Updated 1 Nov 2026 · 5 min read
On this page
What the ISACA CRISC is and who it is for
Certified in Risk and Information Systems Control is ISACA's certification for people who manage IT risk and design, run and monitor the controls that treat it. ISACA describes it as designed for those experienced in the management of IT risk and the design, implementation, monitoring and maintenance of information systems controls. In practice that means risk and compliance analysts, IT risk managers, control owners, and project managers who own a risk register.
The exam is open to anyone, and you can sit it before you have the experience. To become certified, you then need three or more years of professional work experience across at least two of the four CRISC domains, gained within the ten years before you apply. ISACA offers no experience waivers or substitutions for CRISC. You have five years from passing the exam to apply, and there is a one-time US$50 application processing fee.
One date matters if you are using older books: ISACA updated the CRISC exam on 3 November 2025. The four domains stayed the same, but the weights shifted slightly, and the previous prep materials were withdrawn on 3 September 2025.
ISACA CRISC at a glance
| Item | Detail |
|---|---|
| Exam code | CRISC |
| Questions | 150 multiple-choice |
| Time allowed | 4 hours (240 minutes) |
| Passing score | 450 on a scale of 200 to 800 |
| Exam fee | US$575 for ISACA members, US$760 for non-members |
| Languages | English, Spanish and Japanese |
| Where you sit it | PSI testing centres or remote proctored |
| Certification valid for | Renewed every year: 20 CPE hours a year, 120 over each three-year cycle, plus an annual maintenance fee (US$45 members, US$85 non-members) |
What is on the exam
Four domains. Risk response and reporting is the largest, and together with governance it makes up 58% of the exam.
Governance (26%). The business context risk sits in. Organisational governance covers strategy and objectives, structure, roles and responsibilities, culture and ethics, policies and standards, business resilience such as BCP and DRP, and asset management. Risk governance covers enterprise risk management, the lines of defence, the risk profile, risk appetite and tolerance, and the frameworks, laws, regulations and contracts that shape it. Expect questions about who owns a decision and what should come first.
Risk assessment (22%). Finding and sizing risk. Risk identification covers risk events, threat modelling, vulnerability management and building risk scenarios. Risk analysis covers assessment standards, business impact analysis, the risk register, analysis methods, and the difference between inherent and residual risk. Many questions ask what the risk practitioner should do before recommending anything.
Risk response and reporting (32%). What happens once a risk is understood. It covers response options, risk and control ownership, vendor and supply chain risk, and handling issues, exceptions and exemptions. It then moves into control frameworks, control design, selection and testing, and finally monitoring and reporting: risk action plans, data aggregation and validation, KRIs, KCIs and KPIs, heatmaps, scorecards, dashboards and emerging risk.
Technology and security (20%). The technology the risk lives in: enterprise architecture and roadmaps, operations and change management, the SDLC, data lifecycle, project and portfolio management, resilience and recovery, and emerging technologies. It closes with security frameworks, awareness training, and data privacy and protection principles.
Why people fail it
The most common mistake is studying in the wrong proportion. Technical candidates start with technology and security because it feels familiar, but it is the lightest domain at 20%. Risk response and reporting alone is 32%, and questions there turn on ownership, metrics and reporting rather than on how a control works technically.
The second is the question style. CRISC questions usually give you several answers that are all reasonable and ask which is best, most important or first. The right answer tends to be the one a risk practitioner would choose: confirm the business impact, involve the risk owner, check against appetite and tolerance. The technical fix is often wrong. You learn that pattern by answering many questions and reading why the wrong options are wrong.
The third is outdated material. Study sets written before the November 2025 update still use the old weights, so check that your sources match the current outline. Finally, remember the cost: every attempt is paid in full, US$575 or US$760, so a rushed first attempt is expensive.
A study plan that fits the exam
This seven week plan follows the domain weights. Before week 1, try the free CRISC practice questions cold to find your baseline.
- Week 1, governance part one: strategy and objectives, roles, culture, policies, business resilience and asset management.
- Week 2, governance part two: enterprise risk management, the lines of defence, risk profile, appetite and tolerance, and the legal and regulatory drivers.
- Week 3, risk assessment: threat modelling, vulnerability management, risk scenarios, BIA, the risk register, and inherent against residual risk.
- Week 4, risk response: response options, ownership, third-party risk, exceptions and exemptions, then control frameworks and control design.
- Week 5, monitoring and reporting: control testing, risk action plans, KRIs, KCIs and KPIs, and reporting methods. This domain is 32%, so it gets two weeks.
- Week 6, technology and security: architecture, operations, SDLC, data lifecycle, resilience, emerging technology, security frameworks and privacy.
- Week 7, full practice runs: sit mixed sets of 150 questions in four hours, review every miss, and go back to the weakest domain. The CertStash CRISC pack has 1,896 questions with explanations, which is enough for several full runs without repeats.
On exam day
You sit the exam at a PSI testing centre or remotely proctored at home. At a centre, arrive at least 30 minutes early. Remotely, run PSI's system compatibility check before the day, and note that remote proctors only chat in English. Either way, the name on your government-issued ID must match the name you registered with.
You get four hours for 150 questions, so plan on about a minute and a half per question with time left to review. Two breaks of up to ten minutes each are allowed with the proctor's permission, but the timer keeps running. There is no penalty for a wrong answer, so answer every question. The exam also includes unscored pretest items alongside the scored ones, so give every question your full attention. You see a preliminary pass or fail on screen, and the official score arrives within ten working days.
Frequently asked questions
Can I retake the CRISC if I fail?
Yes. You get four attempts in a rolling 12-month period. After a first fail you wait 30 days, then 90 days before each of the third and fourth attempts. Each attempt costs the full exam fee. If you think your result is wrong, you can request a rescore within 30 days for a US$75 fee.
Can I take the exam before I have three years of experience?
Yes. The exam is open to anyone. You then have five years from passing to apply, and the experience must fall within the ten years before your application.
How long does exam eligibility last after I register?
Six months from registration. You can book as early as 48 hours after paying, appointments open 90 days ahead, and you can reschedule free of charge up to 48 hours before your slot.
Is the practice pack enough on its own?
No, and it is not meant to be. It is practice, not a course. The questions and explanations show you how CRISC phrases risk decisions and where your gaps are, but you still need a solid source for the concepts, such as ISACA's review manual or a course. Use the pack to test and sharpen what you have learned.
When you are ready to practise at full length, get the complete ISACA CRISC practice pack for US$39.
Sources
The official pages the facts in this guide were checked against.
- isaca.org/-/media/files/isacadp/project/isaca/certification/exam-candidate-guides/2026/exam-candidate-guide.pdf
- isaca.org/credentialing/crisc/get-crisc-certified
- isaca.org/about-us/newsroom/press-releases/2025/isaca-updates-cdpse-and-crisc-exams-to-reflect-latest-risk-and-privacy-priorities
- isaca.org/credentialing/crisc/crisc-exam-content-outline
- isaca.org/credentialing/crisc
- isaca.org/credentialing/crisc/maintain-crisc-certification