20%
  1. 4ATechnology Principles
  2. 4A1Technology Roadmaps and Enterprise Architecture (EA)
  3. 4A2Operations Management
  4. 4A3System Development Life Cycle (SDLC)
  5. 4A4Data Lifecycle Management
  6. 4A5Portfolio and Project Management
  7. 4A6Technology Resilience and Disaster Response/Recovery
  8. 4A7Emerging Technologies
  9. 4BInformation Security Principles
  10. 4B1Security Concepts, Frameworks, and Standards
  11. 4B2Security/Risk Awareness and Training
  12. 4B3Data Privacy and Data Protection Principles

Example scenario: Developers want to deploy changes several times a day. Which controls would keep change risk within tolerance?

Official CRISC exam content outline · Effective November 3, 2025

Format

Questions
150
Duration
4h
Passing score
450 / 800
Delivery
Test centre or online
Languages
English, Japanese, Spanish

Question types

Choose the one best answer from four options; a question may ask for the MOST or FIRST appropriate action.

CertUp example

A risk practitioner sees the same control failure reported in three quarters in a row. What is the MOST appropriate action?

  1. Accept the risk as a normal cost of operations
  2. Ask the control owner for a plan and update the risk register entry
  3. Remove the control from the register
  4. Replace the control owner
Show answer

B. A repeated failure means the risk response is not working, so the owner needs a plan and the register must show the current exposure.

Eligibility and booking

Experience required for certification

3 years in risk assessment and risk response

Required

You need three years of work performing CRISC tasks in both Domain 2 (Risk Assessment) and Domain 3 (Risk Response and Reporting). There are no waivers or substitutions.

Verified experience and application

Required

The experience must fall within the ten years before you apply. Have it verified, then apply and pay the $50 application fee within five years of passing.

You can take the exam before you have the experience. If you passed between August 2021 and November 2025, the earlier rule applies: three years across at least two domains, one of them Governance or Risk Assessment.

Anyone can register. Registration gives you six months to sit the exam. Book with PSI from 48 hours after paying, up to 90 days ahead, and reschedule free until 48 hours before.

Register for the CRISC examExam candidate guide

Make a study plan

Read the outline and try the free practice quiz first. Note which domains your job already covers.

Most candidates spend 80–140 hours. Plan for the low end if you already work in IT risk, security or audit; add time if risk frameworks or the technology domain are new to you.

9 weeksto be ready
  1. 1Understand the examRead the syllabus and format, check you’re eligible and pick a target date.5 h
  2. 3Learn the core conceptsWork through one main course or book, topic by topic.53 h
  3. 4Practice with mock examsTake timed practice tests and review every mistake.27 h
  4. 5Prepare for exam dayBook the exam and check the ID and delivery rules.5 h

Learn the core concepts

Choose one main course or the official manual, and work through the four domains in order.

Best official courseCRISC Online Review CourseISACA · $895 · $795 for ISACA members · 6 monthsBest official referenceCRISC Review Manual, 8th editionISACA · $139 · $109 for ISACA membersBest video courseMasterclass - CRISC ExamHemang Doshi · $20 · lifetime access
See all 4 CRISC courses →

Treat risk as a business decision. The risk owner in the business decides how to respond. The risk practitioner analyzes, advises and reports.

Practice with mock exams

Use ISACA's QAE database as your main question bank. Review the explanation for every answer, including the ones you got right.

Free CRISC Practice QuizISACA · Free · 10 questions · short form to see resultsCRISC Questions, Answers & Explanations DatabaseISACA · $399 non-member · $299 member · 6 months, extension availablePractice Tests to prepare for CRISC Exam (Updated 2026)Hemang Doshi · $19.99 · lifetime access
See all 4 CRISC practice tests →

Are you ready?

  • You can say who owns the risk and who owns the control in a scenario.
  • You can explain why the best answer fits the business objective and why the other options do not.
  • You score consistently on mixed sets of questions you have not seen before.
  • You can finish a four-hour timed exam with time to review flagged questions.

Prepare for exam day

Bring one current, original government ID with your photo and signature. The first and last name must match your ISACA registration; digital IDs are not accepted.

Before travelling to PSI

  • Arrive at least 30 minutes before your start time. More than 15 minutes late means you forfeit the fee.
  • Store phones, watches, notes and bags outside the testing room. Calculators are not allowed.
  • Use the on-screen tutorial before the exam starts.
  • Ask the proctor before taking either of your two 10-minute breaks.
ISACA exam candidate guide

If you miss the exam because of illness or another emergency, contact PSI within 72 hours with documentation to reschedule without losing the fee.

Advice from exam takers