By TK | March 8, 2026
Let me tell you something that surprises almost every candidate I speak with about CRISC.
They come in expecting it to feel like a technical risk exam — something you can power through with a solid understanding of frameworks, threat categories, and control taxonomies. And then they sit in front of the first practice question and realise: this is fundamentally different from any certification they've studied for before.
CRISC — the Certified in Risk and Information Systems Control — is not a knowledge test. It's a judgement test. ISACA isn't asking you to recite what risk frameworks say. It's asking you to think like a risk practitioner who has seen real consequences and has learned to prioritise, communicate, and act accordingly. That distinction changes everything about how you prepare.
If you're considering CRISC in 2026, this is the article I wish had existed when I started. Let's go through exactly what the exam looks like now, what's changed, and how to approach it.
What Is CRISC, and Who Is It Actually For?
CRISC stands for Certified in Risk and Information Systems Control. It's issued by ISACA — the same body behind CISA, CISM, and CGEIT — and it sits squarely at the intersection of IT risk management and enterprise business operations.
Where CISA is about auditing systems and CISM is about managing security programmes, CRISC is about owning the risk conversation between IT and the business. It asks: given what could go wrong, what does the business actually choose to accept, mitigate, transfer, or avoid — and can you facilitate that decision intelligently?
CRISC holders are typically risk managers, IT risk analysts, internal auditors moving into risk roles, control specialists, compliance leads, and professionals working in GRC (Governance, Risk and Compliance) functions. Increasingly, it's also pursued by consultants and project managers who need a credible risk language to work across business and technology stakeholders.
One thing worth knowing upfront: CRISC consistently ranks among the highest-paying IT certifications globally. That's not a coincidence — organisations genuinely struggle to find professionals who can translate IT risk into business-relevant terms, and CRISC signals exactly that capability.
The 2026 Exam Structure: What's Changed
ISACA refreshed the CRISC job practice framework and its exam weighting in recent years, and if you're using older study materials — particularly anything pre-2022 — you may be preparing for a version of the exam that no longer exists.
Here's the current structure as of 2025–2026:
Format: 150 questions (including 15 unscored pretest items — you won't know which ones) Duration: 4 hours Delivery: Computer-based testing at Pearson VUE centres worldwide, plus remote proctoring available Passing score: 450 out of 800 (on ISACA's scaled scoring system) Question types: Primarily scenario-based multiple choice; no drag-and-drop or simulations
The Four Domains and Their Weightings
The headline shift in the updated framework is the elevated weight of Domain 1 (Governance) and Domain 3 (Risk Response and Reporting). Combined, they now represent 58% of your exam — more than half. If you're spending the majority of your study time on technical risk and control content, you're working backwards.
ISACA's message is clear: CRISC is increasingly a governance and communication credential. The technical foundation matters, but your ability to identify what the business needs, translate risk into decision-relevant language, and report meaningfully to stakeholders is what the exam is now designed to test.
Domain 1: Governance (26%)
Governance is the lens through which everything else in CRISC is evaluated. This domain is about the structures, policies, and accountability mechanisms that define how an organisation makes risk decisions — not just whether the right controls exist.
Key concepts tested here include:
Organisational risk appetite and risk tolerance. These are frequently confused on the exam. Risk appetite is the broad-level amount and type of risk an organisation is willing to accept in pursuit of its objectives. Risk tolerance is the acceptable deviation from appetite in specific areas. You'll be expected to apply both in scenario questions — correctly identifying when a proposed action exceeds tolerance even if it sits within appetite.
Risk culture. ISACA pays significant attention to the behavioural and cultural dimensions of risk — how leadership tone, incentive structures, and communication norms either support or undermine sound risk management. Questions often ask what a risk practitioner should do first when they observe cultural issues, not just what the ideal state looks like.
Three lines of defence model. Understand this deeply — which function sits in which line, what accountability each line carries, and critically, how the model breaks down in practice. CRISC questions love edge cases where lines are blurred or where the model is being misapplied.
