Skip to main content
Ace Skills Consulting
ISACA logoAdvanced

CRISC® – Certified in Risk and Information Systems Control

Identify, assess and treat IT risk in business terms, and prepare for the CRISC exam with focused practice.

  • 32 hours of live, trainer-led sessions
  • Covers all four CRISC domains
  • Build a risk register and treatment plan in class
  • Scenario questions with explained answers
  • Mock exam with domain-wise review
Aligned to ISACA exam CRISC
Duration
4 Days | 32 Hrs
Next batch
Batches on request
Delivery
Live Online · Onsite · Corporate
Level
Advanced
Exam
CRISC
Language
English

Why learn CRISC with Ace Skills

  • Risk in business language

    Learn to express IT risk in terms of objectives and impact, which is what boards and exam questions both expect.

  • Full risk life cycle

    Follow one organisation from risk appetite to treatment and monitoring, so the domains connect rather than stand alone.

  • Scenario-question practice

    Work through the "best next step" style of question that CRISC uses, with clear explanations of each option.

  • Useful beyond the exam

    Templates for risk scenarios, registers and KRIs that you can adapt for your own organisation.

Course overview

Every technology decision carries risk, and organisations need people who can describe that risk in business language, recommend sensible controls and track whether those controls work. The CRISC certification recognises exactly this role. This four-day course gives you a working method for IT risk management and prepares you for the exam's scenario-based questions.

The course follows the four CRISC domains. Day one sets up governance: organisational strategy, risk appetite and tolerance, roles and responsibilities, and the frameworks that tie risk to enterprise objectives. Day two is about assessment: identifying threats and vulnerabilities, building risk scenarios, and analysing likelihood and impact. Day three covers risk response and reporting, including treatment options, control design and ownership, key risk indicators and how to report to senior management. Day four focuses on information technology and security, from architecture and the system development life cycle to data privacy, and closes with exam preparation.

Learning is practical. You will work with a fictional organisation through the week, writing risk scenarios for it, populating a risk register, choosing treatments and defining indicators that would warn of trouble. These exercises make the exam's "what should the risk practitioner do first" questions far easier to reason through.

Each domain ends with practice questions and a discussion of the reasoning behind the best answer. The final session includes a timed mock exam and a personal revision plan.

This course is aligned to the CRISC exam as published by ISACA. Confirm the current exam content outline, experience requirements and fees on the ISACA website before booking.

Key features

  • Trainer with practical IT risk management experience
  • Plan aligned to the four CRISC domains
  • Running case study: one organisation through the full risk life cycle
  • Risk register, KRI and control design exercises
  • Practice questions every day with explained answers
  • Timed mock exam and revision plan
  • Course completion certificate from Ace Skills Consulting

Who should attend

  • IT risk and operational risk professionals
  • Information security and compliance managers
  • IT auditors moving into risk roles
  • Business analysts and control owners
  • Project and programme managers responsible for risk

Prerequisites

  • Working knowledge of IT environments and business processes
  • Some exposure to risk, control, audit or security work is recommended
  • Certification requires relevant work experience as defined by ISACA

Curriculum

4 Days · 32 Hours · 12 Modules · 6 Labs

  1. Organisational context

    • Organisational strategy, goals and objectives
    • Organisational structure and culture
    • Policies and standards
    • Business process review

    Risk governance

    • Enterprise risk management and frameworks
    • Three lines model
    • Risk profile, appetite and tolerance
    • Legal, regulatory and contractual requirements
    • Lab: Define risk appetite statements for a case organisation · 45 min

    Roles and ethics

    • Risk ownership and accountability
    • Professional ethics in risk management
    • Communicating with the board

  2. Risk identification

    • Risk events and threat modelling
    • Vulnerability and control deficiency analysis
    • Risk scenario development
    • Lab: Write risk scenarios for a cloud migration · 60 min

    Risk analysis

    • Qualitative and quantitative analysis
    • Likelihood and impact
    • Inherent and residual risk
    • Business impact analysis

