- Organizational Governance: Strategy, Goals, and Objectives, Organizational Structure, Roles, and Responsibilities, Organizational Culture and Ethics, Policies and Standards.
- Risk Governance: Enterprise Risk Management (ERM), Lines of Defense, Risk Profile, Risk Appetite and Risk Tolerance.
ISACA Certification Training Course
ISACA Certified in Risk and Information Systems Control (CRISC) Certification Training Course
We'll get you ready for the ISACA CRISC exam, the credential for professionals who identify and manage IT risk and design and monitor IS controls.
Course focus: Governance, Risk Assessment, Risk Response and Reporting, Technology and Security, mapped to the official ISACA CRISC job practice.
Course Overview
What the CRISC Course Covers
The CRISC exam covers 4 domains in the ISACA job practice. Risk Response and Reporting carries the most weight at 32%, so we give it the most class time.
Our live virtual class follows the job practice domain by domain, with practice questions in the scenario style ISACA uses. We also walk you through registration, scheduling with PSI and the application you file after you pass.
CRISC is about connecting IT risk to business decisions. ISACA's job practice walks from governance through assessment, response and reporting, then into the technology and security principles a risk professional has to understand.
Risk Response and Reporting is the largest domain at 32%, so we spend the most time on choosing responses, owning controls and building risk reporting that leadership actually reads. Governance follows at 26%.
Accumentum is an independent training provider. We are not affiliated with or endorsed by ISACA, and this isn't official ISACA training. ISACA sets exam content, fees and policies, so check isaca.org before you register.
Course Objectives
What You Will Be Able to Do
01
Cover Every Domain
Work through all 4 domains in the official CRISC job practice, weighted the way the exam weights them.
02
Go Deep on Risk Response and Reporting
This domain is 32% of the exam per ISACA, so it gets the most class time.
03
Think Like ISACA
ISACA questions ask for the best answer from a management and business view. We practice that every session.
04
Be Ready for Test Day
You'll know the format: 150 multiple choice questions in four hours, scored from 200 to 800.
05
Design and Monitor Controls
Select, design and test IS controls and report on how well they work.
06
Report Risk to Leadership
Turn risk data into reporting that supports business decisions.
Who Should Attend
- IT risk and control professionals.
- Business analysts and project managers who handle risk.
- Compliance and audit staff working on control design.
- Security staff who report risk to leadership.
- Compliance staff who track control remediation.
- Project managers responsible for project and vendor risk.
Prerequisites
- ISACA requires three years of experience in IT risk management and IS control. ISACA does not allow experience waivers for CRISC.
- You can take the exam before you have the experience. ISACA gives you five years after passing to apply for certification. We don't add enrollment prerequisites of our own.
Pathway Map
CRISC Course Pathway
Every module opens with the exam domain it maps to, so you can see how the pieces fit together across the course.
Course Content
- Risk Identification: Risk Events, Threat Modeling and Threat Landscape, Vulnerability Management, Risk Scenario Development and Evaluation.
- Risk Analysis: Risk Assessment Concepts and Standards, Business Impact Analysis (BIA), Risk Register, Risk Analysis Methodologies.
- Risk Response: Risk Response Options, Risk and Control Ownership, Vendor and Supply Chain Risk Management, Issues, Findings, Exceptions and Exemptions Management.
- Control Design and Implementation: Control Frameworks, Types, and Standards, Control Design, Selection, Implementation, and Analysis, Control Testing Methodologies.
- Risk Monitoring and Reporting: Risk Action Plans, Data Collection, Aggregation, Analysis, and Validation, Risk and Control Metrics, Risk and Control Monitoring Techniques.
- Technology and Security: Technology Principles, Technology Roadmaps and Enterprise Architecture (EA), Operations Management, System Development Life Cycle (SDLC).
- Information Security Principles: Security Concepts, Frameworks, and Standards, Security and Risk Awareness and Training, Data Privacy and Data Protection Principles.
