ISACA certification practice
Practise Certified in Risk and Information Systems Control CRISC across all 5 official exam domains — IT Risk Identification, IT Risk Assessment, Risk Response and Reporting, Information Technology and Security, and more — with original exam-style questions, full explanations, and wrong-answer analysis. Courseiva helps you prepare with realistic practice questions, topic-based revision, explained answers and structured study routes.
Ways to study CRISC
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
New here? Start with this
Start with a 25-question practice test
Covers all 5 domains · takes ~5 min · no account needed · shows your weak areas immediately
Key facts for the Certified in Risk and Information Systems Control CRISC exam.
Exam cost
$575 USD (ISACA member) / $760 USD (non-member) / ~£460 / ~£610
Duration
240 minutes (4 hours)
Question count
150 questions
Passing score
450 / 800
Validity
Ongoing (annual CPE maintenance required)
Delivered by
PSI
Online proctored
Yes — available
Retake policy
Up to four attempts per 12-month period
Question formats
The ISACA Certified in Risk and Information Systems Control (CRISC) is a globally recognised credential that validates expertise in enterprise IT risk identification, assessment, evaluation, response, and monitoring. The exam spans four domains: governance, IT risk assessment, risk response and reporting, and information technology and security. CRISC is designed for professionals who bridge the gap between IT and business risk management, ensuring that risk-related decisions align with organisational strategy and risk appetite. It is consistently ranked among the highest-paying IT certifications globally and is particularly valued in financial services, consulting, and large enterprise environments where formal risk governance frameworks are essential.
Official prerequisite
Three years of cumulative work experience in IT risk management and IS control across at least two of the four CRISC domains, with mandatory experience in Domains 1 or 2. No education substitutions are permitted for CRISC.
Recommended experience
Hands-on experience in enterprise risk assessment, risk frameworks (NIST RMF, ISO 31000, COBIT), and internal controls; experience in regulated industries such as banking, insurance, or government is highly beneficial
3+ years in IT risk management and IS control — practitioners in risk, audit, and compliance are the primary audience
Should you skip this exam?
Skip if you have no dedicated risk management background — CRISC assumes significant risk assessment and control experience; those early in their careers should consider CISA or Security+ first
Courseiva study tip
Anchor your preparation in ISACA's official CRISC Review Manual and practice questions — questions are heavily scenario-based and require you to apply risk management judgement in realistic enterprise situations, not just recall definitions
UK salary range
£75,000–£115,000
US salary range
$125,000–$170,000
Job roles that cite CRISC
What certification to take next
The CRISC exam costs $575 USD for ISACA members and $760 USD for non-members. Annual ISACA membership is $135 and includes access to resources and member discounts, making it cost-effective to join before registering for the exam.
The passing score is 450 out of 800 on a scaled basis, consistent with other ISACA credentials. The exam uses 150 multiple-choice questions in a four-hour session.
CRISC requires three years of cumulative paid work experience in IT risk management and IS control, covering at least two of the four domains — and experience in Domain 1 (Governance) or Domain 2 (IT Risk Assessment) is mandatory. Unlike some ISACA credentials, no education substitutions are allowed for CRISC.
CRISC covers four domains: (1) Governance, (2) IT Risk Assessment, (3) Risk Response and Reporting, and (4) Information Technology and Security. The exam emphasises the practical integration of risk management with business strategy and IT operations.
CRISC is specifically focused on IT risk identification, assessment, and control — it is narrower than CISM (which covers all of security management) and complementary to CISA (which focuses on auditing and assurance). Many senior GRC and risk professionals hold CRISC alongside CISM or CISA. CRISC typically commands the highest salaries of the three.
CRISC requires continuous annual maintenance: 20 CPE hours per year (120 hours over three years) and an annual ISACA maintenance fee. The credential remains active indefinitely as long as these requirements are met.
CRISC is best suited for IT risk managers, GRC professionals, compliance officers, and risk consultants with hands-on experience in enterprise risk frameworks. It is particularly valued in financial services, insurance, healthcare, and any sector where formal IT risk governance is regulated or audited.
See how CRISC stacks up against related certifications.
100% free — no account required
Everything on Courseiva for CRISC is free — no subscription, no trial, no email wall.
Courseiva Exam Intelligence
Data confidence: BuildingDerived from Courseiva's continuously updated practice dataset: 983 exam-style questions. Updated 2 July 2026.
