ISACA • CRISC
Certified in Risk and Information Systems Control (CRISC) Practice Test
Validates expertise in IT risk management across governance, risk assessment, risk response and reporting, and technology and security domains.
Exam Details
Questions
761
Duration
240 minutes
Passing Score
450/800
Difficulty
ProfessionalLast Updated
Jan 2026
Topics Covered
Governance (26%)Risk Assessment (22%)Risk Response and Reporting (32%)Technology and Security (20%)
Exam Domain Breakdown
Governance26%
Risk Assessment22%
Risk Response and Reporting32%
Technology and Security20%
Exam Overview
The Certified in Risk and Information Systems Control (CRISC) is an ISACA credential that validates a professional's expertise in enterprise IT risk management and information systems control. It is the only professional certification specifically focused on IT risk management, making it uniquely positioned among risk and security credentials. The exam covers four core domains: Governance, Risk Assessment, Risk Response and Reporting, and Technology and Security — spanning the full lifecycle of identifying, analyzing, evaluating, and responding to IT-related business risks. The certification was updated in November 2025 to reflect evolving enterprise risk landscapes and the growing intersection of governance, technology, and cybersecurity risk.
Since its inception in 2010, more than 46,000 professionals worldwide have earned the CRISC designation. It is consistently ranked among the top-paying IT certifications globally — ISACA data places it at #4 worldwide by average compensation. Holding the CRISC demonstrates the ability to apply risk governance best practices, design and implement information system controls, and communicate risk findings to senior stakeholders and boards.
Who Should Take This Exam
CRISC is designed for mid-to-senior-level IT and business professionals who are directly involved in managing enterprise risk. Primary target roles include IT Risk Managers, Chief Information Security Officers (CISOs), IT Auditors, Compliance Officers, Security Consultants, and Information Systems Control professionals. It is particularly relevant for those who bridge technical IT functions and executive-level governance responsibilities.
The credential suits professionals with several years of hands-on experience in risk identification, assessment, and mitigation — not entry-level candidates. Those working in financial services, healthcare, technology, consulting, or government sectors will find the certification especially aligned with regulatory and operational demands in those industries. Professionals seeking to transition from purely technical roles into risk management leadership will also benefit significantly.
Prerequisites
ISACA does not impose formal educational prerequisites for sitting the CRISC exam. However, to achieve full certification after passing the exam, candidates must demonstrate at least three years of cumulative work experience in IT risk management and information systems control, spanning at least two of the four CRISC job practice domains. This experience must have been gained within the 10-year period preceding the certification application date. The exam result is valid for five years, giving candidates time to accumulate the required experience after passing.
While not required to register, candidates are strongly advised to have a working knowledge of enterprise risk frameworks (such as COBIT, ISO 31000, or NIST), IT governance principles, and information security fundamentals before attempting the exam. Familiarity with risk assessment methodologies, control design concepts, and regulatory compliance environments will significantly ease preparation.
Exam Format
The CRISC exam consists of 150 scored multiple-choice questions administered over 240 minutes (4 hours). The exam is computer-based and can be taken at authorized PSI testing centers worldwide or via remote proctoring. All questions test practical, scenario-based judgment aligned with real-world job tasks performed by risk professionals, rather than pure memorization of definitions.
Scoring uses a scaled system ranging from 200 to 800, and the minimum passing score is 450. Exam registration is continuous — there are no fixed testing windows — and candidates can schedule their appointment as early as 48 hours after paying the registration fee. Once registered, candidates have a 12-month eligibility window to sit the exam. Registration costs US$575 for ISACA members and US$760 for non-members, plus a US$50 application processing fee upon certification.
Skills Measured
- 1.Domain 1 — Governance (26%): Covers organizational strategy, goals, and objectives as they relate to IT risk. Includes enterprise risk management (ERM) frameworks, the three lines of defense model, risk appetite and tolerance, IT governance structures, and how risk management aligns with and supports overall business strategy.
- 2.Domain 2 — Risk Assessment (22%): Focuses on identifying, analyzing, and evaluating IT risk. Topics include threat and vulnerability identification, risk event scenarios, likelihood and impact assessment, risk register maintenance, emerging risk monitoring, and quantitative and qualitative risk assessment methodologies.
