CRISC Exam Guide 2026: Domains, Cost, and Study Plan

CRISC exam guide for 2026

The current CRISC exam has 150 multiple-choice questions in four hours, uses a 200-800 scaled score, and requires 450 to pass. Registration is US$575 for ISACA members or US$760 for nonmembers. The exam outline effective November 3, 2025 weights the domains 26%, 22%, 32%, and 20%.

Those numbers matter because many guides still show the previous 26/20/32/22 split or an outdated eligibility window. This guide uses ISACA's current credential page, exam content outline, 2026 Candidate Guide, certification requirements, and maintenance page, all checked July 30, 2026.

free CRISC practice questionsPractice questions with detailed explanations

CRISC exam at a glance

ISACA includes both scored questions and unscored pretest questions in the exam. Pretest items do not affect your result. You cannot identify them, so give every item the same attention. There is no penalty for an incorrect answer; answer all 150 questions.

A preliminary pass or fail status appears after the exam. ISACA says the official score is available within 10 working days.

The four current CRISC domains

ISACA updated the CRISC outline for exams delivered from November 3, 2025. Risk Assessment increased from 20% to 22%, while Technology and Security decreased from 22% to 20%. Governance and Risk Response and Reporting remained at 26% and 32%.

Use the percentages to set an initial allocation, not to predict an exact question count. Domain 3 deserves the largest block, but a weak lower-weighted domain still needs remediation. Download the official outline before studying and use its task and knowledge statements as your checklist.

Can you take the exam before you have the experience?

Yes. The exam is open to anyone. Passing it and earning the certification are separate steps.

To become CRISC certified, you need at least three years of cumulative professional experience performing IT risk management and information systems control work across at least two of the four CRISC domains. ISACA does not allow experience waivers or substitutions.

Current timing rules are:

1. You may take the exam before meeting the experience requirement.
2. Your qualifying experience must have been earned within the 10 years before your certification application.
3. You must submit the certification application within five years after passing the exam.
4. The application must include verified experience, acceptance of ISACA's ethics and policy requirements, and the US$50 processing fee.

Do not add an extra domain restriction from an older or third-party summary. The current CRISC certification page states at least two of the four domains. Use the current application form when you are ready to document the work.

What CRISC actually costs

The fixed fees most candidates need to plan for are:

Professional ISACA membership currently costs US$145 to join and US$135 per year after that, plus local chapter dues. The exam discount is US$185, but that does not make the first-year membership decision an exact break-even: chapter dues and the live checkout total vary. Compare the member and nonmember totals at checkout before paying.

Preparation products are optional and their prices can change. Check the live ISACA store instead of relying on a bundled total from a blog. A retake requires another full exam fee.

Registration, scheduling, and retakes

After registration and payment, you receive a six-month exam eligibility window. ISACA says candidates may schedule as early as 48 hours after registration. Available appointments depend on PSI capacity and the selected delivery method.

Read the appointment confirmation and the current Candidate Guide before exam day. The guide controls identification, rescheduling, remote workspace, check-in, and prohibited-item rules. Do not rely on a testing-center anecdote for what is allowed.

If an attempt is unsuccessful, the current waiting periods are:

• After attempt 1: wait 30 days before attempt 2.
• After attempt 2: wait 90 days before attempt 3.
• After attempt 3: wait 90 days before attempt 4.
• Maximum: four attempts within a rolling 12-month period.

Every retake requires full payment. Build the waiting periods into any deadline tied to a job, promotion, or application.

How CRISC scoring works

ISACA converts performance to a scale from 200 to 800. A score of 450 or higher passes. The scaled score is not a raw percent correct, so claims that a particular practice percentage equals 450 are not official.

ISACA also does not publish a CRISC pass rate. Vendor estimates, candidate polls, and salary claims cannot tell you whether your preparation is sufficient. Use evidence you control: coverage of the current outline, error patterns, explanation quality, and performance under the four-hour time limit.

A flexible eight-week CRISC study plan

There is no official required study-hour total. Eight weeks is a planning template, not a promise. If the diagnostic exposes unfamiliar domains or your weekly availability is limited, stretch each phase rather than compressing it.

Week 0: establish the baseline

Use a mixed set that touches all four domains. For every miss, record the domain, the concept, why your choice failed, and what evidence supports the better answer. A percentage alone does not tell you what to fix.

