Duration
4 days
Overview
This update to the CRISC exam content outline is based on changes in the work practices of IT risk professionals as well as market dynamics and trends that have placed an increased focus on organizational governance, continuous risk monitoring and reporting, information security and data privacy considerations for effective ITRM. These statements and domains are the results of extensive research, feedback, and validation from IT risk and control subject matter experts and prominent industry leaders from around the globe.
Certification Requirements
A minimum of 3-years of professional information systems auditing, control or security work experience–as described in the CRISC job practice areas–is required for certification. Work experience for the CRISC certification must be gained within the 10-year period preceding the application date for certification. Candidates have 5-years from the passing date to apply.
DAY 1
9:00am - 10:30am
DOMAIN 1—Governance 26%
Organizational Governance A
- Organizational Strategy, Goals, and Objectives
- Organizational Structure, Roles, and Responsibilities
- Organizational Culture
10:30am - 10:45am Morning Break
10:45am - 12:30pm
Organizational Governance A
- Policies and Standards
- Business Processes
- Organizational Assets
12:30pm - 1:30pm Lunch Break
1:30pm - 3:30pm
Risk Governance B
- Enterprise Risk Management and Risk Management Framework
- Three Lines of Defense
- Risk Profile
3:30pm - 3:45pm Afternoon Break
3:45pm - 5:00pm
Risk Governance B
- Risk Appetite and Risk Tolerance
- Legal, Regulatory, and Contractual Requirements
- Professional Ethics of Risk Management
DAY 2
9:00am - 10:30am
DOMAIN 2—IT Risk Assessment 20%
IT Risk Identification A
- Risk Events (e.g., contributing conditions, loss result)
- Threat Modelling and Threat Landscape
10:30am - 10:45am Morning Break
10:45am - 12:30pm
IT Risk Identification A
- Vulnerability and Control Deficiency Analysis (e.g., root cause analysis)
- Risk Scenario Development
12:30pm - 1:30pm Lunch Break
1:30pm - 3:30pm
IT Risk Analysis and Evaluation B
- Risk Assessment Concepts, Standards, and Frameworks
- Risk Register
- Risk Analysis Methodologies
3:30pm - 3:45pm Afternoon Break
3:45pm - 5:00pm
IT Risk Analysis and Evaluation B
- Business Impact Analysis
- Inherent and Residual Risk
DAY 3
9:00am - 10:30am
DOMAIN 3—Risk Response and Reporting 32%
Risk Response A
- Risk Treatment / Risk Response Options
- Risk and Control Ownership
- Third-Party Risk Management
- Issue, Finding, and Exception Management
- Management of Emerging Risk
10:30am - 10:45am Morning Break
10:45am - 12:30pm
Control Design and Implementation B
- Control Types, Standards, and Frameworks
- Control Design, Selection, and Analysis
- Control Implementation
- Control Testing and Effectiveness Evaluation
12:30pm - 1:30pm Lunch Break
1:30pm - 3:30pm
Risk Monitoring and Reporting C
- Risk Treatment Plans
- Data Collection, Aggregation, Analysis, and Validation
- Risk and Control Monitoring Techniques
3:30pm - 3:45pm Afternoon Break
3:45pm - 5:00pm
Risk Monitoring and Reporting C
- Risk and Control Reporting Techniques (heatmap, scorecards, dashboards)
- Key Performance Indicators
- Key Risk Indicators (KRIs)
- Key Control Indicators (KCIs)
DAY 4
9:00am - 10:30am
DOMAIN 4—Information Technology and Security 22%
Information Technology Principles A
- Enterprise Architecture
- IT Operations Management (e.g., change management, IT assets, problems, incidents)
- Project Management
10:30am - 10:45am Morning Break
10:45am - 12:30pm
Information Technology Principles A
- Disaster Recovery Management (DRM)
- Data Lifecycle Management
- System Development Life Cycle (SDLC)
- Emerging Technologies
12:30pm - 1:30pm Lunch Break
1:30pm - 3:30pm
Information Security Principles B
- Information Security Concepts, Frameworks, and Standards
- Information Security Awareness Training
3:30pm - 3:45pm Afternoon Break
3:45pm - 5:00pm
Information Security Principles B
- Business Continuity Management
- Data Privacy and Data Protection Principles
Secondary Classifications
Supporting Tasks
- Collect and review existing information regarding the organization’s business and IT environments.
- Identify potential or realized impacts of IT risk to the organization’s business objectives and operations.
- Identify threats and vulnerabilities to the organization’s people, processes, and technology.
- Evaluate threats, vulnerabilities, and risk to identify IT risk scenarios.
- Establish accountability by assigning and validating appropriate levels of risk and control ownership.
- Establish and maintain the IT risk register, and incorporate it into the enterprise-wide risk profile.
- Facilitate the identification of risk appetite and risk tolerance by key stakeholders.
- Promote a risk-aware culture by contributing to the development and implementation of security awareness training.
- Conduct a risk assessment by analyzing IT risk scenarios and determining their likelihood and impact.
- Identify the current state of existing controls and evaluate their effectiveness for IT risk mitigation.
- Review the results of risk analysis and control analysis to assess any gaps between current and desired states of the IT risk environment.
- Facilitate the selection of recommended risk responses by key stakeholders.
- Collaborate with risk owners on the development of risk treatment plans.
- Collaborate with control owners on the selection, design, implementation, and maintenance of controls.
- Validate that risk responses have been executed according to risk treatment plans.
- Define and establish key risk indicators (KRIs).
- Monitor and analyze key risk indicators (KRIs).
- Collaborate with control owners on the identification of key performance indicators (KPIs) and key control indicators (KCIs).
- Monitor and analyze key performance indicators (KPIs) and key control indicators (KCIs).
- Review the results of control assessments to determine the effectiveness and maturity of the control environment.
- Report relevant risk and control information to applicable stakeholders to facilitate risk-based decision-making.
- Evaluate alignment of business practices with risk management and information security frameworks and standards.
Programme scope, delivery arrangements and suitability are confirmed during enquiry.