- 3.Domain 3 — Risk Response and Reporting (32%): The largest domain, addressing the selection and implementation of risk treatment options (accept, mitigate, transfer, avoid), design and evaluation of controls, risk ownership, key risk indicators (KRIs), risk monitoring processes, and communicating risk status and findings to stakeholders, management, and the board.
- 4.Domain 4 — Technology and Security (20%): Examines IT operations, infrastructure, and security as risk domains. Covers the System Development Life Cycle (SDLC), cloud and emerging technology risks, information security frameworks, data privacy concepts, security awareness programs, and the risk implications of IT architecture and operational decisions.
Study Tips
- Use the official ISACA CRISC Review Manual as your primary study resource — it is mapped directly to the four exam domains and updated to reflect the November 2025 job practice revision. Supplement it with the CRISC QAE (Questions, Answers, and Explanations) database, which contains 833 practice questions with detailed rationale.
- Prioritize Domain 3 (Risk Response and Reporting, 32%) in your preparation since it carries the highest exam weight. Focus on understanding when to apply each risk treatment option and how to design effective controls — these concepts are heavily scenario-tested.
- Enroll in ISACA's official Online Review Course or instructor-led CRISC training if you benefit from structured learning. ISACA also offers free 10-question practice quizzes to benchmark readiness before committing to full preparation.
- Study from the perspective of a risk practitioner making business decisions, not a purely technical security professional. CRISC questions are scenario-based and test judgment about balancing risk with business objectives — not memorization of technical configurations.
- Join ISACA Engage community study groups or a local ISACA chapter. Peer discussion is particularly valuable for CRISC because many questions require contextual judgment that benefits from practical experience-sharing with fellow risk professionals.
- Review the official CRISC Exam Content Outline published by ISACA (available at isaca.org/credentialing/crisc/crisc-exam-content-outline) to map each domain's tasks and knowledge statements. Use this as a self-assessment checklist to identify knowledge gaps before your exam date.
- Allow 3–6 months of dedicated preparation. In the final two weeks, shift from reading to timed practice exams to build exam-pacing discipline under the 240-minute constraint with 150 questions.
Career Benefits
CRISC-certified professionals command some of the highest compensation in the IT and security fields. ISACA reports an average annual salary exceeding US$151,000 for credential holders, and the certification consistently ranks in the top five globally for IT compensation. In high-demand markets such as financial services, healthcare, and government contracting — particularly in cities like New York, Washington D.C., and San Francisco — salaries can run 20–40% above average. Consulting and contract rates for CRISC holders typically range from US$50 to over US$100 per hour depending on experience.
Beyond compensation, CRISC opens doors to senior leadership roles including IT Risk Manager, CISO, Compliance Program Manager, and VP of Enterprise Risk. It is especially valued for enabling career transitions from technical IT or audit roles into governance and risk management leadership. As regulatory requirements intensify globally and organizations face growing operational, cyber, and third-party risks, demand for credentialed risk professionals continues to strengthen. CRISC differentiates candidates from those holding broader security credentials (such as CISSP or CISM) by demonstrating specialized depth in enterprise IT risk governance and control design.
Sample Questions
Preview — answers shown5 sample questions with correct answers and explanations. Start a practice session to test yourself across all 761 questions.
1. A consulting firm implements detective controls including Security Information and Event Management (SIEM) system, quarterly access reviews, and security awareness phishing simulations. A social engineering attack bypasses preventive email filtering. Which control should identify the successful phishing compromise? (Select one!)
ASIEM detecting anomalous user behavior and unauthorized access patterns
BQuarterly access reviews identifying inappropriate permissions
CEmail filtering blocking malicious attachments proactively
DSecurity awareness training preventing future phishing clicks
Explanation
SIEM systems are detective controls that identify when threats have occurred by monitoring logs, detecting anomalies, and alerting on suspicious activities in real-time or near real-time. After a successful phishing attack, SIEM would detect unusual login patterns, lateral movement, or data exfiltration attempts. Quarterly access reviews are detective but operate on a 90-day cycle, too slow for active compromise detection. Security awareness training is a preventive control. Email filtering is also preventive and already failed to block the attack. Detective controls must identify what preventive controls missed.
2. An organization's risk register contains 250 identified risks across all business units. The Chief Risk Officer analyzes the register and finds 40 risks have no assigned risk owner, 25 risks list owners who left the company, and 15 risks show last review dates over 18 months ago. Which risk governance principle is MOST significantly violated? (Select one!)
