ISACA · Exam reference
About the CRISC - Certified in Risk and Information Systems Control exam
The Certified in Risk and Information Systems Control (CRISC) certification validates a professional's ability to identify, assess, respond to and report on enterprise IT risk, and to design and monitor the controls that keep that risk inside appetite. It is ISACA's flagship credential for risk practitioners who sit between the technology estate and the people who own the business consequences.
10
Sample questions
240 min
Exam time limit
70%
Practice pass mark
$575
Exam voucher
CRISC is the certification for the person in the room who has to say how bad it would actually be. Where CISM is about running a security programme and CISA is about auditing controls after the fact, CRISC sits earlier in the chain: identifying IT risk, sizing it in terms a business owner recognises, choosing a response, and then proving the controls behind that response still work. ISACA aims it at risk practitioners, control owners, compliance leads and the security managers who keep being asked to quantify things. The exam is 150 multiple-choice questions in four hours, and its difficulty is not vocabulary — it is judgement. CRISC questions are overwhelmingly scenario-based and frequently ask for the BEST or FIRST action among four defensible options. Candidates who know the material still fail because they answer as a technologist rather than as a risk advisor: recommending a fix when the correct answer is to assess impact, or accepting a risk that was never theirs to accept. Domain 3, Risk Response and Reporting, carries 32% of the exam on its own, and Governance adds another 26%, so more than half the paper turns on ownership, appetite, escalation and reporting rather than on technology. The current exam content outline took effect on 3 November 2025, shifting weight toward Risk Assessment and away from Technology and Security. This course is built to that outline, with every practice question mapped to one of the four live domains so you can see exactly where your judgement is holding up and where it is not.
Exam Domains Covered
Exam Format & Details
The CRISC exam consists of 150 multiple-choice questions over a 4-hour (240-minute) time limit. There are no performance-based or simulation items — every question is multiple choice, and most are scenario-based. The passing score is 450 on a scaled range of 200-800. The exam covers four domains: Governance (26%), Risk Assessment (22%), Risk Response and Reporting (32%) and Technology and Security (20%), under the exam content outline that took effect on 3 November 2025. The exam is delivered at PSI test centres and by remote online proctoring. Registration costs $575 USD for ISACA members and $760 USD for non-members. Passing the exam is only part of certification: candidates must also submit evidence of at least three years of relevant IT risk management and IS control experience before the CRISC designation is awarded.
Why Practice Questions Matter
CRISC is not a recall exam, so re-reading a guide does a poor job of preparing you for it. Almost every question is a scenario with four plausible answers, one of which is best because of who owns the risk, what stage of the risk lifecycle you are in, or what the risk appetite already says. That instinct is built by repetition and by reading explanations of why the near-miss answer is wrong. Practising by domain also exposes the specific gap most candidates have: comfort in Technology and Security, and hesitation in Governance and in Risk Response and Reporting, which together carry 58% of the exam.
Sample Practice Questions
The following questions are a preview of the type of syllabus-aligned questions you will practise in CertCrush. They reflect the format and reasoning style of the CRISC - Certified in Risk and Information Systems Control exam — not actual exam content.
Q1.A hospital is designing controls across the data lifecycle for a new patient records system. Which activity at the create stage has the GREATEST influence on the effectiveness of every later control?
- A.Assigning a classification and a named data owner
- B.Encrypting the underlying storage volumes
- C.Setting the backup frequency for the database
- D.Designing the database index structure for performance
Domain: Technology and Security
Q2.A key risk indicator for third-party access has crossed the defined tolerance threshold and now sits outside stated appetite. What is the MOST appropriate action?
- A.Adjust the threshold so the indicator returns inside the acceptable band
- B.Wait for the next reporting cycle to confirm the reading is not an anomaly
- C.Escalate the breach with the position and response options for decision
- D.Select and implement the most effective mitigating control immediately
Domain: Risk Response and Reporting
Q3.Residual risk for a business-critical process sits above appetite, no affordable control is available, and the activity is essential to strategy. What should the risk practitioner do FIRST?
- A.Recommend avoiding the risk by discontinuing the process
- B.Escalate for a formal senior-level acceptance decision with defined monitoring
- C.Implement the most effective control available and report the residual position as resolved
- D.Request that the board raise risk appetite so the exposure falls within it
Domain: Risk Response and Reporting
Q4.A risk assessment has already established the likelihood and impact of a prolonged data centre outage. Management now wants to know how quickly the absence of each affected process becomes intolerable and what each hour of downtime costs. Which activity BEST provides this?
- A.A business impact analysis
- B.A repeat quantitative risk analysis using updated annualised loss expectancy figures
- C.A threat assessment of the causes of data centre outages
- D.A control self-assessment of the data centre resilience controls
Domain: Risk Assessment
Q5.An organisation responds to an internal capacity risk by outsourcing the affected service to a specialist provider. What should the practitioner ensure is addressed as a result of this decision?
- A.The inherent risk rating of the original capacity issue is recalculated
- B.The secondary risk created by the outsourcing arrangement is identified and owned
- C.The original risk register entry is closed now that the service has moved
- D.Insurance is purchased to cover potential provider failure
Domain: Risk Response and Reporting
Frequently Asked Questions
What is included in the free CRISC - Certified in Risk and Information Systems Control sample?
The free sample includes 10 syllabus-aligned practice questions, sample flashcards, and a preview chapter from the study guide. No account or payment is required to try the sample.
How many questions are in the full CRISC - Certified in Risk and Information Systems Control course?
The full course includes a comprehensive question bank covering all exam domains. You can see the total question count on the CRISC - Certified in Risk and Information Systems Control course page.
Are these official ISACA exam questions?
No. CertCrush questions are independently written and syllabus-aligned — they mirror the format, difficulty, and reasoning style of the official exam. We are not affiliated with or endorsed by ISACA.
Which domains does the CRISC - Certified in Risk and Information Systems Control course cover?
The course covers 4 exam domains: Governance, Risk Assessment, Risk Response and Reporting, Technology and Security.
Can I study on mobile?
Yes. CertCrush is fully responsive and works on phones, tablets, and desktops. The timed exam, flashcards, and study guide all work on mobile without installing an app.
What happens when I create an account?
Creating a free account lets you access full courses, track your weak areas by domain, and resume practice sessions across devices. No credit card is required to register.