ALREADY HAVE A CRISC CERTIFICATION? LOG IN TO MYISACA

What is covered on the CRISC exam?

The Certified in Risk and Information Systems Control® (CRISC®) exam consists of 150 questions covering 4 job practice domains, all testing your knowledge and ability on real-life job practices leveraged by expert professionals.

Below are the key domains, subtopics and tasks candidates will be tested on:

26%
Domain 1

Governance
20%
Domain 2

IT Risk Assessment
32%
Domain 3

Risk Response and Reporting
22
Domain 4

Information Technology and Security
GET YOUR EXAM CANDIDATE GUIDE ACCESS EXAM PREP MATERIALS
Illustration of a certificate on the wall with man in front

ISACA’S commitment

Since its inception in 2010, more than 23,000 people have obtained ISACA’s CRISC certification to validate their expertise in using governance best practices and continuous risk monitoring and reporting. The domains, subtopics and tasks are the results of extensive research, feedback and validation from subject matter experts and prominent industry leaders from around the globe.

Job practice areas tested for and validated by a CRISC certification

26% DOMAIN 1 – GOVERNANCE

The governance domain interrogates your knowledge of information about an organization’s business and IT environments, organizational strategy, goals and objectives, and examines potential or realized impacts of IT risk to the organization’s business objectives and operations, including Enterprise Risk Management and Risk Management Framework.

A—ORGANIZATIONAL GOVERNANCE

  1. Organizational Strategy, Goals, and Objectives
  2. Organizational Structure, Roles and Responsibilities
  3. Organizational Culture
  4. Policies and Standards
  5. Business Processes
  6. Organizational Assets

B—RISK GOVERNANCE

  1. Enterprise Risk Management and Risk Management Framework
  2. Three Lines of Defense
  3. Risk Profile
  4. Risk Appetite and Risk Tolerance
  5. Legal, Regulatory and Contractual Requirements
  6. Professional Ethics of Risk Management

20% DOMAIN 2 – IT RISK ASSESSMENT

This domain will certify your knowledge of threats and vulnerabilities to the organization’s people, processes and technology as well as the likelihood and impact of threats, vulnerabilities and risk scenarios.

A—IT RISK IDENTIFICATION

  1. Risk Events (e.g., contributing conditions, loss result)
  2. Threat Modelling and Threat Landscape
  3. Vulnerability and Control Deficiency Analysis (e.g., root cause analysis)
  4. Risk Scenario Development

B—IT RISK ANALYSIS AND EVALUATION

  1. Risk Assessment Concepts, Standards and Frameworks
  2. Risk Register
  3. Risk Analysis Methodologies
  4. Business Impact Analysis
  5. Inherent and Residual Risk

32% DOMAIN 3 – RISK RESPONSE AND REPORTING

This domain deals with the development and management of risk treatment plans among key stakeholders, the evaluation of existing controls and improving effectiveness for IT risk mitigation, and the assessment of relevant risk and control information to applicable stakeholders.

A—RISK RESPONSE

  1. Risk Treatment / Risk Response Options
  2. Risk and Control Ownership
  3. Third-Party Risk Management
  4. Issue, Finding and Exception Management
  5. Management of Emerging Risk

B—CONTROL DESIGN AND IMPLEMENTATION

  1. Control Types, Standards and Frameworks
  2. Control Design, Selection and Analysis
  3. Control Implementation
  4. Control Testing and Effectiveness Evaluation

C—RISK MONITORING AND REPORTING

  1. Risk Treatment Plans
  2. Data Collection, Aggregation, Analysis and Validation
  3. Risk and Control Monitoring Techniques
  4. Risk and Control Reporting Techniques (heatmap, scorecards, dashboards)
  5. Key Performance Indicators
  6. Key Risk Indicators (KRIs)
  7. Key Control Indicators (KCIs)

22% DOMAIN 4 – INFORMATION TECHNOLOGY AND SECURITY

In this domain we interrogate the alignment of business practices with Risk Management and Information Security frameworks and standards, as well as the development of a risk-aware culture and implementation of security awareness training.

A—INFORMATION TECHNOLOGY PRINCIPLES

  1. Enterprise Architecture
  2. IT Operations Management (e.g., change management, IT assets, problems, incidents)
  3. Project Management
  4. Disaster Recovery Management (DRM)
  5. Data Lifecycle Management
  6. System Development Life Cycle (SDLC)
  7. Emerging Technologies

B—INFORMATION SECURITY PRINCIPLES

  1. Information Security Concepts, Frameworks and Standards
  2. Information Security Awareness Training
  3. Business Continuity Management
  4. Data Privacy and Data Protection Principles

SUPPORTING TASKS

  1. Collect and review existing information regarding the organization’s business and IT environments.
  2. Identify potential or realized impacts of IT risk to the organization’s business objectives and operations.
  3. Identify threats and vulnerabilities to the organization’s people, processes and technology.
  4. Evaluate threats, vulnerabilities and risk to identify IT risk scenarios.
  5. Establish accountability by assigning and validating appropriate levels of risk and control ownership.
  6. Establish and maintain the IT risk register and incorporate it into the enterprise-wide risk profile.
  7. Facilitate the identification of risk appetite and risk tolerance by key stakeholders.
  8. Promote a risk-aware culture by contributing to the development and implementation of security awareness training.
  9. Conduct a risk assessment by analyzing IT risk scenarios and determining their likelihood and impact.
  10. Identify the current state of existing controls and evaluate their effectiveness for IT risk mitigation.
  11. Review the results of risk analysis and control analysis to assess any gaps between current and desired states of the IT risk environment.
  12. Facilitate the selection of recommended risk responses by key stakeholders.
  13. Collaborate with risk owners on the development of risk treatment plans.
  14. Collaborate with control owners on the selection, design, implementation and maintenance of controls.
  15. Validate that risk responses have been executed according to risk treatment plans.
  16. Define and establish key risk indicators (KRIs).
  17. Monitor and analyze key risk indicators (KRIs).
  18. Collaborate with control owners on the identification of key performance indicators (KPIs) and key control indicators (KCIs).
  19. Monitor and analyze key performance indicators (KPIs) and key control indicators (KCIs).
  20. Review the results of control assessments to determine the effectiveness and maturity of the control environment.
  21. Report relevant risk and control information to applicable stakeholders to facilitate risk-based decision-making.
  22. Evaluate alignment of business practices with risk management and information security frameworks and standards.

Getting ready for the exam

ISACA offers a variety of exam preparation resources including group training, self-paced training and study resources in various languages to help you prepare for your certification exam. Choose what works for your schedule and your studying needs.

ACCESS ALL CRISC EXAM PREP MATERIALS

ISACA glossary and CRISC translations

Some CRISC terms can be lost in translation. That is why ISACA has translated our CRISC Terminology List into numerous languages, ensuring learners fully understand the materials. Please see the list of translations below. To learn more about key industry terms, please explore the ISACA glossary here.

Chinese Simplified | Korean | Spanish