thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

ISACA · Governance, Risk & Privacy · Professional

ISACA CRISC exam guide

Exam CRISC

CRISC validates enterprise IT risk management: governance, risk assessment, risk response and reporting, and technology and security controls. It suits professionals who identify and manage IT risk and design controls, a role that has grown with AI and regulatory pressure.

Questions150
Time limit240 minutes
Passing score450 (200-800 scale)
Exam fee$760 USD
Valid for3 years
DeliveryPSI test center or remote proctored

Format: Multiple choice. Fee note: $575 for ISACA members; $50 application fee after passing.

Who it's for

IT risk, control and compliance professionals with at least three years of risk management experience.

What the exam covers

Governance26%
Risk Assessment22%
Risk Response and Reporting32%
Technology and Security20%

Eligibility & prerequisites

Required: At least 3 years of IT risk management and IS control experience across at least 2 of the 4 CRISC domains, one of which must be Domain 1 or 2. No waivers. Experience must be within 10 years before applying or 5 years after passing.

Recommended: Hands-on risk assessment and control design experience.

Keeping it active

Annual and 3-year CPE cycle: earn at least 20 CPE hours each year and 120 hours every 3 years, and pay ISACA's annual maintenance fee (lower for members).

Skills & careers

Skills it validates

  • Establishing risk governance and appetite
  • Identifying and assessing IT risk scenarios
  • Designing risk responses and controls
  • Monitoring KRIs and reporting risk
  • Evaluating technology and security controls
  • Third-party and emerging technology risk

Job roles

IT Risk ManagerRisk AnalystControl AnalystCompliance ManagerBusiness Analyst (risk)Security Risk Consultant

Where it fits in your path

Planning a degree too? See how this cert earns college credit in the College Credit Navigator.

Build my study plan

  1. Week 1-2: Governance (26%): organizational strategy, risk frameworks, appetite and tolerance.
  2. Week 3: Risk assessment: scenarios, likelihood and impact, risk registers.
  3. Week 4-5: Risk response and reporting (32%): treatment options, control design, KRIs, KPIs, reporting.
  4. Week 6: Technology and security: enterprise architecture, IT operations, security controls and emerging tech.
  5. Week 7: ISACA question database and timed practice exams.

Make it yours: pick your exam date and weekly hours. We'll split your time by domain weight and give you a printable plan.

Exam-day tips

  • Risk response and reporting is the largest domain at 32%.
  • Risk owners, not risk practitioners, accept risk; watch for role questions.
  • Know KRIs vs KPIs vs KCIs.
  • The best answer usually links risk to business objectives.
  • Practice with ISACA's official questions for wording style.

Key terms for this exam

All 90 terms Study with thinQcards™

Commonly confused on this exam

Frequently asked questions

How much does CRISC cost?

$575 for ISACA members and $760 for non-members, plus a $50 application fee.

CRISC vs CISM?

CRISC focuses on IT risk and controls; CISM on running the security program.

Can experience be waived for CRISC?

No. CRISC does not allow experience waivers.

How do I maintain CRISC?

Earn 20 CPE hours annually and 120 every 3 years and pay the annual maintenance fee.

Is CRISC worth it?

Yes for risk and GRC roles in banking, insurance, healthcare and government.

Official page: www.isaca.org. Reviewed November 2026. Vendors change fees and objectives, so confirm with the vendor before you book. Spot something out of date? Tell us.