Prepare for CRISC by linking each response to the risk, criteria and authority described in the scenario. The worked exercise compares two treatments against a supplied residual-loss limit and explains why treatment cost is a separate figure.
Which CRISC outline should you use?
Use the Certified in Risk and Information Systems Control (CRISC) outline effective from 3 November 2025.
Risk Assessment now carries 22% and Technology and Security 20%. If your notes show the older 20% and 22% pairing, compare their coverage with the current outline.
The outline covers governance, assessment, response and reporting, and technology and security. Practise the supporting tasks as well as the named concepts; a list of terms alone does not show how you would use them.
Sources: CRISC® Exam Content Outline — Domain overview, subtopics and supporting tasks; ISACA Updates CDPSE and CRISC Exams to Reflect Latest Risk and Privacy Priorities — 2025 press release with updated CRISC domain weights and dates
What should you review in the four domains?
Risk Response and Reporting is the largest domain at 32%. Review all four areas and use practice gaps alongside these weights to plan your work.
The percentages describe content distribution. The tasks below are study suggestions, not mandatory business procedures or separate domain passing thresholds.
| Domain | Weight | What it covers | A useful review task |
|---|---|---|---|
| 1. Governance | 26% | Organizational strategy and structure, culture and ethics, policies and resilience, ERM, lines of defense, risk profile, risk appetite and tolerance, frameworks and legal or regulatory requirements | Take one business objective from your own workplace and trace which IT risk it creates, then find where appetite and tolerance for that risk are stated |
| 2. Risk Assessment | 22% | Risk events, threat modeling, vulnerability management, risk scenarios, assessment concepts and standards, business impact analysis, risk register, analysis methods, inherent and residual risk | Build an explicitly stated risk scenario, identify its assumptions and compare inherent and residual assessments using your reference material. |
| 3. Risk Response and Reporting | 32% | Response options, risk and control ownership, vendor and supply chain risk, exceptions and exemptions, control design and testing, risk action plans, KRIs, KCIs and KPIs, reporting techniques, emerging risks | Compare treatment options with the supplied criteria, name the designated owner and identify the evidence needed to monitor the response. |
| 4. Technology and Security | 20% | Technology principles, roadmaps and enterprise architecture, operations management, SDLC, data lifecycle, resilience and recovery, emerging technologies, security frameworks, awareness training, data privacy | Explain how one operational change — a new release process, a cloud migration — changes the risk and control picture |
Sources: CRISC® Exam Content Outline — Domain overview, subtopics and supporting tasks; ISACA Updates CDPSE and CRISC Exams to Reflect Latest Risk and Privacy Priorities — 2025 press release with updated CRISC domain weights and dates
Practise comparing two risk treatments
Only Treatment A meets the supplied residual-loss limit. Its cost is a separate input, and approval belongs to the owner named in the scenario.
This original practice uses fictional estimates, a specific monetary limit and assigned decision authority. The estimates are given assumptions, not an ISACA formula or a forecast of actual losses.
Practice exercise
A fictional policy gives risk owner Dana sole authority to approve responses and exceptions for one defined scenario. The analyst may recommend a response but cannot accept risk. The residual expected annual loss limit is USD 20,000. All estimates are given: Treatment A leaves residual expected annual loss of USD 15,000 and costs USD 12,000 annually; Treatment B leaves USD 25,000 and costs USD 5,000 annually. Neither has yet been approved. Which option meets the limit, by how much does B exceed it, and what should the analyst recommend to Dana?
Show answer
Only A meets the limit: USD 15,000 ≤ USD 20,000. B exceeds it by USD 25,000 − USD 20,000 = USD 5,000. Recommend A as the option that meets the stated limit and present both sets of figures to Dana for a decision. The analyst cannot approve B’s above-limit exposure or an exception.
Annual treatment cost is separate from residual expected annual loss; subtracting B’s USD 5,000 cost from its USD 25,000 residual estimate would incorrectly make it appear to meet the limit. Dana’s authority to consider exceptions does not mean one has already been approved. This comparison identifies the option meeting the supplied criterion; it does not prove A is best among all possible treatments or guarantee actual losses. Other questions can supply different metrics, constraints and roles.
Sources: CRISC® Exam Content Outline — Domain overview, subtopics and supporting tasks
How can you turn the outline into useful practice?
Work from concepts to explicit scenarios, then use mixed practice to check whether you can explain the decision.
Review appetite, tolerance, inherent and residual risk, response options, ownership and the listed risk, control and performance indicators in your current materials. For each example, identify what is being measured and which decision it informs.
In a treatment question, keep estimates, costs, thresholds and approval authority separate. Check whether a number is given or must be calculated before introducing a formula.
- Check every domain and its detailed subtopics against your materials; use weights and your actual practice gaps to allocate time.
- After an error, record the concept, role, criterion or evidence you misread and revisit the corresponding objective.
- Explain why the alternatives fail under the supplied facts, then practise mixed timed questions. Treat practice percentages as feedback, not predicted scaled scores.
Sources: CRISC® Exam Content Outline — Domain overview, subtopics and supporting tasks; ISACA Certification Exams Candidate Guide — Program summary, registration, exam day rules, scoring and retake policy
Can you take CRISC before meeting the experience requirement?
Yes. You can sit the exam before you qualify for certification. Passing alone does not award the credential.
Certification requires at least three years of relevant professional work experience across at least two of the four CRISC domains.
The candidate guide lists no experience waivers or substitutions. Verify that your documented work covers the professional tasks in the current application.
Apply within five years of passing. The relevant work experience must fall within the ten years preceding your application and be verified through the application process. Certification also requires the application fee and agreement to ISACA’s professional ethics requirements.
Sources: Earn a CRISC® Certification — Certification requirements, application and maintenance; ISACA Certification Exams Candidate Guide — Program summary, registration, exam day rules, scoring and retake policy
What should you expect on exam day?
CRISC has 150 multiple-choice questions in 240 minutes. Each has four options and one best answer. The exam is closed book and is delivered through PSI at a testing center or by remote proctoring.
Read the stated role, constraints and qualifiers such as BEST or MOST. ISACA says there is no penalty for wrong answers, so answer every question. Practise pacing across the full session, including time for review.
The passing standard is 450 on the 200–800 scaled score. It is not a raw percentage or a fixed correct-answer count. The guide mentions unscored pretest items without specifying their number. Domain weights describe content coverage; the domain feedback is informational, not a set of separate passing thresholds.
A preliminary result appears on screen. The official result follows within 10 working days.
Sources: CRISC® Exam Content Outline — Domain overview, subtopics and supporting tasks; ISACA Certification Exams Candidate Guide — Program summary, registration, exam day rules, scoring and retake policy
What should you check before booking?
Registration gives you six months of exam eligibility. Check the current candidate guide, your appointment instructions and the booking price before paying.
You can reschedule without penalty at least 48 hours before your appointment, within the eligibility period. The handbook describes one optional paid six-month extension under specific timing conditions; it is not automatic.
After a failed first attempt, the retake waits are 30 days, then 90 days after the second and third attempts. The limit is four total attempts in a rolling 12 months, with a fee for each attempt.
- Check that your original, valid government-issued ID has the required name, photo and signature and matches your registration.
- For remote testing, complete the compatibility check and review the workspace and check-in rules before your appointment.
- Keep notes, calculators and extra screens out of the testing area. Follow the proctor’s instructions; approved breaks consume exam time.
- If you need accommodations, arrange approval through ISACA before scheduling.
Sources
Facts checked: