CRISC exam: structure and IT risk preparation

About the CRISC exam

Certified in Risk and Information Systems Control is ISACA's certification for IT risk management. The exam tests whether you can connect an organisation's objectives to the IT risks that threaten them, recommend a proportionate response, give the decision to the right owner and report in a way that supports that decision.

If you are deciding between risk and audit, start with CISA vs CRISC.

Exam at a glance

ISACA's 2026 candidate guide describes 150 multiple-choice questions in four hours, about 96 seconds each, with four options and one best answer per question. Some scenarios support several questions. You can sit at a test centre or with remote proctoring, and results are scaled rather than reported as a percentage.

What does the CRISC exam test?

ISACA's exam content outline has four domains:

• Governance (26%): organisational context, roles, risk appetite and tolerance, frameworks and policy.

• Risk assessment (22%): identifying risk scenarios and analysing their likelihood and impact.

• Risk response and reporting (32%): choosing and tracking responses, control design and monitoring, and reporting risk with indicators.

• Technology and security (20%): the technologies, architecture and security principles that risks and controls sit within.

Response and reporting is the largest domain, but answers there depend on the governance and assessment work that comes before it.

What makes the CRISC exam challenging?

A technically effective control is not automatically the right response. The best answer fits the business objective, the organisation's risk appetite, the cost of the control and who owns the risk. Keep three roles distinct: the risk practitioner who analyses and recommends, the risk owner who decides, and the control owner who operates the control.

Also keep inherent and residual risk apart, and remember that accepting a risk is a legitimate response when the right person makes that decision within appetite.

A reporting example to practise with

A security dashboard shows that 97% of servers were patched within 30 days last quarter, and the board is told the vulnerability risk is under control. Is that the right conclusion?

The 97% is a control performance measure: it shows the patching process mostly works. It says little about exposure. A more useful key risk indicator might be the number of internet-facing systems with critical vulnerabilities older than the agreed window, because the 3% that missed could all sit on the most exposed systems. A good answer separates "is the control working?" from "is our exposure within appetite?", and asks which one the board actually needs for its decision.