More study resources

About this exam

CRISC (Certified in Risk and Information Systems Control) is an ISACA credential for professionals who manage IT risk and the controls that support business resilience. ISACA states the certification demonstrates IT risk management expertise and prepares holders to address emerging technology, including AI risk assessment and data governance and ethics. The exam covers four domains: Corporate IT Governance; Risk Assessment; Risk Response & Reporting; and Technology and Security.

It suits risk managers, IT audit and control practitioners, security and governance professionals, and others whose work involves identifying, assessing, responding to, and reporting technology risk across an enterprise.

The exam is computer-based and delivered at authorized PSI testing centers worldwide or as a remotely proctored exam. Registration is continuous; candidates may schedule as early as 48 hours after paying fees. Eligibility is established at registration and remains valid for six months, and appointments open only 90 days ahead. Exam fees are US$575 for members and US$760 for non-members.

Preparation options include ISACA's online review course, Review Manual in digital or print, the Questions, Answers & Explanations Database (six-month subscription to an 833-question pool), a free 10-question practice quiz, and member-only Engage study groups. Passing the exam is one step: candidates must also pay a US$50 application fee, demonstrate experience, and apply within five years.

What you'll study

Common questions

About CRISC preparation

What is the CRISC exam format?

It is computer-based and administered at authorized PSI testing centers globally or as a remotely proctored exam. Registration is continuous, so you can register at any time. You may schedule a testing appointment as early as 48 hours after paying your exam registration fees.

How much does CRISC cost?

ISACA lists the exam at US$575 for members and US$760 for non-members. Becoming certified also requires a US$50 application processing fee after you pass. Membership can reduce the exam cost, but confirm current pricing and membership terms on ISACA's site before registering.

How long is my exam eligibility?

Eligibility is established when you register for the CRISC exam and is good for six months. You must register and pay before you can schedule and take the exam. If you cannot find your desired site or date, verify that your eligibility has not expired.

How far in advance can I schedule?

CRISC exam appointments are only available 90 days in advance. If your preferred site or date is not visible more than 90 days out, check back closer to the date. If it still does not appear, confirm your eligibility has not expired.

Can I reschedule my appointment?

Yes. You can reschedule anytime without penalty during your eligibility period if you do it at least 48 hours before your scheduled testing appointment. ISACA directs candidates to its Scheduling Guide for the rescheduling steps.

What domains does the exam cover?

ISACA lists four domains: Corporate IT Governance; Risk Assessment; Risk Response & Reporting; and Technology and Security. The certification is aimed at IT risk management expertise, including addressing emerging technology such as AI risk assessment and AI data governance and ethics.

How long do I have to apply for certification after passing?

Candidates have five years from passing the exam to apply for CRISC certification. To become certified, you must also pay the US$50 application processing fee, submit an application demonstrating experience requirements, and adhere to the Code of Professional Ethics and Continuing Professional Education Policy.

What study materials does ISACA offer?

ISACA lists an online review course, digital and print versions of the CRISC Review Manual, and a six-month subscription to the Questions, Answers & Explanations Database with an 833-question pool. It also offers a free 10-question practice quiz and member-only Engage study groups. Group and self-paced training are available in multiple languages.

What are common scheduling mistakes?

Booking too far ahead is a common trap: appointments open only 90 days out. Another is letting the six-month eligibility lapse before scheduling. Also ensure your ISACA account name matches the government-issued ID you will present. ISACA applies a zero-tolerance policy to fraudulent test-taking, with score nullification or certification revocation.

Does ISACA publish a passing score or retake policy?

The CRISC credential page does not state a passing score, exam duration, or retake policy. Candidates should consult ISACA's exam candidate guide and scheduling materials for current rules rather than relying on secondhand figures. This guide does not invent values the official page omits.