Training course

This is a free, self-paced reading course for CRISC: Certified in Risk and Information Systems Control: ISACA’s credential for the practitioners who sit between the technology and the boardroom. CRISC is not an audit exam and it is not a security-management exam. It asks whether you can run the risk conversation itself: build a risk scenario from a business objective, size it honestly, defend the rating when someone senior wants it softened, design a key risk indicator that warns before the loss rather than after it, and decide whether a risk should be treated, transferred, accepted, or walked away from. This course is written to be read straight through, in order, before you start drilling practice questions.

The course is organized as one module per official exam domain, in the order ISACA publishes them, and each module carries the domain’s published weight. That structure matters here because CRISC is a judgment exam: nearly every question offers two or three defensible actions and asks which one is best, first, or most important. Definitions get you down to the two survivors; only the reasoning behind the definitions picks between them. Weighting the reading to the blueprint means you spend the most time in Risk Response and Reporting, which is where the exam spends the most of its own. Every lesson ends with its key terms and suggested further reading, so the course works as a reference after the first pass as well as a syllabus during it.

CRISC Professional level 4 modules Domain-weighted Self-paced Free account

What the course covers

Governance

Module 1 · 26%

Two halves of one discipline. Organizational governance, strategy, structure, roles, culture, policies and standards, business processes, and organizational assets. Then risk governance, the three-lines model, risk appetite against tolerance and capacity, the risk profile, legal, regulatory, and contractual obligations, and professional ethics. The questions turn on who owns a risk, who is entitled to accept one, what belongs in front of the board, and what you do when leadership leans on you to soften a rating.

IT Risk Assessment

Module 2 · 20%

Turning uncertainty into something decidable: identifying threats and vulnerabilities, building risk scenarios that carry a cause, an event, and a business consequence, and maintaining the risk register. Then analysis in both registers, qualitative heat maps and where they break down, ALE arithmetic, FAIR, sensitivity analysis, and holding the line between inherent and residual risk. Expect the exam to ask what you do first when an assessment surfaces something ugly.

Risk Response and Reporting

Module 3 · 32%

The heaviest domain by a wide margin, and the longest module here for that reason. Choosing among accept, mitigate, transfer, and avoid on cost-benefit grounds; control types and the gap between design effectiveness and operating effectiveness; compensating and bridge controls; third- and fourth-party risk; exception management and the mechanics of a risk acceptance that survives scrutiny. Then the reporting half. KRIs, KPIs, and KCIs, threshold setting, dashboards executives will actually read, and reporting honestly when a remediation date slips.

Information Technology and Security

Module 4 · 22%

The technology literacy a risk practitioner has to carry to be credible: change and configuration management; the SDLC and CI/CD pipelines; business continuity and disaster recovery, including reasoning about RTO and RPO; data classification and lifecycle; identity and access management; network security; SIEM and incident response; cloud shared responsibility; and emerging-technology risk, including machine learning models that drift after deployment.

How to use it

Read a module, then take the matching portion of the CRISC practice exam rather than waiting until you have finished everything. On CRISC the value of practice is not in checking whether you knew the term. It is in reading why the best answer beats the near-miss, because the near-misses are the whole game. When you get one wrong, work out whether you missed a fact or misread which stage of the risk process the question was standing in. Those are different failures and they need different fixes. The course modules themselves open once you are signed in to a free Certifym account.

If you want a quick read on where you stand before committing to the full course, the free CRISC sample questions are a short, no-signup pass across the blueprint. For exam logistics, question count, the four-hour sitting, the 200-800 scaled score with 450 to pass, pricing, and the three-year experience requirement for certifying, see the CRISC certification guide.

CRISC: Certified in Risk and Information Systems Control

One module per official CRISC exam domain, weighted the way ISACA weights them.

A self-paced reading course for CRISC: Certified in Risk and Information Systems Control, ISACA's credential for the practitioners who sit between the technology and the boardroom. The course is organized as one module per official exam domain, in the order ISACA publishes them, and each module carries the domain's published weight, so the time you spend maps to the time the exam spends.

