Academy · ISACA · 4 domains
CRISC preparation: IT risk as a discipline, not a colour on a chart.
Four domains — governance, IT risk assessment, risk response and reporting, and the technology a risk practitioner has to be literate in. Nearly a third of the exam is response and reporting, which is the half of risk work most registers never reach. Preparation follows ISACA’s published exam content outline, domain by domain.
Instructor-led and arranged in a conversation, not bought from a page. Independent preparation — CyberWave is not an ISACA training partner. All five tracks
What it is
The credential for the half of risk work that gets skipped.
Most organisations can produce a risk register. Far fewer can say who owns each risk, which treatment was chosen and why, what the residual position is after the controls that actually operate, and what indicator would tell them the position had changed. That second list is where CRISC spends nearly a third of its exam.
- “Cyber attack” — rated high
- A colour, agreed in a workshop nobody minuted
- Residual risk only, with the controls assumed to work
- An owner who is a department, not a person
- A review date that has already passed
- A report nobody made a decision from
- A named asset, a plausible route, an outcome somebody would feel
- An assessment method you could repeat and defend
- Inherent and residual, and whether the control actually operates
- A person who may accept the risk, or may only recommend
- A treatment with a date, and an indicator that would move
- One page: risk, exposure, options, recommendation, owner, date
Who sits it, and what sent them.
Three of these four already do the work. What they are missing is the method and the vocabulary to defend it in a room where somebody would prefer a different answer.
- The register owner
“I maintain it. I am not sure anybody reads it.”
CRISC treats risk as an analytical discipline rather than a colour on a heat map — scenario, assessment, treatment, residual position, indicator.
Driving it: a quarterly review
- The IT lead
“The board asked what our exposure is.”
Usually with three days’ notice. The material gives you a repeatable way to answer instead of assembling a view from memory each time.
Driving it: the next board meeting
- The auditor
“I report on the past. I want to shape what gets funded.”
Audit examines whether a control worked. Risk decides which controls should exist. CRISC is the step upstream.
Driving it: a move out of assurance
- The vendor risk lead
“I chase questionnaires and manage exceptions.”
Third-party risk sits inside the largest domain. Most of the exam describes your week already.
Driving it: a supplier review backlog
The exam outline
The four domains, and where the marks are.
ISACA’s domains, in ISACA’s order, with the weightings from the current exam content outline. Weightings move when ISACA refreshes its job practice, so the published outline is always the authority — reading it is the first hour of preparation rather than an optional extra.
| Domain | Weight | What it covers |
|---|---|---|
| 01Governance | 26% | Organisational governance — strategy and objectives, structure, roles and responsibilities, culture, policies and standards, business processes and assets. Then risk governance: enterprise risk management and risk frameworks, the three lines model, the risk profile, risk appetite, tolerance and capacity, the legal, regulatory and contractual requirements in scope, and the professional ethics of risk work. |
| 02IT Risk Assessment | 20% | Identification: risk events, threat and vulnerability analysis, and building risk scenarios that describe something that could actually happen here rather than a category. Then analysis and evaluation — assessment standards and frameworks, the risk register, analysis methodologies, business impact analysis, and the distinction between inherent and residual risk that everything downstream depends on. |
| 03Risk Response and Reporting | 32% | The largest domain. Response: treatment options, risk and control ownership, third-party risk, issue, finding and exception management, and handling emerging risk. Control design and implementation: control types and standards, selection, implementation, and testing for effectiveness. Then monitoring and reporting — treatment plans, data collection and validation, and reporting techniques including key risk, control and performance indicators. |
| 04Information Technology and Security | 22% | The technology a risk practitioner has to be literate in: enterprise architecture, IT operations, project management, disaster recovery, the data lifecycle, the system development lifecycle and emerging technologies. Then security principles — security concepts, frameworks and standards, awareness and training, business continuity management, and data privacy and protection principles. |
Governance and response together take well over half the exam. That is the honest signal about what CRISC is: a governance and decision credential with enough technology in it to keep the decisions grounded.
A heat map is not a decision. Somebody still has to own the risk and choose what happens to it.
Domain 2 teaches you to write a scenario specific enough to assess. Domain 3 asks what you do about it: which treatment, whose name is against it, which control, tested how, and reported to whom on what cadence.
Eligibility
Three years, two domains, no waivers.
The shortest experience requirement of the four credentials on this site, and the only one with no substitutions whatsoever. Read both halves of that before you book, because they pull in opposite directions.
The six rules, as ISACA publishes them
- 01
Three years, not five
CRISC asks for three years of cumulative work experience performing the tasks in its domains. That is the shortest requirement of the four credentials on this site, and it is the reason CRISC is often the first one a risk practitioner can actually complete.
- 02
Across at least two domains — including one specific pair
The experience has to span at least two of the four domains, and at least one of those must be Governance or IT Risk Assessment. Three years spent entirely on control implementation does not satisfy it. Map your history against the domains before you plan a date.
- 03
There are no substitutions
Unlike CISA and CISM, CRISC publishes no experience waivers or substitutions — no degree, no other credential, no teaching offset. Three years of the actual work, verified. This is the single most commonly misread fact about the credential.
