ISACA CRISC
ISACA CRISC Cheat Sheet
CRISC Tests IT Risk Management Judgment — From Assessment Through Monitoring
CRISC is for risk practitioners who translate IT risk into business terms and manage the full risk lifecycle. Technical risk knowledge without business context will fail you.
Check Your Readiness →
Among the harder certs
Avg: Approximately 60–65%
Pass: 750 / 1000
Most candidates understand ISACA CRISC concepts — and still fail. This exam tests how you apply knowledge under pressure.
Core Framework
CRISC Four Domain Framework
CRISC tests risk management across the full lifecycle. The correct answer always connects IT risk to business impact, uses appropriate risk quantification, and selects responses aligned with the organization's risk appetite.
-
01
IT Risk Identification
— Identify, categorize, and evaluate IT risk scenarios
-
02
IT Risk Assessment
— Analyze likelihood, impact, and risk tolerance
-
03
Risk Response and Mitigation
— Select and implement appropriate risk responses
-
04
Risk and Control Monitoring and Reporting
— Track, measure, and report risk status
Scenario Traps
Wrong instinct vs correct approach
A risk assessment reveals a critical vulnerability in a core business system
✕ Wrong instinct
Immediately remediate the vulnerability regardless of cost
✓ Correct approach
Assess exploitability, business impact, and remediation cost relative to risk appetite; present response options to risk owners with a cost-benefit analysis — the risk owner decides, not the risk practitioner
IT risk monitoring reveals residual risk has increased above the accepted threshold
✕ Wrong instinct
Implement additional technical controls immediately
✓ Correct approach
Escalate to risk owners and senior management — exceeding risk tolerance thresholds requires a formal risk decision, not unilateral technical action
A new cloud service is being adopted — when should risk assessment occur?
✕ Wrong instinct
After deployment, to assess actual risk in production
✓ Correct approach
Risk assessment should occur before procurement and deployment — identify risks during vendor evaluation, negotiate contractual controls, and establish monitoring requirements before adoption
Quick Rules
Know these cold
-
▸
Inherent risk = pre-control; Current risk = with existing controls; Residual risk = post-response
-
▸
Risk responses: Accept, Avoid, Transfer, Mitigate — match to cost-benefit analysis
-
▸
Risk appetite is the organization's decision — the risk practitioner presents options
-
▸
KRIs are leading indicators; KPIs are lagging — design KRIs for early warning
-
▸
Risk assessments are continuous — not point-in-time events
-
▸
Risk exceeding tolerance requires escalation, not autonomous control deployment
-
▸
Risk register is the living document — update it as the threat landscape changes
Self Check
Can you answer these without checking your notes?
In this scenario: "A risk assessment reveals a critical vulnerability in a core business system" — what should you do first?
Assess exploitability, business impact, and remediation cost relative to risk appetite; present response options to risk owners with a cost-benefit analysis — the risk owner decides, not the risk practitioner
In this scenario: "IT risk monitoring reveals residual risk has increased above the accepted threshold" — what should you do first?
Escalate to risk owners and senior management — exceeding risk tolerance thresholds requires a formal risk decision, not unilateral technical action
In this scenario: "A new cloud service is being adopted — when should risk assessment occur?" — what should you do first?
Risk assessment should occur before procurement and deployment — identify risks during vendor evaluation, negotiate contractual controls, and establish monitoring requirements before adoption
Failure Patterns
Common Exam Mistakes — What candidates get wrong
Confusing inherent, current, and residual risk
Inherent risk is the risk before any controls. Current risk accounts for existing controls. Residual risk is what remains after all risk responses. Using these interchangeably produces incorrect risk treatment recommendations.
Selecting risk mitigation when transfer or acceptance is more appropriate
Risk responses must match the cost-benefit profile. Mitigating low-probability, low-impact risks with expensive controls is wasteful. Risk transfer or acceptance with monitoring may be more appropriate.
Treating risk assessment as a one-time activity
CRISC emphasizes continuous risk monitoring and reassessment. Technology environments change, new threats emerge, and existing controls degrade. Risk assessment is an ongoing practice, not a periodic event.
Ignoring risk appetite when selecting risk responses
Risk responses must be calibrated to the organization's risk appetite. A response that reduces risk below the risk appetite threshold wastes resources; one that leaves residual risk above tolerance is inadequate.
Confusing key risk indicators with key performance indicators
KRIs are forward-looking signals that warn of increasing risk exposure. KPIs measure current performance. CRISC tests whether you can design KRIs that provide early warning — not just measure current state.
CRISC tests risk management judgment across the full lifecycle. Test whether you're assessing and responding to IT risk correctly.