You work through governance — strategy, structure, culture, policy, appetite, and professional ethics — then IT risk assessment, where scenarios, registers, and both qualitative and quantitative analysis turn uncertainty into something decidable. Risk response and reporting is the longest module, covering the four treatment options, control design and effectiveness, third-party risk, exception management, and the indicator and reporting work that tells leadership whether any of it is working. The final module covers the technology and security material a risk practitioner needs in order to judge whether a proposed control is plausible.

CRISC is a judgment exam: nearly every question offers two or three defensible actions and asks which is best, first, or most important. The lessons are written to teach the reasoning behind the definitions, not just the definitions, and each ends with its key terms and further reading so the course works as a reference after the first pass. Certifym is an independent study publisher and is not affiliated with, endorsed by, or sponsored by ISACA.

Module 1: Governance 26% of exam

Two halves of one discipline. Organizational governance — strategy, structure, roles, culture, policies and standards, business processes, and organizational assets. Then risk governance — the three-lines model, risk appetite against tolerance and capacity, the risk profile, legal, regulatory, and contractual obligations, and professional ethics.The questions in this domain turn on who owns a risk, who is entitled to accept one, what belongs in front of the board, and what you do when leadership leans on you to soften a rating. Get the structure right here and much of the rest of the exam becomes a matter of locating yourself in it.

1.1 What a risk practice is, and how CRISC thinks 6 min Free preview
1.2 Organizational strategy, goals, and objectives 5 min 🔒
1.3 Organizational structure, roles, and responsibilities 5 min 🔒
1.4 Organizational culture and risk culture 5 min 🔒
1.5 Policies, standards, procedures, and guidelines 5 min 🔒
1.6 Business processes and organizational assets 5 min 🔒
1.7 Risk governance and the three lines model 5 min 🔒
1.8 Enterprise risk management and risk frameworks 5 min 🔒
1.9 Risk appetite, tolerance, and capacity 5 min 🔒
1.10 The risk profile and risk-aware decision making 5 min 🔒
1.11 Legal, regulatory, and contractual requirements 5 min 🔒
1.12 Professional ethics of risk management 5 min 🔒
1.13 Risk communication, awareness, and training 5 min 🔒

Module 2: IT Risk Assessment 20% of exam

Turning uncertainty into something decidable: identifying threats and vulnerabilities, building risk scenarios that carry a cause, an event, and a business consequence, and maintaining the risk register. Then analysis in both registers — qualitative heat maps and where they break down, ALE arithmetic, FAIR, and holding the line between inherent, current, and residual risk.The module closes with business impact analysis, evaluation against criteria, prioritization, and the mechanics of running an assessment that survives review. Expect the exam to ask what you do first when an assessment surfaces something ugly.

2.1 Risk events, threats, and vulnerabilities 5 min 🔒
2.2 Threat modeling and the threat landscape 5 min 🔒
2.3 Building IT risk scenarios 5 min 🔒
2.4 The risk register and risk ownership 5 min 🔒
2.5 Qualitative risk analysis and its limits 5 min 🔒
2.6 Quantitative risk analysis: SLE, ARO, ALE, and FAIR 5 min 🔒
2.7 Inherent, current, and residual risk 5 min 🔒
2.8 Business impact analysis and asset valuation 5 min 🔒
2.9 Risk evaluation, ranking, and prioritization 5 min 🔒
2.10 Running an assessment: scope, method, and quality control 5 min 🔒

Module 3: Risk Response and Reporting 32% of exam

The heaviest domain by a wide margin, and the longest module here for that reason. Choosing among accept, mitigate, transfer, and avoid on cost-benefit grounds; control types and the gap between design effectiveness and operating effectiveness; compensating and bridge controls; third- and fourth-party risk; exception management and the mechanics of a risk acceptance that survives scrutiny.Then the reporting half — KRIs, KPIs, and KCIs, threshold setting, escalation paths, dashboards executives will actually read, the quality of the data underneath them, and reporting honestly when a remediation date slips.