Course Features
How We Teach It
Expert-Led Classes
Live virtual instruction with time for questions, so you aren't figuring out the hard parts alone.
Job Practice Mapping
Every module maps to a domain in the official CRISC job practice.
Practice Questions
Scenario based practice questions with explanations for every answer.
Registration Help
We help you register with ISACA, schedule with PSI and plan your certification application.
Certification Exam
CRISC exam details
CRISC Exam Readiness
Our class maps to the official CRISC outline so you walk in knowing what to expect.
Per ISACA, the CRISC exam has 150 multiple choice questions in four hours. It's offered at PSI test centers or by remote proctoring with continuous registration. Scores are scaled from 200 to 800 and a 450 or higher passes. ISACA lists the exam fee at US$575 for members and US$760 for non-members. The exam is offered in English, Spanish and Japanese. Source: https://www.isaca.org/credentialing/crisc
Exam Format
CRISC Exam at a Glance
Questions
150 multiple choice questions.
Time
4 hours.
Delivery
Computer based, at a PSI test center or by remote proctoring, with continuous registration.
Scoring
Scaled scores from 200 to 800. A score of 450 or higher passes.
Exam Fee
US$575 for ISACA members and US$760 for non-members, per ISACA. A US$50 application processing fee applies when you apply for certification after passing.
Languages
English, Spanish and Japanese.
Careers
Where the CRISC Can Take You
CRISC fits people who sit between the business and IT on risk. Holders work in enterprise risk, IT risk, control design and compliance, and many also hold CISA or CISM.
CRISC holders often work as IT risk analysts, risk managers, control assessors and compliance leads. It pairs well with CISA for people who move between audit and risk, and with CISM for people who own the security program.
IT Risk Manager
Runs the IT risk program and the risk register.
Control Design Lead
Designs, tests and monitors IS controls.
Enterprise Risk Analyst
Connects technology risk to enterprise risk reporting.
Third Party Risk Manager
Assesses and monitors vendor and supply chain risk.
Study Plan
How We Prepare You for the CRISC
We teach CRISC as a risk lifecycle. You'll identify a risk, analyze it, pick a response, design the control and then report on it, the same order the job practice uses.
Practice questions focus on the decision a risk professional makes, such as who should own a risk or which metric best shows control health. You'll get a weekly plan and timed sets that build up to a full length exam.
CRISC questions usually describe a business situation and ask for the best response from a risk practitioner. We practice reading for the risk owner, the control owner and the business objective in each question, since that is where most wrong answers come from.
You'll also leave class with a study plan for the weeks before your exam, built around the domains where your practice scores were lowest.
Risk Lifecycle
Every module follows identify, analyze, respond, control and report.
Risk Register Work
We build and review sample register entries in class.
Metrics Practice
KRIs, KCIs and KPIs and when each one fits.
Timed Practice
Full length timed sets before you book the exam.
Funding
Paying for CRISC Training
We are an Army CA and Air Force COOL Approved Vendor, so eligible service members can often use those programs toward CRISC training. Your education counselor decides what gets approved, and we help you put the paperwork together.
If you're paying yourself or through your employer, PathPay spreads tuition into monthly payments. Email info@accumentum.net and we will send a quote for the CRISC class that you can pass to a manager or training budget owner.
Army CA
Send us your request details and we will provide the course quote and documents your counselor asks for.
Air Force COOL
We are an approved vendor. We help you confirm the credential is on your COOL list before you apply.
PathPay
Monthly payments instead of one lump sum. See the PathPay page for current terms.
Employer Paid
We provide quotes and course outlines your employer can use to approve the spend.
