IT, Cloud & Cybersecurity • Certification
Certified in Risk and Information Systems Control
Prove enterprise IT risk and control expertise.
Researched and maintained by TestPrepPilot Editorial BoardIT governance & risk certifications desk · Figures last verified August 2026
The short version
What is the Certified in Risk and Information Systems Control and is it worth it?
CRISC is a 150-question, 4-hour exam scored 450/800, costing $575 for members and $760 for non-members. Three years of IT risk experience is required. It is valid three years with 120 CPE credits.
- Establishes enterprise IT risk credibility
- Four domains from governance to controls
- Valuable for GRC and risk roles
- Pairs with CISA and CISM
What is it?
What exactly is the Certified in Risk and Information Systems Control?
Prove enterprise IT risk and control expertise.
The Certified in Risk and Information Systems Control (CRISC) validates the ability to identify, assess and manage enterprise IT risk and design effective controls. It is aimed at IT risk managers, GRC specialists and control analysts and sits at the intersection of business risk and security.
The path in brief
- Join ISACA
- Study the 4 domains
- Schedule via PSI
- Pass at 450/800
- Maintain 120 CPE/3yr
Before you book
Who is eligible to sit the Certified in Risk and Information Systems Control?
Who it is for: IT risk managers, GRC and control professionals.
The test itself
What is the format of the Certified in Risk and Information Systems Control?
The Certified in Risk and Information Systems Control is administered by PSI test centre or remote proctoring and runs 4 hours, contains 150 questions and requires 450 / 800 scaled to pass.
| Administered by | PSI test centre or remote proctoring |
|---|---|
| Questions | 150 questions |
| Time limit | 4 hours |
| Pass mark | 450 / 800 scaled |
| Exam fee | ~$400-575 |
| Format | Multiple choice (scenario-based) |
Content outline
What topics are on the Certified in Risk and Information Systems Control?
The Certified in Risk and Information Systems Control is weighted across 4 domains; the largest are Risk Response and Reporting (32%), Governance (26%), Technology and Security (22%).
Weightings come from the official exam outline. Study time is best allocated in roughly these proportions rather than evenly across domains.
- Governance 26%
Risk appetite and ERM
- IT Risk Assessment 20%
Threats and analysis
- Risk Response and Reporting 32%
Treatment and metrics
- Technology and Security 22%
Controls and resilience
Money & time
How much does the Certified in Risk and Information Systems Control cost?
For the Certified in Risk and Information Systems Control, the exam fee is ~$400-575; the all-in cost is typically $675-$1,160; most candidates spend 3-4 months preparing.
Cost breakdown
| Exam fee | $575-$760 |
|---|---|
| Review manual/QAE | $100-$400 |
| Typical total | $675-$1,160 |
ISACA membership lowers the exam fee and study discounts.
Timeline
- Study 3-4 months
Typical prep: 3-4 months
The path
How do you register for the Certified in Risk and Information Systems Control?
- 1
Register with ISACA10 minutes
Create an account; membership lowers the exam fee and unlocks study discounts.
- 2
Pay the exam fee
Members pay $575, non-members $760. A $50 application fee may apply for some credentials.
- Members: $575
- Non-members: $760
- 3
Schedule via PSI
Book a slot at a PSI test centre or choose remote proctoring.
- Test centre
- Remote proctored
- 4
Take the exam
Complete the 150-question exam and receive a scaled score.
The fine print
What are the retake and renewal rules for the Certified in Risk and Information Systems Control?
- Proctoring & delivery
- ISACA exams are delivered by PSI at authorised test centres or through PSI remote proctoring, with a live proctor and secure-room requirements.
- Retake policy
- Candidates may attempt an exam up to four times in a rolling 12-month period: a 30-day wait before attempt 2, then 90-day waits before attempts 3 and 4. Each attempt requires a new registration fee.
- Score reporting
- Exams are scored on a 200–800 scale; 450 is the passing mark. Candidates see a preliminary pass/fail at the centre, with the official score following.
- Recertification
- Certifications are valid for three years. Holders must earn 120 CPE credits over the cycle (minimum 20 per year) and pay the annual maintenance fee ($45 members / $85 non-members).
What it pays
How much does this credential pay?