Question difficulty mix
Average time per question: 94s
4
Exam domains
official blueprint domains covered by the bank
983
Questions
exam-style questions in the CRISC bank
Practice modes
Choose a mode that matches your current study phase. Use topic practice early on and mock exams closer to your exam date.
All CRISC Questions
Browse the full question bank organised by domain and difficulty.
Practice Test
Start a 20-question session with a full explanation after each answer.
Mock Exam
Simulate the real exam with a timed, full-length question set.
Quick 25
A 25-question warm-up — ideal for a short daily study session.
Flashcards
Reinforce key terms, commands, and protocol facts with flashcards.
Domain Practice
Focus exclusively on one exam domain to target your weakest area.
50-Question Set
Mid-length practice set covering all domains.
Exam guide
Start with a short practice session, review each missed answer, then return to the topics that caused mistakes.
Certified in Risk and Information Systems Control CRISC spans 5 official exam domains (IT Risk Identification, IT Risk Assessment, Risk Response and Reporting, and more). Questions test whether you can apply each objective in a realistic scenario, not just recall a definition.
Related practice questions
Use these internal links to move from the exam guide into focused topic practice pages.
Practise CRISC questions linked to IT Risk Identification.
Practise CRISC questions linked to IT Risk Assessment.
Practise CRISC questions linked to Risk Response and Reporting.
Practise CRISC questions linked to Information Technology and Security.
Practise CRISC questions linked to Risk Response and Mitigation.
Practise CRISC questions linked to CRISC fundamentals.
Practise CRISC questions linked to CRISC scenario.
Practise CRISC questions linked to CRISC troubleshooting.
Practice directory
Every practice set is a unique selection of questions — numbered tests, domain-focused sessions, and topic-specific quizzes.
Showing 8 of 64 tests. See all 64 CRISC practice tests →
Official blueprint
Target weak areas by practising questions from a single domain. Each domain page shows all questions, difficulty breakdown, and a focused practice session.
Practise CRISC questions in this domain →
Practise CRISC questions in this domain →
Practise CRISC questions in this domain →
Practise CRISC questions in this domain →
Practise CRISC questions in this domain →
Deep-dive questions
The most-searched CRISC questions — each with a detailed explanation, worked example, and full answer breakdown.
Learn the concepts
16 book-style chapters cover every CRISC objective in plain English. Read the theory here, then test it with practice questions.
Chapter 1
Introduction to IT Risk Management
12 min read
Chapter 2
Risk Identification Methodology and Techniques
12 min read
Chapter 3
The Risk Register and the Threat Landscape
12 min read
Chapter 4
Risk Owners, Stakeholder Analysis, and Communication
12 min read
Chapter 5
Risk Assessment Approaches and Frameworks
12 min read
Chapter 6
Quantitative Risk Analysis: ALE, SLE, ARO, and More
12 min read
Chapter 7
Qualitative Risk Analysis: Probability and Impact Matrices
12 min read
Chapter 8
Risk Assessment Outputs and Reporting
12 min read
Free study guide
The Courseiva CRISC study guide covers exam format, the official domain blueprint with weights, a structured study plan, and domain-specific tips for each section. Use it alongside practice questions to build both conceptual depth and exam confidence.
Sample questions
Original exam-style questions — not copied from any exam or dump site. Open a question for the full answer breakdown.
During a risk assessment for a critical financial application, the IT risk manager identifies a vulnerability in the application's authentication module. The exploit would require…
When integrating IT risk into the enterprise risk management (ERM) program, what is the PRIMARY benefit?
During a third-party risk assessment, a vendor is classified as 'critical' due to its access to sensitive customer data. According to the organization's vendor risk appetite, what…
A risk register is being updated after a quarterly risk assessment. One risk has decreased in likelihood due to new controls. However, the risk score remains unchanged because the…
Which risk identification technique relies on analyzing past incidents to predict future risks?
A risk manager discovers that a business unit has been using an unapproved software-as-a-service (SaaS) application for three months. The application stores customer PII. Which of…
Related certifications
Studying for CRISC? These related ISACA certifications share concepts and are common next steps.
All ISACA certifications →Courseiva provides free Certified in Risk and Information Systems Control CRISC (CRISC) practice questions with original exam-style questions, detailed explanations, topic-based practice, mock exams, readiness tracking, and study analytics. Courseiva is an independent platform and is not affiliated with ISACA.