CRISC certifies the people who keep an organization's IT risk register honest: they identify risk scenarios, rate them, agree treatments with business owners, design the controls and report the results. ISACA updated the exam on 3 November 2025, and the experience rule changed with it. If you pass now, you need three years of work in both risk assessment and risk response and reporting, and ISACA accepts no waivers or substitutions.
Who CRISC is for
The natural candidate works in IT risk or governance, risk and compliance (GRC) on the second line: an IT risk analyst or manager, a GRC analyst who runs control self-assessments, a consultant who builds risk programs. Control owners in IT who report key risk indicators upward also fit. The experience has to be specific. ISACA wants three years performing CRISC tasks in both Domain 2 (Risk Assessment) and Domain 3 (Risk Response and Reporting), gained within the ten years before you apply or within five years after passing.
That rule is new. Candidates who passed between August 2021 and November 2025 still apply under the older one: three years across at least two of the four domains, one of them Governance or Risk Assessment. If you passed in that window and haven't applied, check which rule your exam date puts you under before you write the application.
If your job is testing controls on the third line, CISA is the better match. If you run the security function and the risk register is one of your tools, CISM is written for you. And if you've done assessments but never owned a treatment plan, the new experience rule may keep you waiting after you pass.
CRISC exam facts after the 2025 update
| CRISC | |
|---|---|
| Format | 150 multiple-choice questions, one best answer each |
| Time | 4 hours (240 minutes) |
| Passing score | 450 on a scaled range of 200 to 800 |
| Price | US$575 for ISACA members, US$760 for non-members; US$50 application fee after passing |
| Delivery | PSI test centers or remote proctoring; English, Spanish and Japanese |
| Experience | Three years in both Risk Assessment and Risk Response and Reporting; no waivers |
| Outline | Effective 3 November 2025 |
| Renewal | Annual fee of US$45 (members) or US$85; 20 CPE hours a year, 120 over three years |
What the 2025 outline weights
- Governance: 26%
- Risk Assessment: 22%, up from 20%
- Risk Response and Reporting: 32%
- Technology and Security: 20%, down from 22%
Risk Response and Reporting is the largest domain, and it's three topics in one. Risk response covers treatment options, risk and control ownership, vendor and supply chain risk, and the handling of issues, exceptions and exemptions. Control design covers frameworks, selection and testing methods. Monitoring and reporting asks you to build key risk indicators (KRIs), key control indicators (KCIs) and key performance indicators (KPIs), aggregate and validate the data behind them, and present it in heat maps, scorecards and dashboards, including for emerging risks.
Governance is the second largest at 26%. It covers organizational strategy, culture and ethics, enterprise risk management, the lines of defense, risk appetite and tolerance, and the legal and contractual requirements that shape a risk framework. The Technology and Security domain is broad and shallow: enterprise architecture, DevOps and change management, the system development life cycle, Agile project management, resilience, emerging technologies, and security and privacy principles.
Expect questions that separate risk appetite from tolerance, inherent from residual risk, a KRI from a KPI, and a risk owner from a control owner. Ownership runs through the 24 supporting tasks: you assign and validate it, then collaborate with risk owners on treatment plans and with control owners on controls, which casts the practitioner as adviser and coordinator. Another task asks you to facilitate tabletop exercises.
Preparing with a risk register of your own
ISACA's materials are built around the 2025 outline: the CRISC Review Manual, 8th edition, the Questions, Answers and Explanations database with an 833-question pool, and an online review course. Check that anything secondhand was published after September 2025, when ISACA released the updated prep, since older material uses the previous weights.
Domain 3 deserves about a third of your study time, and governance a quarter. The best practice is a risk register you build yourself. Take one real system, write five risk scenarios with a threat, a vulnerability and a business impact, and rate each for inherent and residual risk. Name a risk owner and a control owner for each, then pick one treatment and define a KRI with a threshold that would trigger escalation.
Run practice questions in timed blocks, roughly a minute and a half each, since you'll have 240 minutes for 150. When you miss one, check whether you picked a technically sound fix that ignored who owns the risk or what the appetite allows.
If you're paying yourself, join ISACA first. Professional membership is US$145 a year plus chapter dues, and the member price saves US$185 on the exam.
Applying, renewing and moving on
Apply within five years of passing, pay the US$50 fee and have a supervisor, manager, colleague or client verify your experience. Family members and HR can't verify it. You then report at least 20 CPE hours every year and 120 across each three-year cycle, with at least 90 tied to the CRISC outline, and pay US$45 a year as a member or US$85 as a non-member. Once you hold more than two ISACA certifications the fee for each extra one drops to US$25 or US$50. Failing to report or pay leads to revocation. An appeal can reinstate you, with a US$50 fee after 60 days, but after three years you'd have to pass the exam again.
Options from here:
- AAIR, ISACA's AI risk credential launched in April 2026, lists CRISC among its qualifying certifications and costs US$459 for members or US$599 for non-members.
- CISM if you move into running a security program.
- CISA if you'd rather assess controls than design them.
Our view
CRISC is narrower than CISM and better aimed at the second line. That focus is its strength, since few credentials are built around running an IT risk register, and the vocabulary it drills (appetite, tolerance, indicators) is what you need when you talk risk with business owners. Critics say the exam rewards ISACA's terminology as much as judgment, and the 2025 experience rule now shuts out people whose risk work has been assessment without treatment. We'd pay for it if your title or next role has "risk" in it and you own the register; if you only feed it, CISA or CISM will probably serve you better.
Sources
- ISACA: CRISC certification: price, application fee, delivery, five-year window, prep products and 833-question pool, checked October 2026
- ISACA: CRISC Exam Content Outline: domains, weights and subtopics, checked October 2026
- ISACA: Certification Exam Candidate Guide 2026 (PDF): questions, time, languages, scaled score, no waivers, supporting tasks, retake rules, checked October 2026
- ISACA press release: CDPSE and CRISC exam updates: 3 November 2025 date, weight changes, prep material date, checked October 2026
- ISACA Support: requirements to become CRISC certified: experience rules before and after November 2025, verifiers, checked October 2026
- ISACA: Maintain your CRISC: fees and CPE hours, checked October 2026
- ISACA: CPE Policy (PDF): 90 aligned hours, revocation and expiry, checked October 2026
- ISACA: Become a member: professional membership dues, checked October 2026
- ISACA: AAIR certification: qualifying certifications and price, checked October 2026
- ISACA press releases, 2026: AAIR launch on 15 April 2026, checked October 2026