IT Risk Management Certifications: Comparing CRISC, CGEIT, COBIT, and CRCM
IT risk management certifications validate the ability to identify, assess, and respond to technology-related risk across governance, controls, and compliance. This category spans ISACA's governance and risk credentials alongside a banking-specific regulatory compliance certification, serving IT auditors, risk analysts, governance leaders, and compliance officers alike.
IT Risk Management
Information Systems Audit and Control Association (ISACA)
COBIT® 2019 Foundation
COBIT-2019
0 Practice Exams
0 Questions
American Bankers Association(ABA)
Certified Regulatory Compliance Manager (CRCM)
CRCM
0 Practice Exams
0 Questions
Information Systems Audit and Control Association (ISACA)
Certified in Risk and Information Systems Control (CRISC)
CRISC
6 Practice Exams
900 Questions
What IT Risk Management Field of Certification Actually Covers
IT risk management sits at the intersection of technology, governance, and business decision-making. It's the discipline of figuring out what could go wrong with an organization's systems and data, how likely that is, what it would cost, and what to do about it — whether that means implementing a control, transferring the risk through insurance, or accepting it outright.
This category is less unified than it might look at first glance. Three of the four certifications here come from ISACA and share a common vocabulary of governance, risk, and controls. The fourth, CRCM, comes from the American Bankers Association and applies risk thinking to a specific domain: US consumer banking regulation. A candidate preparing for CRISC and a candidate preparing for CRCM are studying very different material, even though both are technically managing risk.
How the Certifications in IT Risk Management Category Relate to Each Other
Certification | Issuing Body | Level | What It Validates | Experience Needed | Exam Format |
|---|---|---|---|---|---|
COBIT 2019 Foundation | ISACA | Entry-level, vendor-neutral | Working knowledge of the COBIT governance framework, including its risk optimization component | None | 75 questions, 120 minutes, 65% to pass |
CRISC | ISACA | Mid-to-advanced, vendor-neutral | IT risk identification, assessment, response, and monitoring | 3 years of relevant IT risk and control experience | 150 questions, 4 hours, scaled score of 450/800 to pass |
CGEIT | ISACA | Advanced, vendor-neutral | Enterprise IT governance leadership, with risk optimization as one of four domains | 5 years in an oversight or advisory role supporting IT governance | 150 questions, 4 hours, scaled score of 450/800 to pass |
CRCM | American Bankers Association / Institute of Certified Bankers | Mid-to-advanced, industry-specific | US consumer banking law and regulatory compliance risk | 3 years of compliance experience (2 years with a related degree), plus 80 hours of ABA-approved preparation within 5 years | 200 questions, 4 hours |
COBIT Foundation isn't itself a risk certification — it's a framework credential, and risk optimization is just one of eight domains it touches. Candidates often treat it as a stepping stone toward CGEIT or as a standalone way to speak the same governance language as CRISC and CGEIT holders without committing to the experience requirements those two carry. Artificial Intelligence is also becoming relevant to modern governance and risk discussions, particularly as organizations address AI-related risks and controls. CRISC is ISACA's dedicated IT risk credential; CGEIT covers risk as part of a much broader governance mandate that includes IT resource planning and benefits. CRCM doesn't overlap with the ISACA credentials at all in subject matter — it belongs on this list because it's a risk and compliance certification for a specific industry, not because it shares content with the others.
Who Should Start Where
New to IT governance vocabulary, no work experience yet. COBIT 2019 Foundation has no prerequisites and gives you the shared terminology — governance objectives, design factors, performance management — that shows up throughout the other ISACA credentials.
Three-plus years doing hands-on risk assessment, control design, or IT audit work. CRISC is the natural target. It's ISACA's only credential built specifically around the risk lifecycle rather than governance broadly, and the three-year experience bar is lower than CGEIT's.
Five-plus years in an advisory or oversight capacity over enterprise IT governance, not just risk. CGEIT fits professionals operating at a level where they're shaping governance frameworks and reporting to leadership, not just executing risk assessments.
Working in bank or credit union compliance, with US consumer banking law as your daily subject matter. CRCM is the specific credential for that track. It has no substitute among the ISACA options, since none of them cover TILA, RESPA, ECOA, or Reg E in any depth.
How IT Risk Management Category's Certifications Are Viewed by Employers
Recognition varies more across this category than the site's other IT categories, because the certifications don't compete for the same jobs.
CRISC is widely recognized in governance, risk, and compliance (GRC) hiring, particularly at organizations with a dedicated risk or audit function; it's frequently listed as preferred or required in postings for IT risk analyst and GRC analyst roles. CGEIT is respected but narrower in scope — it's aimed at a smaller pool of senior governance professionals, so fewer postings name it explicitly compared to CRISC or the more security-focused ISACA credentials. COBIT 2019 Foundation, on its own, rarely appears as a job requirement; it's more commonly used internally by organizations standardizing on the COBIT framework, or as preparation for CGEIT. CRCM carries weight, but only within US banking and credit union compliance — outside that industry, it has little to no recognition, which is worth knowing if you're weighing it against a broader technology risk credential.
None of this is uniform across employers or regions, and any of these certifications will mean more at an organization that has explicitly built its risk or governance program around the relevant framework.
Typical Career Paths IT Risk Management Category Supports
IT Risk Analyst / Technology Risk Consultant
GRC Analyst or GRC Manager
IT Auditor
Enterprise Risk Manager
IT Governance Specialist
Bank Compliance Officer or Regulatory Compliance Manager (CRCM track specifically)
Chief Risk Officer or Chief Governance Officer (typically reached via CGEIT after years in a CRISC-level role)
What's Changing in IT Risk Management Field Right Now
ISACA revised the CRISC exam content outline in November 2025, the first such update in several years. The four domains stayed the same, but the weighting shifted: IT Risk Assessment moved from 20% to 22% of the exam, while Information Technology and Security dropped from 22% to 20%. Governance held steady at 26%, and Risk Response and Reporting remains the largest domain at 32%. ISACA framed the change as a response to how risk and privacy responsibilities have evolved for practitioners — candidates studying from pre-November 2025 material should confirm they're working from the current job practice outline before scheduling.
Separately, the broader field is absorbing new territory that didn't exist in earlier versions of any of these frameworks: AI system governance, third-party and supply-chain risk, and cloud configuration risk are showing up more often in scenario-based questions across ISACA's credentials, even where the formal domain structure hasn't changed to name them explicitly.