How to study for CRISC: risk decisions and resources

CRISC rewards people who can connect a technical weakness to a business consequence, an owner and a proportionate response. Knowing security controls helps, but the exam keeps asking a different question: given this organisation's objectives and appetite for risk, what should happen next, and who decides?

Start where the marks are

ISACA's CRISC exam content outline weights the four domains as governance 26%, risk assessment 22%, risk response and reporting 32%, and technology and security 20%. Risk response and reporting is the largest domain, but it depends on the first two: you cannot judge a response without knowing who owns the risk and how it was assessed. Study the domains in order, then return to response and reporting with mixed questions.

Concepts to keep apart

• Risk appetite and risk tolerance. Appetite is the broad amount of risk the organisation is willing to pursue; tolerance is the acceptable variation for a particular risk or objective.

• Inherent and residual risk. The position before controls, and the position after them.

• Risk owner and control owner. The person accountable for the risk decision, and the person who runs the control.

• Risk indicators and performance indicators. A key risk indicator tells you exposure is changing; a control or performance indicator tells you whether a control or process is working.

A common trap is an option that is right about the technology but wrong about one of these distinctions, often because it gives the decision to the wrong person.

Test the whole chain on one case

A critical service depends on a single external provider, and there is no tested alternative if the provider fails for several days. Write out the chain: the business objective the service supports, the interruption scenario, the assumptions behind its likelihood and impact, the possible responses, the risk owner and how the response would be monitored.

Now test individual controls against it. A contract with service credits may compensate for a loss without restoring the service. A backup arrangement that has never been tested does not show the organisation can recover. Then change one constraint, such as the longest interruption the business can tolerate, and see whether the right response changes. If it does not, your reasoning is probably following the control rather than the risk.

Keep the error log in risk-process order

Sort mistakes by where the chain broke: scenario definition, assessment assumptions, ownership, response selection or monitoring. Record the fact you missed and the decision it changed. If you chose a response without understanding the objective, the repair is to define the scenario properly, not to learn more control names.

Review correct guesses too. If you cannot explain why the rejected options were less appropriate, the answer depended on familiarity with the question.

Official resources

ISACA's own CRISC preparation consists of the CRISC Review Manual, the CRISC Questions, Answers & Explanations Database, an online review course and a free practice quiz. The manual explains; the question database shows how ISACA phrases risk decisions and why its answers win. Check that any third-party material matches the current outline, because older editions used different domain weights.

Exam and certification

The exam is 150 multiple-choice questions in four hours, about 96 seconds each. Read ISACA's candidate guide for delivery rules before booking.

Passing does not make you certified. CRISC certification needs three years of relevant experience across at least two of the four domains, within the ten years before you apply, and you must apply within five years of passing. If your work is closer to audit evidence than risk ownership, compare CISA and CRISC before committing.

Qualifico's CRISC practice and flashcards help with recall and with separating the concepts above. They do not reproduce ISACA's scaled scoring; use the official question database to judge readiness. For the format in detail, see the CRISC exam guide.