Expect information-security-analyst pay at a May 2024 median of $124,910 (BLS) — the CRISC is ISACA’s risk-and-compliance credential, and the governance, risk, and compliance roles it serves sit at the top of the security occupations
The direct answer is that the CRISC (Certified in Risk and Information Systems Control) is ISACA’s risk-management and control credential, and the occupations it serves — information security analysts (SOC 15-1212), at a May 2024 median annual wage of $124,910, and the broader risk and compliance roles that sit within business and financial operations — place CRISC holders in the well-compensated tier of security and governance work, with senior risk and GRC roles earning above the occupation medians. The honest framing is that the certification does not set pay — GRC salaries are set by market, employer, and seniority — but the credential signals risk-management and control competence (risk identification, assessment, response, and monitoring; and IS control design and implementation) that employers list for risk, compliance, and audit roles, and it is one of ISACA’s most-taken certifications after CISA. BLS counted about 185,000 information security analysts in 2024 and projects about 30 percent employment growth from 2024 to 2034, much faster than average. The exam itself is a computer-based test of 150 questions with 4 hours, scored on a 200-800 scale with a passing standard of 450, and candidates must meet the experience requirement (typically 3 years of relevant work experience in at least 3 of the 5 CRISC domains). The practical read: the CRISC is the risk-and-compliance complement to the CISA (audit) credential, valuable for security and IT professionals moving into GRC, and the credential’s value is the ISACA risk-management signal in a high-demand governance field. For candidates deciding whether to pursue it, the exam rewards applied risk-management knowledge, and the strongest preparation combines the ISACA QAE (Question & Answer Database) with the review manual.
| Measure | Figure | Source / note |
|---|---|---|
| Median annual wage, information security analysts | $124,910 | BLS Occupational Outlook Handbook, May 2024 (SOC 15-1212) |
| Lowest 10 percent | less than $73,000 | BLS OOH, May 2024 |
| Highest 10 percent | more than $170,000 | BLS OOH, May 2024 |
| Projected growth, 2024-34 | +30% | BLS Employment Projections |
| The certification itself | Professional credential | 150 questions, 4 hours, passing standard 450/800 |
Job growth.BLS projects about 30% growth for information security analysts from 2024 to 2034, much faster than average.
Your odds
What are the pass rates?
ISACA publishes no pass rates — the CRISC is 150 questions in 4 hours with a passing standard of 450/800, and ISACA reports pass/fail rather than cohort data
The core fact is that ISACA does not publish pass rates for the CRISC exam, and none is available from an independent source, because ISACA reports candidate pass/fail rather than cohort pass percentages. What is published is the exam structure: the CRISC is a computer-based test of 150 multiple-choice questions with 4 hours allowed, scored on a 200-800 scale with a passing standard of 450; the exam covers four domains — IT risk identification, IT risk assessment, risk response and mitigation, and risk and control monitoring and reporting — weighted across the paper. Candidates must also meet the experience requirement: typically three years of relevant work experience across at least three of the four domains, with an education waiver option. Because ISACA publishes the exam content outline and the QAE (Question & Answer Database), the preparation is studying the review manual and calibrating with the QAE; the classic failure mode is under-practising the applied risk-scenario items, which reward the ISACA risk-management framework rather than general security knowledge. The certification is valid and requires continuing professional education for renewal. The honest advice is to treat the content outline as the syllabus, complete the ISACA review manual, and drill the QAE extensively before booking, since the exam rewards the ISACA framework’s specific approach to risk.
Read this before quoting the number.ISACA publishes no pass rates; the passing standard is 450/800 and an experience requirement applies.
Source: ISACA — CRISC certification
Your schedule
How long should I study for it?
100-150 study hours over 10-14 weeks of focused study
Plan for roughly 10 to 14 weeks and 100 to 150 hours of study for the CRISC, structured around the four domains — risk identification, risk assessment, risk response and mitigation, and risk monitoring — with the ISACA QAE as the primary calibration tool. The exam’s weight favours risk response and risk assessment, so allocate study time there first. The most effective sequence is: first, confirm your experience requirement eligibility and obtain the content outline; second, complete the ISACA review manual in order, learning the risk-management framework; third, drill the QAE domain by domain, since the exam rewards the ISACA approach; fourth, take timed QAE-based practice exams; and fifth, re-study the weak domains and book the exam. The highest-yield habit is the QAE drilling — the exam’s scenario items mirror the QAE style, and candidates who complete the full database score well above those who only read. Budget the risk-response domain the most time, since it carries the largest question share. After passing, complete the experience verification and plan the CPE cycle, since the certification renews with continuing professional education.