AAccountability and ownership for risk management activities
BRisk appetite alignment with strategic objectives
CIntegration of risk management into business processes
DIndependence of risk management from operational management
Explanation
Accountability and ownership is violated because risk owners must have authority and responsibility to manage specific risks. Risks without owners lack someone accountable for monitoring, reporting, and implementing treatments. Outdated ownership assignments with departed employees create accountability gaps where no one actively manages the risk. The scenario directly demonstrates failure to establish and maintain clear ownership, which is fundamental to effective risk governance. Risk appetite alignment relates to risk tolerance thresholds, not ownership. Independence concerns organizational structure separation. Integration relates to embedding risk practices in operations, not assigning accountability for identified risks.
3. A risk governance committee is implementing a risk monitoring program. The committee wants to establish metrics that provide early warning of increasing cyber risk exposure, track how well controls are operating, and measure achievement of security objectives. Which combination of indicators should the committee implement? (Select two!)
Multiple correct answersAKey Risk Indicators (KRIs) for forward-looking risk exposure trends and early warning signals
BKey Performance Indicators (KPIs) for backward-looking achievement of security program goals
CKey Control Indicators (KCIs) for current state effectiveness of control operation and execution
DService Level Agreements (SLAs) for vendor performance measurement and contractual compliance
EAnnual Loss Expectancy (ALE) calculations for quantitative risk assessment and financial impact
Explanation
Key Risk Indicators provide forward-looking, predictive early warning signals of increasing risk exposure (such as number of unpatched systems, failed login attempts, days since last security assessment), which is essential for proactive risk management. Key Control Indicators monitor current state effectiveness of control operations (such as percentage of controls tested, control failure rates, control execution frequency), ensuring controls are working as designed. KPIs are backward-looking lagging indicators measuring past performance and goal achievement, not early warnings. SLAs track vendor commitments but do not provide comprehensive risk monitoring. ALE calculations are point-in-time risk assessments, not ongoing monitoring metrics. The committee needs KRIs for predictive risk signals and KCIs for control effectiveness monitoring.
4. A logistics company identifies that current cyber insurance policy covers $5 million in ransomware losses with $50,000 deductible and $250,000 annual premium. After implementing the policy, residual risk of ransomware remains at $8 million potential loss with 0.15 annual probability. The insurance reduces financial impact but does not eliminate operational disruption risk or reputational damage. Which risk response strategy has the organization implemented? (Select one!)
ARisk avoidance by eliminating ransomware exposure
BRisk mitigation by reducing likelihood and impact
CRisk acceptance by acknowledging residual risk
DRisk transfer by shifting financial impact to third party
Explanation
Risk transfer shifts risk impact to third parties through insurance, contracts, or outsourcing. The insurance policy transfers up to $5 million in financial losses to the insurer but does not eliminate the risk or reduce its probability. Risk avoidance would require eliminating systems exposed to ransomware. Risk mitigation would implement technical controls reducing likelihood or impact. While residual risk remains, the primary strategy is transfer. Organizations often combine response strategies, but the insurance policy specifically represents transfer of financial consequences.
5. A global retailer implements COBIT 2019 governance framework. The organization operates in highly regulated industries across 45 countries with significant legacy system constraints. When establishing their governance system, which design factor would have the GREATEST influence on tailoring the framework to their specific needs? (Select one!)
ACompliance requirements including multi-jurisdictional regulations and industry standards
BTechnology adoption strategy for cloud migration and digital transformation
CEnterprise size measured by revenue and employee count
DEnterprise strategy and long-term business objectives
Explanation
COBIT 2019 defines 11 design factors for tailoring governance systems. For a global retailer in highly regulated industries across 45 countries, compliance requirements represent the greatest constraint and influence. Multi-jurisdictional regulations create mandatory requirements that cannot be avoided and directly impact governance structure, control selection, and operational processes. Legal and regulatory requirements often override other design factors because non-compliance results in fines, sanctions, or inability to operate. Enterprise size influences resource allocation but not fundamental approach. Strategy guides direction but must operate within compliance constraints. Technology adoption enables business objectives but must comply with regulatory frameworks governing data protection, financial reporting, and industry-specific requirements.
$7
One-time access to this exam
Full access to all 761 questions
Or $15/mo for all 201 exams
Detailed explanations
Free preview stays available