Topics in this domain
- Exam Technique: Thinking Like a Risk Practitioner
- Aligning IT Risk Management with Business Strategy
- Organisational Structure, Roles and Decision Rights
- Risk Ownership and Accountability
- Segregation of Duties
- Risk Culture and Tone at the Top
- Ethics and Professional Conduct
- Policies, Standards, Procedures and Guidelines
- Policy Lifecycle, Exceptions and Enforcement
- Business Process Review: Ownership and Criticality
- Identifying and Valuing Organisational Assets
- Embedding Asset Management into Risk Governance
- Enterprise Risk Management: Purpose and Principles
- The Risk Practitioner's Role in ERM
- The Three Lines Model and Risk Oversight
- Risk Management Frameworks: ISO 31000, COSO ERM, NIST and COBIT
- Applying a Framework: the Risk Management Life Cycle
- Risk Appetite, Tolerance and Capacity
- Establishing and Maintaining the IT Risk Profile
- Making Risk-Based Business Decisions
- Legal, Regulatory and Contractual Requirements
- Connecting Governance to Risk Outcomes
Exam Technique: Thinking Like a Risk Practitioner
The exam in numbers
| Item | Detail |
|---|---|
| Questions | 150 multiple choice, one best answer from four |
| Time | 4 hours |
| Scoring | Scaled from 200 to 800; 450 passes |
| Weights (from 3 November 2025) | Governance 26%, IT Risk Assessment 22%, Risk Response and Reporting 32%, Information Technology and Security 20% |
| To certify after passing | Three years of experience in IT risk management and IS control, across at least two of the four domains (one of them Domain 1 or 2), plus the code of ethics and continuing education |
Check ISACA’s candidate guide for current fees, booking and identification rules before you sit.
Two answers look right
Most CRISC questions have two or three plausible options. A security engineer, an auditor and a risk practitioner would each choose differently, and the exam wants the risk practitioner’s answer: understand and assess the risk, then help the owner choose a response.
Example. “A new vulnerability affects a customer portal. What should the risk practitioner do FIRST?” Patching sounds right, but the practitioner first assesses the risk: exposure, likelihood, impact and existing controls. Then the risk owner decides how to respond.
A method for every question
- Find the role: you’re the risk practitioner advising the business, not the auditor, the engineer or the CEO.
- Find the qualifier: FIRST, BEST, MOST, PRIMARY or MOST LIKELY.
- Find the stage: governance, identification, assessment, response or monitoring and reporting?
- Eliminate answers that skip a stage, fix the problem yourself or decide on the owner’s behalf.
- Choose the practitioner’s answer: risk-based, compared with appetite, owner decides, in the right order.
The practitioner’s mindset
| Usually right | Usually wrong |
|---|---|
| Link the risk to business objectives | Implement a control straight away |
| Assess or analyse before responding | Skip assessment and jump to treatment |
| The risk owner decides and accepts | The practitioner (or IT) accepts the risk |
| Compare with risk appetite and tolerance | Aim to eliminate all risk |
| Update the risk register and profile | Report technical detail to the board |
| Report in business terms and escalate | Decide on cost alone |
These are tendencies, not rules. Read the scenario: if the risk has already been assessed, the next step may well be a response or a report.
Reading the qualifiers
| Qualifier | What it’s really asking |
|---|---|
| FIRST | Which step of the risk process comes before the others? |
| BEST / MOST effective | The option that best keeps risk within appetite for the business |
| PRIMARY / MAIN | The fundamental purpose, not a side benefit |
| MOST LIKELY | The probable cause or result, not the worst case |
| GREATEST concern / risk | What would hurt business objectives most |
Preparing well
- Learn the risk life cycle well; most questions sit at one stage of it.
- For each wrong answer, ask: which stage of the process did that option skip?
- Study by weight: Domain 3 alone is 32% of the exam.
- Pace yourself at about 1.5 minutes per question; flag hard ones and return.
- Answer every question; there’s no penalty for guessing.
In short
- The CRISC exam has 150 multiple-choice questions in 4 hours; scores are scaled from 200 to 800 and 450 passes.
- Every question is answered from the risk practitioner's viewpoint: identifying, assessing, responding to and reporting IT risk so the business can decide.
- Read the qualifier: FIRST, BEST, MOST, PRIMARY and MOST LIKELY change which answer is right.
- FIRST questions are about the risk process in order: context, identification, analysis, evaluation, response, monitoring.
- The risk owner decides and accepts risk; the practitioner advises, facilitates and reports.
- Answers that link risk to business objectives and appetite are usually right; answers that jump to a control are usually wrong.
Exam traps
- Choosing to implement a control before the risk has been assessed.
- Letting the risk practitioner, the CISO or IT accept a business risk.
- Picking 'eliminate the risk'; the aim is risk within appetite.
- Choosing the most technical answer instead of the risk-process answer.
- Reporting technical detail to the board instead of business impact.
Slides
Click the slide and use the arrow keys. F toggles full screen.
A method for every question
The practitioner's mindset
1 / 9