Which BEST describes risk appetite?
Domain 1
Answer: B · whyAppetite is the broad, board-level willingness to take risk; tolerance is the acceptable variation around it.
ISACA · Risk Management
CRISC - Certified in Risk and Information Systems Control
IT risk analysts and managers, GRC professionals, control owners, business analysts and project managers who identify and manage IT risk through IS controls. Very relevant for TPRM and ERM roles.
Overview
- Prerequisites
- Pass the exam and apply within 5 years. Certification needs 3+ years of experience in IT risk management and IS control; ISACA allows no experience waivers or substitutions. US$50 application fee.
- Maintenance
- ISACA CPE policy: at least 20 CPE hours every calendar year and 120 CPE hours over a rolling 3-year cycle, plus the annual maintenance fee (US$45 members / US$85 non-members; reduced to US$25/US$50 for a 3rd+ ISACA certification). From 1 January 2027 at least 90 of the 120 hours must align to the certification's exam content outline; up to 30 may be broader professional development.
- Outline in effect
- 3 Nov 2025
Exam facts
- Questions
- 150
- Duration
- 4 hours (240 minutes)
- Question types
- Multiple choice, one best answer
- Passing score
- 450 on a 200-800 scaled score
- Format
- Linear (fixed form), computer-based
- Delivery
- PSI test centres or remote online proctoring; 6-month eligibility window
- Languages
- English, Spanish, Japanese
Cost
- Member
- US$575
- Non-member
- US$760
- Notes
- Plus US$50 application fee. Optional US$75 eligibility extension.
Domains & weights
- Domain 1 - Governance26%
- Domain 2 - Risk Assessment22%was 20%
- Domain 3 - Risk Response and Reporting32%
- Domain 4 - Technology and Security20%was 22%
Upcoming changes
- ISACA CPE policy change from 1 Jan 2027.
Study plan
- Week 1
Domain 1 - Organisational governance
- Strategy, structure, culture, policies, business resilience, asset management.
- Diagnostic 50 questions.
- Week 2
Domain 1 - Risk governance
- ERM, three lines model, risk profile, appetite vs tolerance, frameworks and legal/contractual requirements (ISO 31000, COSO ERM, NIST RMF, ISO/IEC 27005).
- Week 3
Domain 2 - Risk identification
- Risk events, threat modelling, vulnerability management, risk scenario development.
- Week 4
Domain 2 - Risk analysis
- BIA, risk register, qualitative/quantitative methods, inherent vs residual risk.
- Mixed 80 questions Domains 1-2.
- Week 5
Domain 3 - Response and controls
- Response options, ownership, vendor/supply-chain risk, issues and exceptions.
- Control types, design, selection, testing methods.
- Week 6
Domain 3 - Monitoring and reporting
- KRIs vs KPIs vs KCIs, data aggregation, heat maps, dashboards, emerging-risk reporting.
- Week 7
Domain 4
- Enterprise architecture, operations, SDLC, data life cycle, project/portfolio, resilience, emerging tech (including AI).
- Security principles, awareness, privacy. Timed 150-question mock.
- Week 8
Review
- Re-study weakest domain; second timed mock; review the ISACA glossary terms for risk.
Exam tips
- Read every question for the role you are playing (auditor, risk practitioner, security manager): ISACA rewards the answer that fits that role, not the most technical one.
- Watch qualifier words such as FIRST, BEST, MOST, PRIMARY and GREATEST: several options are often true, and only one is the best next step.
- There is no penalty for wrong answers, so never leave a question blank.
- Budget about 1.5 minutes per question (150 questions in 240 minutes) and flag long scenario items to revisit.
- Bring a current, original, government-issued photo ID whose name exactly matches your ISACA profile; arrive 30 minutes early at a PSI centre, or run the PSI system check well before a remote exam.
- The risk practitioner advises and facilitates; the risk owner decides and accepts.
- Prefer answers that tie risk back to business objectives and appetite rather than purely technical severity.
Common pitfalls
- Confusing KRIs (risk exposure trend) with KPIs (performance) and KCIs (control health).
- Choosing 'implement a control' before the risk has been analysed and an owner assigned.
- Forgetting that risk registers must be kept current and feed the enterprise risk profile.
- Using old 2021-outline materials: Risk Assessment rose to 22% and Technology & Security dropped to 20% from 3 Nov 2025.
Resources & official links
Official
- CRISC Exam Content Outline (effective 3 Nov 2025)
- CRISC Review Manual and QAE Database (ISACA)
- ISACA Certification Exam Candidate Guide (CISA, CRISC, CISM, CGEIT, CDPSE)
Also widely used
- ISACA Risk IT Framework
- ISO 31000:2018 and ISO/IEC 27005:2022 for risk process vocabulary
- Hemang Doshi CRISC study guide
- ISACA Engage CRISC study groups
Sources
- ISACA CRISC page (fees)
- ISACA CRISC Exam Content Outline
- ISACA press release: CDPSE and CRISC exams updated (7 Apr 2025)
- ISACA Certification Exam Candidate Guide (CISA, CRISC, CISM, CGEIT, CDPSE)
- ISACA Support: requirements to maintain my certification
- ISACA CPE Policy changes for 2027
Last verified 19 Oct 2026. Values marked “check official site” could not be confirmed from an official source.
Practice questions
In the three lines model, the risk management function is typically the:
Domain 1
Answer: B · whyRisk and compliance functions sit in the second line; operations are first; internal audit is third.
What should a risk practitioner do FIRST when a new regulation affects a business process?
Domain 1
Answer: B · whyUnderstanding impact and obligations comes before choosing a response.
Which is the MOST useful input when developing realistic IT risk scenarios?
Domain 2
Answer: B · whyGood scenarios combine relevant threats, vulnerabilities and assets.
Residual risk is BEST defined as:
Domain 2
Answer: B · whyResidual risk remains after controls and other responses.
Which item should the risk register contain for every risk?
Domain 2
Answer: B · whyEach risk needs an owner who is accountable for its response.
Buying cyber insurance is an example of which response?
Domain 3
Answer: C · whyInsurance transfers (shares) the financial impact to a third party.
A critical vendor refuses to share its SOC 2 report. The BEST next step is to:
Domain 3
Answer: B · whySeek compensating assurance and let the accountable owner decide with full information.
Which indicator gives EARLY warning that a risk is approaching tolerance?
Domain 3
Answer: B · whyKey risk indicators are designed to signal increasing exposure early.
Control testing shows a control is designed well but frequently not performed. This is a weakness in:
Domain 3
Answer: B · whyA well-designed control that is not consistently performed fails on operating effectiveness.
The organisation plans to adopt a generative AI tool. From a risk perspective, what should be done FIRST?
Domain 4
Answer: B · whyEmerging technology should be evaluated for threats and opportunities before adoption.
Which BEST supports data life cycle risk management?
Domain 4
Answer: B · whyClassification, retention and disposal rules manage risk across the data life cycle.