Risk ownership. On CRISC, risk must be owned by someone in the business — not IT, not the risk function. Questions frequently test whether candidates understand that IT identifies and assesses risk while the business owns and accepts it.
Domain 2: IT Risk Assessment (20%)
This is the domain most candidates feel most comfortable entering — and where they're most likely to get complacent.
IT Risk Assessment covers the identification, analysis, and evaluation of risk. But the exam doesn't test whether you know the steps of a risk assessment process. It tests whether you can make the right judgements within that process when circumstances are messy.
Key areas:
Inherent vs. residual risk. You'll see this distinction applied in complex scenarios — not just defined. Know what drives the gap between the two, and when residual risk remains above tolerance despite controls.
Qualitative vs. quantitative risk analysis. CRISC tests your judgement on when each approach is appropriate, not just what they are. Qualitative is faster and more accessible for scenarios with limited data. Quantitative is more defensible for high-stakes decisions with available data. The exam often presents situations where you choose between them.
Threat and vulnerability landscape. You need a working vocabulary of threat categories, attack vectors, and vulnerability types — but the exam almost always frames these in a risk impact context rather than a purely technical one. The question is never "what is a SQL injection?" — it's "given this vulnerability profile, what risk treatment approach is most appropriate?"
Risk register management. Maintaining an accurate, current risk register is central to this domain. Know what belongs in it, what triggers an update, and what the risk register communicates to different audiences.
Domain 3: Risk Response and Reporting (32%)
This is the highest-weighted domain and the one that most clearly separates candidates who pass from those who don't.
Risk response is about what you do after you've assessed a risk. Reporting is about how you communicate risk status, trends, and decisions to the right people at the right time in the right format.
The four risk responses. Avoid, mitigate, transfer, and accept. CRISC goes well beyond asking you to define these — it asks you to choose between them in nuanced scenarios where multiple responses seem reasonable. The distinguishing logic is almost always business context: what does the organisation's risk appetite say? What's the cost-benefit of mitigation? Is transfer actually available and effective for this risk type?
Control design and implementation. Controls are the mechanism by which risk is mitigated. CRISC tests control selection, control design principles (preventive vs. detective vs. corrective; automated vs. manual), and the concept of control effectiveness. A badly designed control can be worse than no control — it creates false assurance.
Key Risk Indicators (KRIs). KRIs are one of CRISC's signature topics. A KRI is a metric that provides early warning that risk is increasing — before a risk event occurs. Distinguishing KRIs from KPIs and KCIs, knowing what makes a KRI useful (sensitivity, reliability, measurability), and understanding how they feed into risk reporting are all tested.
Reporting to the board and senior management. Risk reporting for board-level consumption is not the same as operational risk reporting. CRISC tests your ability to tailor risk information — translating technical exposure into business impact language, focusing on trends rather than point-in-time snapshots, and presenting risk in terms of strategic objectives.
Domain 4: Information Technology and Security (22%)
This is the technical foundation domain — and it's where candidates with deep IT backgrounds often feel most at home. Don't let that familiarity become overconfidence.
CRISC tests IT and security knowledge in a very specific way: always through the risk lens. The question is never "how does encryption work?" — it's "given this encryption gap, what is the risk to the organisation and what is the most appropriate response?"
Topics covered include:
IT infrastructure components — networks, cloud, virtualisation, endpoints. Know their risk profiles, not just their architectures.
Information security principles — CIA triad (confidentiality, integrity, availability), access control models, identity and access management, vulnerability management, and incident response. Again, always in the context of risk identification and treatment.
Emerging technology risks — cloud migration, third-party risk, AI/ML adoption, IoT, and shadow IT. ISACA has been updating this area to reflect current enterprise environments. Expect questions that place risk in the context of cloud shared responsibility models and third-party/vendor dependencies.