- Weeks 1-335
Review manual
- Confirm eligibility and get the outline
- Complete the ISACA review manual
- Log weak domains
- Weeks 4-860
QAE drilling
- Drill the QAE domain by domain
- Study risk response and assessment deeply
- Take a timed QAE practice exam
- Weeks 9-1240
Practice + gaps
- Complete remaining QAE questions
- Re-study weak domains
- Take timed practice exams
- Final weeks15
Exam readiness
- Light QAE review
- Confirm exam logistics
- Book the exam
Adjusting the pace
Experience requirement.Typically 3 years across 3 of the 4 domains, with education waivers available.
CISA complement.The CRISC pairs with the CISA (audit) credential for the GRC profile.
How to study
How do I prepare most effectively?
The strategy that reliably passes the CRISC is "learn the ISACA risk framework from the review manual, then drill the QAE to fluency," and the single biggest error is preparing with general risk or security knowledge instead of the ISACA framework the exam tests. A second proven approach is weighting the risk-response and risk-assessment domains, which carry the largest question shares. Third, treat the QAE as the exam rehearsal — the scenario items mirror its style, and completing the full database is the strongest readiness predictor. Fourth, master the risk-scenario items, which present an organisation situation and ask for the ISACA-framework answer about identification, assessment, response, or monitoring. Fifth, confirm the experience requirement early, since eligibility is part of the certification gate. Finally, plan the CPE cycle from the start, since the credential renews with continuing professional education and letting it lapse is the most common way ISACA professionals lose the credential.
Learn the ISACA framework
The exam tests the ISACA risk approach, not general knowledge.
Weight risk response and assessment
The largest question shares.
Drill the QAE to fluency
The full database is the strongest readiness predictor.
Confirm the experience requirement
Eligibility is part of the certification gate.
Plan the CPE cycle
The credential renews with continuing professional education.
What to buy
Which study resources are worth paying for?
CRISC preparation runs $400 to $1,000 depending on the package, with the ISACA review manual and QAE as the core investment. The comparison below separates the exam fee, official resources, and the prep options, with prices current to this review. The buying rule is to budget for the QAE — it is the strongest calibration tool — and the review manual as the syllabus.
| Resource | Price | Format | Best for |
|---|---|---|---|
| CRISC exam registration | ~$400-575 | Computer-based at PSI/Pearson VUE | The exam itself |
| ISACA review manual | ~$100-150 | Book or digital | The authoritative syllabus |
| ISACA QAE (Question & Answer Database) | ~$150-250 | Online question bank | The primary calibration tool |
| ISACA review courses | ~$500-1,000 | Instructor-led or online | Structured review |
| Application fee (experience verification) | Included/varies | Online application | The certification gate |
Prices approximate and dated to this review; the experience requirement applies and CPEs maintain the certification.
Avoid these
What mistakes do candidates most often make?
The most common mistake is preparing with general risk or security knowledge instead of the ISACA framework the exam tests; the second is under-using the QAE, the strongest calibration tool. A third recurring error is being weak on the risk-scenario items, which reward the ISACA approach to identification, assessment, response, and monitoring. Candidates also routinely ignore the experience requirement until after the exam, and many let the CPE cycle lapse, losing the credential. Finally, some candidates skip the review manual and study QAE answers alone, missing the framework the answers depend on.
✕General-knowledge preparation
✓Learn the ISACA risk framework from the review manual.
✕Under-using the QAE
✓Complete the full database; it is the strongest predictor.
✕Weak on risk scenarios
✓Drill the identification-to-monitoring scenario items.
✕Ignoring the experience gate
✓Confirm the 3-year experience requirement early.
✕Missing the CPE cycle
✓Plan continuing professional education from the start.
What you'll face
What question types will I see?
The CRISC contains 150 multiple-choice questions in 4 hours, scored on a 200-800 scale with a passing standard of 450, covering four domains: IT risk identification, IT risk assessment, risk response and mitigation, and risk and control monitoring and reporting. The signature item format presents an organisational risk situation and asks for the ISACA-framework action. The samples below are editor-written illustrations of the published content outline, not live exam items.
Identifying and classifying IT risk.
