ISACA

Free CRISC - Certified in Risk and Information Systems Control Practice Questions

The CRISC - Certified in Risk and Information Systems Control exam is up to 150 questions in 240 minutes, and the voucher costs $575. CertCrush provides 400 syllabus-aligned practice questions across all 4 exam domains, each with a full explanation. Free to try, no account required.

The Certified in Risk and Information Systems Control (CRISC) certification validates a professional's ability to identify, assess, respond to and report on enterprise IT risk, and to design and monitor the controls that keep that risk inside appetite. It is ISACA's flagship credential for risk practitioners who sit between the technology estate and the people who own the business consequences.

Practice content last updated August 2026 · Independently written and aligned to ISACA’s published exam objectives.

About the CRISC - Certified in Risk and Information Systems Control Exam

CRISC is the certification for the person in the room who has to say how bad it would actually be. Where CISM is about running a security programme and CISA is about auditing controls after the fact, CRISC sits earlier in the chain: identifying IT risk, sizing it in terms a business owner recognises, choosing a response, and then proving the controls behind that response still work. ISACA aims it at risk practitioners, control owners, compliance leads and the security managers who keep being asked to quantify things. The exam is 150 multiple-choice questions in four hours, and its difficulty is not vocabulary — it is judgement. CRISC questions are overwhelmingly scenario-based and frequently ask for the BEST or FIRST action among four defensible options. Candidates who know the material still fail because they answer as a technologist rather than as a risk advisor: recommending a fix when the correct answer is to assess impact, or accepting a risk that was never theirs to accept. Domain 3, Risk Response and Reporting, carries 32% of the exam on its own, and Governance adds another 26%, so more than half the paper turns on ownership, appetite, escalation and reporting rather than on technology. The current exam content outline took effect on 3 November 2025, shifting weight toward Risk Assessment and away from Technology and Security. This course is built to that outline, with every practice question mapped to one of the four live domains so you can see exactly where your judgement is holding up and where it is not.

Exam Domains Covered

Exam Format & Details

The CRISC exam consists of 150 multiple-choice questions over a 4-hour (240-minute) time limit. There are no performance-based or simulation items — every question is multiple choice, and most are scenario-based. The passing score is 450 on a scaled range of 200-800. The exam covers four domains: Governance (26%), Risk Assessment (22%), Risk Response and Reporting (32%) and Technology and Security (20%), under the exam content outline that took effect on 3 November 2025. The exam is delivered at PSI test centres and by remote online proctoring. Registration costs $575 USD for ISACA members and $760 USD for non-members. Passing the exam is only part of certification: candidates must also submit evidence of at least three years of relevant IT risk management and IS control experience before the CRISC designation is awarded.