3.1 The four risk response options 5 min 🔒
3.2 Cost-benefit analysis and choosing a response 5 min Free preview
3.3 Response plans, ownership, and execution 5 min 🔒
3.4 Control types and control functions 5 min 🔒
3.5 Control selection and design 5 min 🔒
3.6 Design effectiveness versus operating effectiveness 5 min 🔒
3.7 Compensating controls, bridge controls, and control gaps 5 min 🔒
3.8 Exception management and defensible risk acceptance 5 min 🔒
3.9 Third-party and fourth-party risk 5 min 🔒
3.10 Issues, findings, and remediation tracking 5 min 🔒
3.11 Control monitoring, testing, and assurance 5 min 🔒
3.12 Key risk indicators 5 min 🔒
3.13 Key performance and key control indicators 5 min 🔒
3.14 Thresholds, trigger points, and escalation 5 min 🔒
3.15 Risk reporting and dashboards 5 min 🔒
3.16 Risk data collection, aggregation, and validation 5 min 🔒

Module 4: Information Technology and Security 22% of exam

The technology literacy a risk practitioner has to carry to be credible: enterprise architecture and IT operations; change and configuration management; the SDLC and CI/CD pipelines; emerging technology, including machine learning models that drift after deployment; information security concepts and frameworks; data classification, privacy, and the data lifecycle.Then identity and access management, network and endpoint security, cloud shared responsibility, business continuity and disaster recovery with RTO and RPO reasoning, and security monitoring and incident response — which closes the loop back to the register the course opened with.

4.1 Enterprise architecture and IT operations risk 5 min 🔒
4.2 Change and configuration management 5 min 🔒
4.3 Project management, the SDLC, and CI/CD 5 min 🔒
4.4 Emerging technology and AI risk 5 min 🔒
4.5 Information security concepts, frameworks, and standards 5 min 🔒
4.6 Data classification, privacy, and the data lifecycle 5 min 🔒
4.7 Identity and access management 5 min 🔒
4.8 Network, endpoint, and infrastructure security 5 min 🔒
4.9 Cloud computing and shared responsibility 5 min 🔒
4.10 Business continuity and disaster recovery 4 min 🔒
4.11 Security monitoring, SIEM, and incident response 5 min 🔒

Frequently asked questions about the CRISC training course

Is the CRISC training course free?

Yes. The course costs nothing to read and opens once you are signed in to a free Certifym account, no payment and no card.

How is the course structured?

One module per official CRISC exam domain, in ISACA’s published order, with each module weighted to the domain’s published percentage. Risk Response and Reporting is 32% of the exam and is the longest module here. Within each module the material is broken into short lessons, followed by key terms and further reading.

Does this replace ISACA’s official training?

No. ISACA publishes the exam content outline, a review manual, and its own review courses, and those are the authoritative sources. This course is an independent study companion, written to be read quickly and to slot alongside practice questions, not a substitute for the official exam guide.

Do I need experience before starting?

Nothing stops you reading the course, but CRISC is written for practitioners. Certifying requires three or more years of cumulative work experience performing the tasks of at least two CRISC domains, with no waivers or substitutions, though you may sit the exam first and submit the experience within five years of passing. The material assumes you have seen enterprise IT from the inside; it teaches how to reason about risk in it, not the IT itself.

What should I do after finishing the course?

Move to the CRISC practice exam and work full-length, timed sets until you are clearing the pass mark across all four domains rather than by leaning on the ones matching your day job. Read every explanation, including the ones you got right. Then schedule with ISACA and plan the experience submission.

Is the course current with the latest CRISC outline?

The course is built against the job practice the certification guide identifies as the current outline, the four-domain structure with Governance at 26%, IT Risk Assessment at 20%, Risk Response and Reporting at 32%, and Information Technology and Security at 22%. ISACA can revise the job practice at any time; download the current exam guide from isaca.org before you sit.

Trademark notice & independence. Certifym.net is operated by Certifym Exam Services, LLC and is not affiliated with, endorsed by, or sponsored by ISACA. ISACA®, CRISC®, CISA®, and CISM® are registered trademarks of ISACA. Use of these marks is solely to identify the certification for which these study materials are intended. The CRISC exam content outline and its domain structure are the property of ISACA; candidates should download the official, current exam guide directly from isaca.org.

All course content, questions, answers, and explanations on Certifym are original content created for study purposes. They are not actual ISACA training materials or examination questions and are not represented as such. Studying with these materials does not guarantee a passing result on any live certification exam. Exam requirements, format, domain weights, pricing, and continuing-education policies are set by ISACA and may change; always verify current details on isaca.org before scheduling your exam.