Analysing and evaluating risk.
Selecting and implementing responses.
Monitoring and communicating risk.
Try these
Q1Which risk response is most appropriate for a high-impact risk the organisation accepts deliberately?
Answer:B
Acceptance with documented rationale is the appropriate response when the organisation consciously accepts the risk.
Q2Which process identifies emerging IT risks before they materialise?
Answer:A
Continuous monitoring identifies emerging risks as the environment changes.
Q3Which factor is most important when prioritising IT risks for response?
Answer:A
Risk prioritisation is driven by likelihood and impact.
Samples are editor-written illustrations of the published content outline, not live exam items.
The big day
What should I expect on exam day?
The CRISC is taken on computer at a PSI or Pearson VUE testing center: 150 multiple-choice questions with 4 hours, scored on a 200-800 scale with a passing standard of 450, with results typically available within a few days. The core rules: bring valid photo ID, arrive early, and follow testing-center rules. The certification requires the experience verification after the exam. The most useful exam-day habits: pace at about 1.6 minutes per question, flag and return to the scenario items, and answer every question (no penalty for guessing). If you do not pass, ISACA allows retakes after a waiting period. After passing, complete the experience verification, then plan the CPE cycle, since the credential renews with continuing professional education.
Bring
- Valid photo ID
- Arrival 30 minutes early
- A 4-hour sitting mindset
Leave at home
- Phone, smartwatch, and study materials (testing-center rules)
- Personal notes in the testing room
How the day runs
Rules in the room
- 150 questions, 4 hours
- Passing standard 450/800
- Computer-based at PSI/Pearson VUE
- Experience requirement + CPEs
Afterwards.Passing the CRISC plus the experience verification earns the Certified in Risk and Information Systems Control credential, ISACA’s risk-and-compliance certification, maintained with CPEs.
Reference
What are the key facts about the Certified in Risk and Information Systems Control?
Certified in Risk and Information Systems Control is a certification credential; awarded by ISACA; the exam fee is ~$400-575; typical preparation is 3-4 months; holders typically earn $110,000-$155,000.
| Credential | Certified in Risk and Information Systems Control |
|---|---|
| Abbreviation | CRISC |
| Type | Certification |
| Profession | IT, Cloud & Cybersecurity |
| Specialty | Cybersecurity (Vendor-Neutral) |
| Awarded by | ISACA |
| Difficulty | Hard |
| Typical prep time | 3-4 months |
| All-in cost | $675-$1,160 |
| Typical salary range | $110,000-$155,000 |
| Delivery | PSI test centre or remote proctoring |
| Retake | Up to 4 attempts/12mo; 30 then 90-day waits |
| Validity | 3 years; 120 CPE + $45/$85 annual fee |
| Scope | National / Multi-state |
| Also known as | CRISC |
Real questions
Frequently asked questions about the Certified in Risk and Information Systems Control
What does CRISC cover?
Four domains: governance, risk assessment, risk response and reporting, and technology/security — the full lifecycle of enterprise IT risk and control.
What is the pass mark?
A scaled 450 out of 800 on the 150-question scenario-based exam.
What experience is required?
Three years of IT risk management and controls experience; you can pass first and submit within five years.
How do I renew CRISC?
Earn 120 CPE credits over three years and pay the annual maintenance fee ($45 members / $85 non-members).
Why is the ISACA passing score 450?
ISACA uses a scaled 200–800 range; 450 is the fixed threshold, not a raw percentage. Scenario-based items are weighted by difficulty.
Can I sit the exam without the experience?
Yes for most credentials. You can pass first and have five years afterward to submit verified experience.
In short
Is the Certified in Risk and Information Systems Control worth it?
- CRISC is ISACA’s IT risk and control cert
- 150 questions, 4 hours, 450/800, $575-$760
- Four domains; 3yr risk experience
- 3-year validity; 120 CPE
Same awarding body
What other credentials does ISACA award?
Worth comparing
How does the Certified in Risk and Information Systems Control compare with similar credentials?
Trust
Where does this information come from?
Everything above is taken from the awarding body's own published material. Fees, question counts and domain weights are revised regularly — check the official page before you pay.
- ISACA Awarding body
- Official Certified in Risk and Information Systems Control exam page Exam page
- ISACA certification programme Programme rules
Research confidence: high · Last reviewed 2026-08