CRISC
Certified in Risk and Information Systems Control · ISACA
The CRISC proves you can identify, assess, treat and monitor information technology risk, and design and follow up the associated controls. It is valued by risk management functions in banking, insurance and large groups, and fits well with regulatory requirements such as DORA. Its strength is a clear focus on IT risk as seen by the business; its limit is a narrower audience than the CISM or CISA.
- Exam
- 150 multiple-choice questions in 4 h, scaled score from 200 to 800 with a pass mark of 450. In a PSI test centre or online with remote proctoring.
- Exam price
- $575ISACA member price; non-members pay US$760. A US$50 application fee is due when applying for certification after passing.
- Required experience
- Three years of IT risk management and IS control experience across at least two of the four domains, within the ten years before applying. No waivers.
- Validity and maintenance
- At least 20 CPE hours per year and 120 over 3 years, plus an annual fee of US$45 (members) or US$85 (non-members).
- Format
- Multiple choice
- Recognition
- ISO/IEC 17024 accredited
Who is it for?
IT risk managers, risk and control analysts, GRC consultants and second-line-of-defence teams with three years of experience in IT risk and controls.
Domains covered
- Governance: 26%
- IT risk assessment: 22%
- Risk response and reporting: 32%
- Information technology and security: 20%
Belinda’s take
Information checked on 2 October 2026 against the official site. Prices exclude tax and training, and may change.
The certification names mentioned are trademarks of their respective owners. KrakenShield is not affiliated with any certification body and does not reproduce any exam question.