Domain Guide
CRISC Domains in Detail
Domain 1: Governance (26%)
Organizational Governance covers Strategy, Goals, and Objectives, Organizational Structure, Roles, and Responsibilities, Organizational Culture and Ethics, Policies and Standards and Business Processes and Resilience. Risk Governance covers Enterprise Risk Management (ERM), Lines of Defense, Risk Profile, Risk Appetite and Risk Tolerance and Risk Frameworks, Legal, Regulatory, and Contractual Requirements.
Domain 2: Risk Assessment (22%)
Risk Identification covers Risk Events, Threat Modeling and Threat Landscape, Vulnerability Management and Risk Scenario Development and Evaluation. Risk Analysis covers Risk Assessment Concepts and Standards, Business Impact Analysis (BIA), Risk Register, Risk Analysis Methodologies and Inherent and Residual Risk.
Domain 3: Risk Response and Reporting (32%)
Risk Response covers Risk Response Options, Risk and Control Ownership, Vendor and Supply Chain Risk Management and Issues, Findings, Exceptions and Exemptions Management. Control Design and Implementation covers Control Frameworks, Types, and Standards, Control Design, Selection, Implementation, and Analysis and Control Testing Methodologies. Risk Monitoring and Reporting covers Risk Action Plans, Data Collection, Aggregation, Analysis, and Validation, Risk and Control Metrics, Risk and Control Monitoring Techniques and Risk and Control Reporting Techniques.
Domain 4: Technology and Security (20%)
Technology and Security covers Technology Principles, Technology Roadmaps and Enterprise Architecture (EA), Operations Management, System Development Life Cycle (SDLC) and Data Lifecycle Management. Information Security Principles covers Security Concepts, Frameworks, and Standards, Security and Risk Awareness and Training and Data Privacy and Data Protection Principles.
After the Exam
Scheduling, Retakes and Certification
ISACA exam registration is continuous, so you can register when you are ready and then schedule a seat with PSI at a test center or for remote proctoring. If you need to cancel or change an appointment, ISACA requires you to do it at least 48 hours before your scheduled time.
ISACA allows four attempts in a rolling 12 month period. After a first attempt that does not pass, you wait 30 days to retake, then 90 days before each of the next two attempts, and you pay the full registration fee each time.
Passing the exam is the first step. You then have five years to apply for CRISC certification, pay the US$50 application processing fee, show the required work experience and agree to ISACA's Code of Professional Ethics and Continuing Professional Education policy. We walk you through that application in class.
Keep Exploring
Related Courses and Resources
Frequently Asked Questions
Common questions about our CRISC class and the exam.
The Certified in Risk and Information Systems Control (CRISC) is an ISACA credential. Details are on the official page at https://www.isaca.org/credentialing/crisc.
No. We're an independent training provider. Our course follows the public ISACA job practice. ISACA sells its own review materials at isaca.org.
ISACA lists the exam fee at US$575 for members and US$760 for non-members. After you pass, ISACA charges a US$50 application processing fee when you apply for certification.
ISACA requires three years of experience in IT risk management and IS control. ISACA does not allow experience waivers for CRISC.
Yes. ISACA offers the exam at PSI test centers or by remote proctoring.
We are an Army CA and Air Force COOL Approved Vendor. Email info@accumentum.net and we will help you check what your benefit covers.
No. ISACA does not allow experience waivers or substitutions for CRISC.
Risk Response and Reporting is 32% of the exam, per ISACA.
No. It suits anyone who manages IT risk, including people in enterprise risk, compliance and project roles.
Many people hold both. They cover different jobs, so we suggest one exam at a time. Email us and we'll help you sequence them.
ISACA allows four attempts in a rolling 12 month period, with waits of 30 days after the first attempt and 90 days after the second and third. Each attempt is paid in full.
You follow ISACA's Continuing Professional Education policy. Check isaca.org for current CPE and maintenance fee requirements.
Enrollment
Enroll in CRISC Training
Ready to start? Register on our registration page or email info@accumentum.net with questions about the CRISC class.
Start Your CRISC Prep
Questions about schedules or funding? Email info@accumentum.net.