CRISC Certification: What the Exam Actually Covers, Costs, and Requires

What the CRISC Certification Actually Validates

Certified in Risk and Information Systems Control(CRISC) stands for Certified in Risk and Information Systems Control, and ISACA built it specifically for people who sit at the intersection of business risk and IT controls, not for auditors and not for hands on security engineers, but for the professionals in between who identify risk, decide how an organization should respond to it, and then prove the response worked. ISACA launched the credential in 2010, and more than 46,000 professionals now hold it.

The distinction that matters most: CRISC is not a technical control implementation exam. It tests whether you can look at an organization's risk profile, connect it to business objectives, and communicate it upward in a way executives and boards can act on.

Who This Exam Is For (and Who It Isn't)

CRISC fits IT risk analysts, second line risk managers, GRC leads, control owners, and IT auditors who are moving into a risk ownership role rather than a pure assurance role. It's also a common credential requirement in banking, insurance, and government contracting, where enterprise risk reporting is a formal, recurring obligation.

It's a weaker fit if your day to day work is hands on penetration testing, security architecture, or SOC operations. CISM covers security program management more directly, and CISA is the better match if your role is audit and assurance rather than ongoing risk ownership.

CRISC Exam Format and Structure

The exam runs 150 multiple choice questions in a single 240 minute sitting, delivered at a PSI test center or through PSI's remote proctoring option. There's no case study section and no simulation questions. Every item is a straight multiple choice question, but ISACA writes many of them as scenario based judgment calls rather than pure recall, so memorizing definitions from the review manual without practicing applied scenarios tends to leave candidates underprepared for the pacing. At roughly 96 seconds per question, most candidates who've done adequate scenario practice finish with time to review flagged items.

Scoring uses a scaled range of 200 to 800, with 450 needed to pass. ISACA doesn't publish the raw percentage that maps to a 450, so treat any "you need to get X% right" claim you see elsewhere as an estimate, not an official figure.

Domains and Weightings

ISACA updated the CRISC content outline for exams delivered from November 3, 2025 onward, shifting weight from Domain 4 into Domain 2.

Domain 3 alone carries nearly a third of the exam, and it's the domain most candidates underweight in their prep because it reads as "soft skills" work like reporting and stakeholder communication. It isn't. ISACA tests specific control design, testing methodology, and metrics knowledge inside that domain, not just communication technique.

Cost Breakdown

The exam registration fee is a flat US$575 for ISACA members and US$760 for non members, set by ISACA with no regional discount tiers. If you don't pass, a retake is a full new registration at the same fee, since each attempt is billed separately.

Passing the exam isn't the finish line financially. There's a one time US$50 application fee once you submit proof of your work experience, and then an ongoing annual maintenance fee of US$45 (member) or US$85 (non member) to keep the certification active. Add ISACA membership itself if you want the member pricing on the exam and renewal fees, plus whatever you spend on the review manual, question bank access, or a chapter led review program if you choose one over pure self study.

Prerequisites and Eligibility

You need three years of cumulative professional experience performing the actual tasks the CRISC job practice describes, spread across at least two of the four domains, with at least one of those years specifically in Governance or Risk Assessment. There's no exam prerequisite in the sense of needing another certification first, and ISACA lets you sit the exam before you've met the experience requirement.

That last point trips people up. You can register, sit, and pass CRISC with zero qualifying experience, but ISACA won't issue the actual certification until you submit and they verify that experience, and you have five years from your exam pass date to do it. Pass now and you're not locked out if your risk experience is still a year or two away.

How the Exam Is Scored and What Passing Requires

Because ISACA uses a scaled score rather than a raw percentage, don't chase a specific "percent correct" target from a prep vendor. Aim comfortably past 450 in practice exams, since the scaling means a borderline practice score doesn't reliably predict a pass on test day.

Renewal and Continuing Education

CRISC is not a one and done, lifetime credential, despite what a few outdated pages online still claim. ISACA requires a minimum of 20 CPE hours per year, adding up to 120 hours across a rolling three year cycle, reported through your ISACA account along with the annual maintenance fee. Miss the reporting or the fee and ISACA can revoke the designation, though there's an appeals path if that happens.

How CRISC Compares to Its Closest Alternative

The certification most often cross shopped against CRISC is ISC2's Certified in Governance, Risk and Compliance (CGRC), formerly known as CAP. CGRC leans heavily on the NIST Risk Management Framework and system authorization work, which makes it the stronger choice if your organization operates in federal or FedRAMP heavy environments. CRISC is broader and framework agnostic, and it puts more direct weight on risk reporting to business stakeholders rather than formal system authorization steps. If your work is authorizing and governing specific systems against a compliance framework, look at CGRC. If it's identifying and communicating enterprise risk to leadership, CRISC lines up more closely with what you actually do.

Preparation Timeline

Candidates already working in a risk adjacent role typically report six to ten weeks of part time study, built around the review manual plus a practice question bank, with extra time reserved for Domain 3 given its exam weight. Candidates coming from a pure technical or audit background without regular risk reporting exposure often need closer to twelve weeks, since the scenario judgment questions assume familiarity with how risk actually gets escalated and tracked in a live organization, not just textbook definitions.