Certified in Risk and Information Systems Control Practice Exams

The CRISC (Certified in Risk and Information Systems Control) is ISACA's credential for professionals who identify and manage enterprise IT risk and implement information systems controls. It covers four domains: Governance (26%); IT Risk Assessment (22%); Risk Response and Reporting (32%); and Information Technology and Security (20%). The exam is 150 items in 4 hours, scored on a 200–800 scale with 450 required to pass. Candidates need three years of cumulative experience in IT risk management and control across at least two of the four domains, one of which must be Domain 1 or Domain 2, with no experience waivers available.

• 1The leading credential specifically for IT risk management, distinct from audit (CISA) and security management (CISM)
• 2Proves you can translate technical exposure into business risk language that executives and boards act on
• 3Consistently ranked among the highest-paying IT certifications, and widely requested for risk and GRC roles
• 4Aligns with enterprise risk frameworks and the COBIT and Risk IT bodies of knowledge used across regulated industries

• ✓Align IT risk management with enterprise governance, strategy, culture, and the three lines of defense
• ✓Establish and apply risk appetite, tolerance, and capacity so treatment decisions are consistent and defensible
• ✓Identify IT risk through scenario development, threat and vulnerability analysis, and control deficiency review
• ✓Analyze and evaluate risk using qualitative and quantitative methods, including inherent and residual risk
• ✓Maintain a risk register with defined risk owners, treatment plans, and tracked issues and exceptions
• ✓Select risk responses — mitigate, transfer, avoid, or accept — and justify them against appetite and cost
• ✓Design, implement, and test controls, evaluating both design adequacy and operating effectiveness
• ✓Monitor risk and controls using KRIs, KPIs, and KCIs with defined thresholds and escalation triggers
• ✓Report risk to stakeholders using heat maps, dashboards, and scorecards tailored to the audience
• ✓Assess risk arising from technology and security practices: architecture, operations, data lifecycle, and emerging technology