Business continuity and disaster recovery — BCP and DRP from a risk perspective. Know the difference between RTO and RPO, what drives them, and how their absence or failure creates residual risk.
What Makes CRISC Questions Hard
This deserves its own section, because candidates are often caught off guard by the nature of the difficulty.
CRISC questions are hard because they are genuinely ambiguous. Two or even three of the four answers are often plausible. The question isn't "do you know what risk appetite is?" — it's "given this specific business context, which action best reflects what a competent risk practitioner would do first?"
A few patterns to watch for:
"First" and "most important" are critical keywords. ISACA consistently tests sequencing — not what to do, but what to do before other things. In risk, the sequence almost always follows: understand context → identify/assess → respond → monitor → communicate.
The business perspective almost always wins. When in doubt between a technically correct answer and a business-aligned answer, ISACA favours business alignment. Risk practitioners serve the business — they don't override it.
Communication before action. If a question asks what to do when you've identified a significant new risk, the CRISC-correct answer is almost always to report it to the appropriate stakeholder before implementing a response unilaterally.
The risk owner is not IT. Any answer that places risk ownership in IT, the security function, or the risk management team is almost always wrong. Risk ownership sits with the business process owner.
Experience Requirements and Exam Eligibility
CRISC requires three years of cumulative work experience in IT risk management and IS control across at least two of the four CRISC domains — with mandatory experience in Domain 1 (Governance) or Domain 2 (IT Risk Assessment).
Key points:
This makes CRISC somewhat self-selecting: most candidates who pursue it already have meaningful risk or audit experience. If you're earlier in your career and the experience requirement isn't quite there yet, it's worth noting that passing the exam now and accumulating experience before the five-year window closes is a legitimate strategy some candidates use — though it carries scheduling risk.
Study Timeline and Approach
Most working professionals with relevant experience complete their CRISC preparation in 3 to 5 months at a pace of roughly 60 to 90 focused minutes on weekdays and 2 to 3 hours on weekends.
The variables that affect that timeline most:
Your existing risk fluency. If you're coming from an internal audit, GRC, or risk management background, much of Domain 2 and parts of Domain 4 will feel familiar. You can move through those sections faster and invest more time in Domains 1 and 3, which are heavier and more concept-dense.
Your experience with ISACA's reasoning style. If you've held CISA or CISM, you already understand how ISACA frames questions and what it means for an answer to be "most correct." That mental model transfers directly and typically cuts 3 to 4 weeks off preparation time.
How you engage with practice questions. The single most common preparation mistake I see is treating practice questions as a completion task — working through a question bank and recording your score. That approach will not pass you. The right practice is to analyse every wrong answer and every right answer, understanding the reasoning before moving on. Quality over volume, every time.
Recommended resources for 2026:
Is CRISC the Right Certification for You Right Now?
CRISC is one of the most valuable certifications available in the IT governance and risk space. But it's worth asking honestly whether the timing is right.
CRISC makes strong sense if:
Consider waiting if:
Ready to Start?
CRISC is a challenging exam — but it rewards the right kind of preparation. The candidates I've seen succeed aren't necessarily the ones with the most experience or the deepest technical knowledge. They're the ones who genuinely internalised how a risk practitioner thinks, and who practised applying that reasoning under exam conditions until it felt natural.
👉 Book a free 30-minute discovery call — if you're working out whether CRISC is the right fit, or you want to map out a study plan that actually works around your schedule, let's talk.
If you're also evaluating CISA or CISM alongside CRISC, the CISA Domain Overview Guide is a good free resource to orient yourself on how ISACA structures each credential.
And when you're ready to go deep into structured preparation, browse the full course library — including CRISC, CISA, and CISM prep built around the way real professionals study.
The exam is manageable. The thinking behind it is learnable. You've got this.
Preparing for CRISC in 2026? Drop a comment below with where you are in the process — I read every one and respond personally.