Introduction to the CRISC Exam
- Overview of the CRISC certification
- Exam structure and scoring
- Effective exam preparation strategies
Domain 1 – Governance
- Strategy, goals and objectives
- Organisational structure, culture, ethics and accountability
- Risk appetite and risk tolerance
- Enterprise risk frameworks
- Policies and standards
- Legal and regulatory requirements
- Maintaining risk registers and risk profiles
- Stakeholder communication and reporting
Domain 2 – Risk Assessment
- Identifying risk events and applying threat modelling
- Vulnerability management and scenario development
- Business Impact Analysis
- Residual risk evaluation
- Risk analysis methodologies
- Updating risk registers
- Developing a risk-aware culture through training and awareness
Domain 3 – Risk Response and Reporting
- Risk response options and treatment planning
- Control design, selection and implementation
- Managing issues, findings and exceptions
- Vendor and supply chain risk management
- Monitoring and analysing KPIs, KRIs and KCIs
- Reporting emerging risks to relevant stakeholders
Domain 4 – Technology and Security
- Technology roadmaps and enterprise architecture
- IT operations and lifecycle management
- Disaster recovery
- Security frameworks and standards
- Security awareness training
- Data lifecycle management
- Data privacy and protection
- Emerging technologies and their potential risk implications
Exam Readiness
The final part of the course supports participants in developing an effective approach to the certification examination through:
- Mock exam review
- Time-management techniques
- Test-taking and question-answering strategies
CRISC Exam and Assessment
The course prepares participants for the CRISC certification examination. The CRISC exam is booked separately through ISACA and is delivered online.
The examination:
- Contains 150 multiple-choice questions
- Has a duration of four hours
- Is scored on a scale of up to 800
- Requires a minimum score of 450 to pass
Practice questions and mock examination activities are incorporated into the course to support preparation.
CRISC Exam Distribution from 3 November 2025
From 3 November 2025, the four CRISC domains remain unchanged, although their weighting within the examination is adjusted as follows:
- Domain 1 – Governance: 26%
- Domain 2 – Risk Assessment: 22%
- Domain 3 – Risk Response and Reporting: 32%
- Domain 4 – Technology and Security: 20%
Hands-On Learning
Alongside examination preparation, the course provides opportunities to apply risk management concepts to realistic organisational situations. Participants engage in:
- Scenario-based group exercises and tabletop simulations
- Workshops focused on developing and analysing risk registers
- Mock examination practice supported by instructor-led review
- Case studies based on realistic enterprise risk challenges
Important Change to ISACA Product Access Periods
Effective 16 April 2026, ISACA is reducing product access periods from 12 months to 6 months across exams, QAE products, Online Review Courses, non-sponsored webinars and Virtual Workshops.
How the New Access Periods Work
1. Assignment and Redemption Window
Products must be assigned and redeemed within 6 months of the original purchase date.
2. Access and Completion Window
Once a product has been redeemed, learners have 6 months of access in which to use it. This period includes accessing learning materials, scheduling examinations and, where applicable, sitting the examination.
What Does This Mean for Learners?
- Review Manuals: Long-term access will continue.
- QAE Databases and Online Review Courses: Available for 6 months following redemption.
- Exams: Must be scheduled and completed within 6 months of redemption.
Participants are encouraged to redeem their products promptly and plan their study and examination schedules early so that they can make full use of the available access period.
