Failed CRISC (Certified in Risk and Information Systems Control)? Here's Your Recovery Plan

Pro tip: ISACA offers a free QAE database to members.

• Answering as an engineer instead of a risk practitioner. Presented with a risk, technical candidates reach for the strongest control, when CRISC usually wants the answer that assigns ownership, checks the decision against risk appetite, or escalates to the risk owner.
  Before picking, ask who owns this decision. If an option has you unilaterally implementing a control that the business has not accepted the cost of, it is probably wrong even when it is technically correct.
• Confusing risk owner with control owner. CRISC treats these as separate accountabilities, and questions build on that separation. The business unit head owns the risk; the IT manager may own the control that treats it.
  Write out five real risks from your own organization and name both owners for each. If you find yourself naming the same person twice, you have not understood the split the exam is testing.
• Blurring risk appetite and risk tolerance. They are related but not interchangeable, and questions turn on the difference between the amount of risk an organization is willing to pursue and the acceptable variation around it.
  Anchor both to a number. If appetite is stated as no more than four hours of unplanned downtime per quarter, tolerance is the band around that figure the organization will live with before escalating. Practise until the distinction is automatic.
• Mixing up KRIs, KCIs, and KPIs. Domain 3 is 32 percent of the exam and metrics run through all of it, so getting these confused costs more points on CRISC than on any other ISACA exam.
  For a single risk, write one key risk indicator that gives early warning, one key control indicator that shows the control is operating, and one key performance indicator that shows the process is achieving its objective. Repeat for five risks.
• Underweighting Domain 1 because it feels like corporate theory. Governance is 26 percent, and combined with Risk Response and Reporting at 32 percent, more than half the exam sits away from technical content.
  Allocate study hours in proportion to the published weights. Domains 1 and 3 together are 58 percent of the exam. Domain 4, the most comfortable one for technical candidates, is only 20 percent.
• Assuming a pass leads directly to certification. CRISC requires three or more years of professional experience across at least two of the four domains, and ISACA allows no waivers or substitutions of any kind, unlike CISA and CISM.
  Before booking, map your work history to the four domains and confirm at least two are genuinely covered. Identify the supervisor or manager who will verify it, and check the experience falls inside the ten-year window before your application date.
• Choosing residual risk answers without checking what the controls actually do. Questions present inherent risk, a control set, and ask about residual exposure, and candidates apply a control that reduces likelihood to a question about impact.
  For every control you study, note whether it reduces likelihood, reduces impact, or does both. Then work scenarios where the residual figure barely moves, because the control addressed the wrong variable.
• Studying only from the 833-question QAE database. That pool is smaller than the CISA equivalent, so repeated passes produce recall of specific items rather than command of the domains, and the real exam rephrases everything.
  Use the Review Manual as the primary source and the question bank as a diagnostic tool. Read the explanation on every item, including the ones you answered correctly, because CRISC scoring turns on reasoning rather than recall.
• Letting the six-month eligibility expire. Eligibility begins at registration rather than at scheduling, and ISACA forfeits both eligibility and the registration fee if you do not sit within the window.
  Schedule an appointment as soon as you register, even if you later move it, since rescheduling more than 48 hours out is free. If you need longer, buy the single available six-month extension for US$75 before eligibility expires, cancelling any booked appointment at least 48 hours ahead first.

• Focus on IT risk identification and assessment
• Study risk response and mitigation strategies
• Understand risk monitoring and reporting
• Know control design and implementation
• Combine with CISM for maximum value