CISA vs CRISC: audit, risk and certification fit

CISA and CRISC are both ISACA certifications and both deal with information systems controls, but they ask different questions of those controls. CISA, the Certified Information Systems Auditor, asks whether a control can be relied on and what evidence proves it. CRISC, Certified in Risk and Information Systems Control, asks what risk the business is carrying, who owns it and what should be done about it.

Choose by the question your work asks most often.

The two at a glance

• Focus. CISA: auditing information systems, evaluating controls and reporting findings. CRISC: identifying, assessing, responding to and reporting IT risk in business terms.

• Domains. CISA's five domains are information system auditing process (18%), governance and management of IT (18%), information systems acquisition, development and implementation (12%), information systems operations and business resilience (26%) and protection of information assets (26%). CRISC's four domains are governance (26%), risk assessment (22%), risk response and reporting (32%) and technology and security (20%).

• Exam. Both are 150 multiple-choice questions in four hours, each with four options and one best answer.

• Experience for certification. CISA: five years of information systems audit, control or security work. CRISC: three years of relevant experience across at least two of the four CRISC domains. For both, the experience must fall within the ten years before you apply.

• Keeping it. Both require at least 120 hours of continuing professional education every three years, with a minimum of 20 a year.

One control, two lenses

Suppose a business reviews privileged access every quarter. A CISA candidate asks: what is the control meant to achieve, how would I test that the reviews actually happened, which records would show it, and what do I conclude if two quarters are missing? The output is an audit finding supported by evidence.

A CRISC candidate looks at the same control and asks: what could go wrong if privileged access is not reviewed, how likely and how serious is that, who owns the risk, and is the current control enough for the organisation's risk appetite? The output is information for a risk decision and a way of monitoring it.

The control is the same. The professional question is different, and so is the right answer in each exam. That is why strong security knowledge is not enough for either: CISA questions reward the auditor's sequence and evidence, CRISC questions reward ownership and proportion.

Which one first?

If your work involves planning audits, testing controls or writing findings, in internal audit or an external IT audit team, CISA's outline will feel most relevant. If you sit in a risk, security governance or compliance function that assesses exposures and advises on responses, CRISC is the closer match. If your role covers both, list the tasks you will need to do well in the next year and see which outline covers more of them.

Taking both at once is rarely efficient. The domains overlap, but the habits of thought each exam rewards are different enough to deserve separate preparation.

Experience is the slow part

You can sit either exam before you have the experience, and passing does not make you certified. ISACA asks you to apply for CISA or apply for CRISC within five years of passing, with the required experience evidenced. If you are early in your career, check the timing before you book, so the pass does not lapse before your experience catches up.

How preparation differs

For CISA, organise study around the chain from audit objective to risk, control and evidence; how to study for CISA works through an example. For CRISC, organise it around the chain from business objective to risk scenario, response, owner and monitoring; how to study for CRISC shows how. The CISA and CRISC exam guides cover each format.

Qualifico provides question practice and flashcards for both exams. It does not assess experience, reproduce ISACA's scaled scoring or confer certification.