CRISC study plan
CRISC · Give each week a clear focus.
8 weeks · About 6 hours per week
Corporate IT Governance
Map each of the four CRISC domains to the governance, risk, and control activities it covers
Compare COBIT, ISO 31000, and NIST CSF on how each defines risk appetite, tolerance, and capacity
Explain the three-lines-of-defense model and assign one sample control to each line
Draft a risk appetite statement tied to business objectives for a fictional organization
Your checkpoint
One-page governance framework crosswalk table plus a 150-word risk appetite statement for a fictional company
Corporate IT Governance & Risk Assessment
Identify and classify 15 business risks by category (strategic, operational, financial, compliance, reputational)
Build and calibrate a 5x5 likelihood-impact heat map with documented scoring criteria
Distinguish inherent, residual, and current risk and explain which one drives response decisions
Describe how enterprise risk management integrates with IT strategy setting
Your checkpoint
A risk register of 15 risks scored for inherent and residual likelihood and impact, with a written rationale for each score
Risk Assessment
Construct risk scenarios by decomposing threat, vulnerability, asset, and consequence
Select an appropriate assessment technique (Delphi, scenario analysis, interview, checklist, quantitative modeling) for four given situations
Quantify a single risk using annualized loss expectancy and explain the assumptions behind each input
Evaluate how risk assessment results feed the risk register and risk profile
Your checkpoint
A scenario analysis document covering three business-process risk scenarios, including a full quantified ALE calculation for one
Risk Assessment & Risk Response & Reporting
Evaluate mitigate, transfer, avoid, and accept options against cost, benefit, and residual exposure for 10 risks
Calculate the cost of a control versus the reduction in expected loss to justify a treatment decision
Assign risk owners and define treatment acceptance criteria and target dates
Draft escalation criteria that would move a risk out of tolerance to senior management
Your checkpoint
A risk treatment plan for 10 risks listing selected response, cost-benefit justification, risk owner, and target completion date
Risk Response & Reporting
Design six key risk indicators with thresholds, data sources, and reporting frequency
Structure a risk report so that findings, exposure, and recommended actions are explicit
Differentiate the content and depth of risk reporting for board, executive, and operational audiences
Describe how risk reporting drives continuous improvement of the risk management program
Your checkpoint
A one-page executive risk dashboard with six KRIs, thresholds, RAG status, and a 200-word narrative written for a board audience
Risk Response & Reporting & Technology and Security
Classify controls as preventive, detective, or corrective and map each to the risk it addresses
Design a control test (inquiry, observation, inspection, re-performance) for each control type
Explain how control design and operating effectiveness differ and why both must be assessed
Identify how control gaps surface through KRIs and incident reporting
Your checkpoint
A control matrix of 20 controls mapped to specific risks, control type, owner, and test method
Technology and Security
Explain network segmentation, DMZ design, and boundary defense as risk-reduction controls
Compare authentication and authorization approaches, including MFA, SSO, and least privilege
Describe a data classification scheme and the handling controls each class requires
Assess technical risks in a cloud migration using shared responsibility and third-party risk concepts
Your checkpoint
A two-page technical risk brief on a hypothetical cloud migration identifying eight technical risks with mapped controls and residual exposure
Corporate IT Governance & Risk Assessment & Risk Response & Reporting & Technology and Security
Synthesize cross-domain linkages by tracing one risk from governance appetite through assessment, response, reporting, and technical control
Complete two full-length timed practice exams under exam conditions
Re-drill every item on the accumulated weakness list until each is resolved
Write a one-page exam-day decision heuristic for choosing between closely worded answer options
Your checkpoint
A weakness list with zero unresolved items, plus two timed practice exam scores of 80 percent or higher
Milestones
Week 2: Score 80 percent or higher on a 30-question self-quiz limited to Domain 1 and the basics of Domain 2, and confirm the risk register is fully scored with rationales
Week 4: Score 75 percent or higher on a timed 50-question mixed set covering Domains 1, 2, and 3, logging every missed item to the weakness list
Week 6: Explain aloud, without notes, the difference between risk appetite, tolerance, and capacity, and how a KRI signals movement out of tolerance; score 80 percent or higher on a 40-question set weighted to Domains 3 and 4
Week 8: Two full-length timed practice exams completed with scores of 80 percent or higher and zero unresolved items remaining on the weakness list