    Risk register

    • Register structure and fields
    • Aggregating and prioritising risk
    • Keeping the register current
    • Lab: Populate and prioritise a risk register · 45 min

  3. Risk response

    • Accept, mitigate, transfer and avoid
    • Risk and control ownership
    • Third-party risk management
    • Issue, finding and exception management

    Control design and implementation

    • Control types and frameworks
    • Control design and testing
    • Control effectiveness evaluation
    • Lab: Choose treatments and design controls for top risks · 50 min

    Monitoring and reporting

    • Key risk, performance and control indicators
    • Data collection and validation
    • Reporting to management and the board
    • Lab: Define KRIs with thresholds and owners · 35 min

  4. Technology foundations

    • Enterprise architecture
    • IT operations management
    • Project and programme management
    • Enterprise resilience

    Security and privacy

    • Information security frameworks and awareness
    • Data life cycle management
    • Data privacy principles
    • SDLC and emerging technologies

    Exam readiness

    • Exam structure and question style
    • Timed mock exam
    • Weak-area review and study plan
    • Lab: Timed mock exam with review · 90 min
Download full syllabus (PDF)

Skills you will gain

  • IT risk management
  • Risk appetite
  • Risk scenarios
  • Risk assessment
  • Risk registers
  • Risk treatment
  • Control design
  • Control testing
  • Key risk indicators
  • Third-party risk
  • Risk reporting
  • Data privacy

Tools & technologies

  • Risk register templates
  • Heat maps
  • Spreadsheet models
  • Practice question bank

Certification exam

Exam details
Exam nameCertified in Risk and Information Systems Control (CRISC)
Exam codeCRISC
Number of questions150
Duration240 minutes
Passing score450 / 800 (scaled)
Voucher includedNo — book directly with the vendor
Question formatMultiple choice
DeliveryOnline proctored or Test centre

Skill areas measured

  1. Governance
  2. IT Risk Assessment
  3. Risk Response and Reporting
  4. Information Technology and Security

Exam details are pending verification. Vendors change exams; confirm on the official vendor page before booking. Official exam page (opens in a new tab)

Schedule & Pricing

Live Online

Individual

Price on request

  • 32 hours of live, trainer-led sessions
  • 6 hands-on labs
  • Ace Skills course completion certificate

Onsite

At your office or our centre

Pricing depends on location, group size and dates.

  • Delivered at your premises or an Ace centre
  • Same curriculum and labs as live online
  • Dates planned around your team

Corporate / Team

Private batch for your organisation

A private batch with content adapted to your environment and goals.

  • Customised curriculum
  • Private batch, online or onsite
  • Progress and assessment reports
  • GST invoice and PO-based billing

No public batches scheduled — Talk to an Advisor for a private batch.

Projects & labs you will build

  • Day 2 · 60 min

    Write risk scenarios for a cloud migration

  • Day 3 · 50 min

    Choose treatments and design controls for top risks

Your certificate

Certificate of Completion — Ace Skills Consulting

Awarded on completing the course. It records the course title and training hours, and you can share it on your LinkedIn profile.

The ISACA certification itself is awarded by ISACA when you pass exam CRISC.

Frequently asked questions

Do I need risk experience before the exam?

You can take the exam before you meet the experience requirement, but ISACA only awards the certification once relevant experience is verified. Check the current rules on the ISACA website.

How is CRISC different from CISM?

CRISC centres on identifying and managing IT risk and the controls that address it, while CISM focuses on running an information security programme. Many professionals hold both.

Is the exam fee included?

No. You book and pay for the exam directly with ISACA.

Will the templates be useful at work?

Yes. The risk scenario, register and KRI templates are generic and can be adapted to your organisation's own method.

Can you run this for our risk team?

Yes. We run private batches for corporate teams, online or onsite, with case studies adjusted to your sector.

Related courses

Explore more

All Cybersecurity courses ISACA certifications

CISM, CISA, CRISC and COBIT are trademarks of ISACA.

Train your team on CRISC

Private batches online or at your office in India and the GCC, with a curriculum adapted to your environment.