CRISC shows you can identify, assess, treat and monitor information systems risk and design the controls that keep it in check. Over four days we cover ISACA's four domains through risk scenarios and reviewed question sets. It suits organisations already working with ISO 27005 or enterprise risk management.
The essentials
Publisher : ISACA
Certification : CRISC – Certified in Risk and Information Systems Control
Duration : 4 days (28 h)
Level : Advanced
Formats : Live virtual class · In-person in Casablanca · On-site (intra-company)
Languages : French or English
Exam facts : 150 multiple-choice questions · 4 h · 450 on a 200–800 scale
Exam voucher: included or optional depending on the package — contact us.
Link IT risk management to governance, strategy and risk appetite.
Identify relevant threats, vulnerabilities and risk scenarios.
Analyse likelihood and impact to rank risks.
Select response options and design effective controls.
Monitor risks and controls and report to decision-makers.
Bring security and technology into the risk framework.
Practise on scenarios and a timed mock exam.
Program
Domain 1 – Governance (26%)
Business and IT environment, strategy and goals
Enterprise risk management
Risk appetite, tolerance and regulatory frameworks
Domain 2 – IT risk assessment (22%)
Risk identification and threat modelling
Vulnerability management
Risk analysis methods
Domain 3 – Risk response and reporting (32%)
Risk treatment plans
Control design and effectiveness
Monitoring and stakeholder reporting
Domain 4 – Technology and security (20%)
Technology roadmaps and development lifecycle
Data lifecycle management
Security frameworks and awareness
Prerequisites
No prerequisites to sit the exam.
To earn the credential, ISACA asks for three years of professional experience across at least two of the four CRISC domains, gained within the ten years before applying.
Familiarity with internal control or a standard such as ISO 27005 is an advantage.
Target audience
Risk managers and IT risk officers
Auditors, internal controllers and compliance managers
CISOs and security analysts
Project managers and architects involved in risk analysis
The exam
The CRISC exam has 150 multiple-choice questions in 4 hours. It is offered in English, Spanish and Japanese; there is no French version. It is computer-based, taken at a PSI test center or remotely with online proctoring. Scores range from 200 to 800 and you need at least 450 to pass. ISACA allows four attempts in a rolling twelve-month period. After passing you have five years to apply for certification, then must report at least 120 CPE hours per three-year cycle, with a minimum of 20 hours each year.
Preparation tips
Domain 3 is worth 32%: master risk response choices and control monitoring.
Keep risk owner and control owner clearly apart, a frequent twist in questions.
Revise with English questions, since there is no French exam.
Frequently asked questions (FAQ)
Is the CRISC exam available in French?
No. ISACA offers it in English, Spanish and Japanese. The course can still be delivered in French, with an English–French glossary for revision. Allow extra revision time to get used to the English wording.
CRISC or CISM?
CRISC concentrates on IT risk and controls; CISM covers security management as a whole. Choose according to your current and target role.
How much experience do I need?
Three years in at least two of the four domains, gained within the ten years before applying. You can sit the exam first and have five years to apply.
Does CRISC complement ISO 27005 certification?
Yes. ISO 27005 provides a risk assessment method, while CRISC widens the view to governance, controls and reporting.
Is the course available online or in Casablanca?
Both: as a live online class, in person in Casablanca, or on-site at your organization, taught in French or English.