CRISC: whether IT risk work qualifies you, and how to prepare

By Alexander Shick · Updated November 5, 2026

Who CRISC is built for

ISACA says CRISC “demonstrates your IT risk management expertise.” The four domains are governance, risk assessment, risk response and reporting, and technology and security, and ISACA now includes AI risk assessment and AI data governance in that scope. It fits IT risk analysts, control owners, compliance staff and the security or audit people who own a risk register. It shows you can run the risk process, not that you can configure the controls.

The three-year rule, and which version applies to you

Anyone can sit the CRISC exam; the experience is needed only to certify. ISACA's support article (dated September 22, 2026) sets the rule by when you pass. If you passed after November 2025, you need three years of verified work performing CRISC tasks in both domain 2 (risk assessment) and domain 3 (risk response and reporting). ISACA says there are no substitutions or experience waivers, and the work must fall within the ten years before you apply or the five years after you first pass.

People who passed between August 2021 and November 2025 need three years across at least two of the four domains, one of them governance or IT risk assessment. ISACA's get-certified page still shows that two-of-four wording, so if your experience is mainly in governance or technology, confirm with ISACA which rule covers your pass date. Either way, you apply within five years of passing, pay a US$50 processing fee, and have a supervisor, manager, colleague or client verify the work.

Four domains, weighted toward risk response

The exam is 150 multiple-choice questions in 4 hours. ISACA scores on a scale of 200 to 800, and 450 passes. You register any time, take it at a PSI test center or online with a remote proctor, and have six months from registration to sit it.

Risk response and reporting is almost a third of the exam. Plan extra hours for the side you have not worked: governance and enterprise risk frameworks if you come from security, the technology and security domain if you come from enterprise risk.

Self-study or a CRISC class

ISACA's own products cover most needs. The question database (983 questions in version 8.1, per ISACA's store page; the CRISC landing page still says 833; three timed practice exams, 6 months of access) is the piece most candidates use; the 8th-edition review manual is the reference; and the online review course adds about 14 hours of video and interactive modules with a 25-question practice exam. ISACA also has a free 10-question practice quiz and member-only online study groups.

A live boot camp makes sense when an employer pays or you need fixed dates. Risk Tide's four-day class bundles ISACA's materials, the exam, a retake and membership; Learning Tree's includes the voucher and coaching after the course.

CRISC prices we found

Totals add the $760 non-member exam fee unless the provider includes the exam.

Join before you register. ISACA's professional membership costs US$145 a year before any chapter dues, and the member exam price alone saves $185, $40 more than the dues. Add the review manual ($30 off) and question bank ($100 off) and the saving reaches $315, $170 more than the dues, unless your chapter charges more than that. The costs people miss: each retake is a full registration fee, with waits of 30 days before the second attempt and 90 days before the third and fourth, and no more than four attempts in 12 months.

Before you pay a CRISC provider

• Does the course follow the current outline? Risk Tide says its class follows ISACA's outline updated in November 2025; ask other providers which edition of ISACA's materials they use.
• What does a retake cost? Risk Tide includes one free retake; ask Learning Tree and others what happens if you fail.
• How long do you have to use the voucher? Learning Tree says you must test within 6 months of redeeming the voucher, with 6 months of course and question-bank access.
• Is ISACA membership included? Risk Tide includes a year; without it you pay non-member prices for anything you add, so ask others whether theirs does.

Renewing CRISC each year

Once certified, you report at least 20 CPE hours a year and 120 over each three-year cycle, and pay an annual maintenance fee of US$45 as a member or US$85 otherwise. From January 1, 2027, ISACA lets up to 30 of the 120 hours be general learning outside the CRISC domains; the other 90 or more must relate to CRISC. Hours that fit more than one ISACA certification count toward each.

Funding CRISC for a risk team

Check experience person by person before paying for a group: under the current rule, staff whose work sits only in governance or only in technology will pass but cannot certify until they have three years in risk assessment and risk response. For a group, compare one private class against ISACA's question bank for each person plus an internal study group.

Questions about CRISC

How much is the CRISC exam?

$760 for non-members and $575 for ISACA members, as of November 2026.

Can I take CRISC without three years of experience?

Yes. You can sit and pass the exam first; you then have five years to apply, with the experience verified.

Does CISA or CISM experience count?

Only where the work matches CRISC tasks. ISACA lists no substitutions or waivers for exam passers after November 2025.

How is CRISC scored?

On ISACA's 200 to 800 scale; 450 or higher passes.

Next step

Send us a short description of your risk work and your deadline, and we will check it against the experience rule and suggest a study route.

Ask for help choosing CRISC training