- 04
Sit first, apply later
You may sit the exam before the experience is complete and apply once it is, within the window ISACA sets after passing — currently five years. Experience must have been gained within the preceding ten years and is verified independently on application.
- 05
Ethics and the risk method
Certification requires adherence to ISACA’s Code of Professional Ethics. The professional ethics of risk work are also examined inside Domain 1, which is unusual and deliberate: presenting a risk honestly to people who would prefer a different answer is part of the discipline.
- 06
Upkeep is annual and cumulative
Continuing professional education — an annual minimum of 20 hours and 120 hours across a three-year cycle — plus an annual maintenance fee paid to ISACA. Missing the annual minimum is the usual way a credential is lost.
The format
How the exam is actually delivered.
A linear multiple-choice exam you can move back and forth through. Confirm the current numbers against ISACA’s published exam information before you plan, because a certifying body can change them.
As ISACA currently publishes it, the exam is 150 multiple-choice questions in a four-hour sitting, at a test centre or by remote proctoring, on a date you book with ISACA. Results are reported on a scaled range of 200 to 800 with 450 as the passing score — scaled rather than a percentage, so it does not map onto a count of correct answers.
A preliminary result appears at the end of the sitting, with the official one and a domain breakdown following. The questions are scenario-led and the recurring test is whether you know what a risk practitioner does FIRST: usually understand the business impact, confirm ownership, or check what the risk appetite already says — rather than implement a control nobody asked for.
The question style
Watch the qualifier. FIRST, BEST, MOST important, GREATEST concern — these decide between two answers that are both defensible. CRISC in particular rewards the option that keeps the decision with the person accountable for it.
What it does not test
No laboratory, no configuration, no code. It also does not reward risk avoidance as a default: accepting a risk within appetite, with an owner and a documented rationale, is frequently the best answer.
Preparation
What preparation covers, in this order.
The order follows the discipline: a scenario has to be written before it can be assessed, a response chosen before it can be reported, and an indicator designed before anybody can tell whether the position moved. Scope and pace are agreed with you rather than fixed here.
- 01
Get the governance vocabulary exact
Appetite, tolerance, capacity. Accountable versus responsible. Who may accept a residual risk and who may only recommend. A quarter of the exam sits here, and loose use of any of these terms changes which answer is best in the other three domains too.
- 02
Learn to write a risk scenario
Not “cyber attack” — a named actor, a named asset, a plausible route, an outcome somebody would feel. Most weak registers fail at this step, and the exam tests it directly because everything downstream inherits the quality of the scenario.
- 03
Separate inherent from residual, then keep them separate
Assessment before controls, assessment after controls, and the honest question of whether the control is actually operating. A register that only records residual risk cannot show anybody what the controls are earning.
- 04
Work the response domain hardest
A third of the exam is response and reporting: treatment options, ownership, control design and testing, issue and exception management, third-party risk. Preparation is weighted the way the exam is rather than giving four domains equal time.
- 05
Build indicators that mean something
Key risk indicators, key control indicators, key performance indicators — what makes one leading rather than lagging, and how a threshold gets set. This is the part that turns a register into something an executive can act on.
- 06
Practise reporting to a decision
The exam repeatedly asks what you would report, to whom, and when. Practise the one-page version: the risk, the exposure, the options, the recommendation, the owner, the date. That is also the artefact your board actually wants.
Back at work
Where the register stops being a document.
Academy is not product training and Sentinel is not exam preparation. The overlap is the vocabulary — and CRISC’s vocabulary is the one that shows up fastest in a real register.
A CRISC candidate learns the difference between inherent and residual risk. A register is where that difference has to survive a conversation with the person whose budget the treatment affects: the rating, the treatment and the owner sit on one row, and the residual judgement is the argument that row has to support. Domain 3 teaches ownership; action tracking is where a treatment decision becomes an owner and a due date rather than a paragraph. Domain 3 also teaches indicators, and reporting is where a figure has to be traceable back to the risks and controls it came from.
Neither depends on the other. You can take the track without opening the product, and nothing in Sentinel requires a credential. But a register maintained by people who share this vocabulary reads differently — the scenarios are specific, the owners are real, and the review dates arrive before the board meeting rather than after it.
7 open risks, 1 rated critical, each with an inherent rating shown as L×S — and 2 actions in Critical Now with an owner and a date. From the example workspace used across this site; Northstar Manufacturing Ltd. is fictional.
Straight answers
What we will not tell you about CRISC.
No pass rate, no partner badge, no promise about the result. Where something has not been established, it does not appear on the page.
CRISC questions people ask before they commit
Is it true there are no experience substitutions?
CRISC or CISM?
How technical is it?
Is CyberWave an ISACA training partner?
What does preparation cost, and when does it run?
Will the material help before I sit the exam?
The exam asks what you would do. Next quarter asks whether you did it.
A treatment decision with an owner, a date and an indicator behind it is the difference between a risk register and a risk programme. That part is what Sentinel is for.
No credit card required
- Published pricing on every standard plan
- No credit card required for the trial
- No automatic charge when a trial ends
- Tenant-isolated architecture, data stored in Canada
- Clear data-processing terms
- No compliance guarantee — human judgement still required