Weeks 1-5: follow the current outline

Use the current official Review Manual as the primary reference and map notes to the outline rather than reading passively. Weight the schedule toward Domain 3, then Domain 1, while still covering every listed area. End each session by retrieving the ideas from memory and applying them to original practice questions.

Weeks 6-7: integrate and time the work

Move from isolated topics to mixed sets. Review correct answers as well as misses when the reasoning was uncertain. Complete at least one 150-question session inside four hours so that pacing, concentration, and breaks are tested before exam day.

Week 8: remediate, then taper

Rank gaps by repeated errors and domain weight. Revisit the official source, explain the concept without notes, and test it again in a different context. In the final days, confirm ID, appointment time, delivery rules, and workstation or travel plans. Avoid adding an entirely new resource at the last minute.

How to use the official preparation resources

Use these in this order:

1. CRISC Exam Content Outline: Your scope checklist and the source of the current 26/22/32/20 weights.
2. 2026 Exam Candidate Guide: The authority for registration, identification, delivery, scoring, results, and retakes.
3. Current CRISC Review Manual: ISACA's structured reference; the current store listing is the 8th Edition.
4. CRISC QAE: ISACA's CRISC page advertises a six-month subscription with an 833-question pool. Check the current listing before purchase.
5. Original mixed practice: Use fresh questions to diagnose transfer, not to memorize a vendor's answer sequence.

The official pool size is a product fact, not a required question target. Quality of review matters more than chasing a round total. Do not assume a particular practice score guarantees a pass.

A practical method for answering questions

The Candidate Guide says each multiple-choice item has four options and one best answer. A disciplined process helps:

1. Identify the role and the decision the question asks for.
2. Notice qualifiers such as first, best, or most important.
3. Compare every option with the stated business objective and risk context.
4. Eliminate choices that do not answer the precise question.
5. Select an answer, then move on when more reading is no longer improving the decision.

Do not preserve an initial answer merely because it was your first instinct. Change it when your review finds a specific reason. Conversely, do not change answers just because time remains.

For pacing, 240 minutes divided by 150 questions is 96 seconds per question. Track your progress at regular checkpoints and reserve time according to the review functions actually available in your exam interface. Answer every item because incorrect answers have no penalty.

Exam-day checklist

• Confirm that your government-issued ID meets the Candidate Guide and matches your registration name.
• Recheck the appointment time, time zone, delivery method, and check-in instructions.
• For remote delivery, run the required system check and prepare the room exactly as PSI instructs.
• For a test center, confirm the location and travel time before exam day.
• Use only breaks and materials allowed by the current rules.
• Answer every question, including uncertain ones.
• Note the preliminary result and wait for the official score, which ISACA says arrives within 10 working days.

After you pass

Passing does not automatically grant the CRISC designation. Once you meet the experience requirement, submit the certification application within five years of the pass date and pay the US$50 application fee.

After certification, maintain the credential by:

• earning at least 20 CPE hours each year;
• earning 120 CPE hours during each three-year reporting cycle;
• paying the annual US$45 member or US$85 nonmember maintenance fee;
• following ISACA's professional ethics and CPE policies; and
• keeping supporting CPE records in case ISACA selects you for an audit.

ISACA publishes no audit-selection percentage. Its maintenance page says to retain CPE documentation for at least 12 months after the end of the three-year reporting cycle.

Is CRISC the right credential?

CRISC is the most direct of these three ISACA credentials when your work centers on IT risk and information systems controls. CISA is oriented toward audit and assurance, while CISM is oriented toward information security management. Review each current exam outline before choosing; job titles alone do not establish fit.

Do not use an unsourced salary table or a promised payback period to make the decision. Compensation varies by role, experience, location, industry, and employer. A better test is whether the CRISC outline matches work you perform or want to perform and whether employers you target request the credential.

Your next action

free CRISC practicePractice questions with detailed explanations

Official sources

• ISACA CRISC credential page
• CRISC Exam Content Outline
• ISACA announcement of the November 2025 exam update
• 2026 ISACA Exam Candidate Guide
• CRISC certification requirements and application
• CRISC maintenance requirements
• ISACA professional membership pricing

Information checked July 30, 2026. Verify live fees, product details, appointment rules, and policies with ISACA before purchasing or scheduling.