CRISC IT Risk Management Certification - Training & Consulting Academy

CRISC is the only credential focused on enterprise IT risk management. The updated CRISC exam content outline is based on the latest work practices and knowledge to keep certification holders ahead of the game in tackling real world threats in today’s business landscape.
CRISC validates your experience in building a well defined, agile risk management program, based on best practices to identify, analyze, evaluate, assess, prioritize and respond to risks. This enhances benefits realization and delivers optimal value to stakeholders.
The designation demonstrates to employers that the holder is able to identify, evaluate and manage information systems and technology risk, and help enterprises achieve their business objectives.
After qualifying this certification, a professional can be hired as a senior IT auditor, security engineer architect, IT security analyst, or information assurance program manager.
ISACA’s Certified in Risk and Information Systems Control (CRISC) certification is ideal for mid-career IT/IS audit, risk and security professionals.
Prove your skills and knowledge in using governance best practices and continuous risk monitoring and reporting.
Enhance business resilience and stakeholder value and gain increased credibility with peers, stakeholders and regulators.

CRISC validates your experience in building a well-defined, agile risk management program, based on best practices to identify, analyze, evaluate, assess, prioritize and respond to risks. CRISC certification proves your expertise in these work-related domains: Governance, It Risk Assessment, Risk Response and Reporting, Information Technology and Security.

The CRISC designation is designed for IT risk, control and compliance practitioners, business analysts, project managers and other respected professionals.
The highly respected certification demonstrates to employers that the holder is able to identify and evaluate IT risk, and help their enterprise accomplish its business objectives.

Domain 1: IT risk Identification
Risk capacity, risk appetite, and risk tolerance
Risk culture and communication
Elements of risk
Information security risk concepts and principles
The IT risk strategy of the business
IT concepts and areas of concern for the risk practitioner
Methods of risk identification
IT risk scenarios
Ownership and accountability
The IT risk register
RISK awareness
Domain 2: IT Risk Assessment
Risk assessment techniques
Analyzing risk scenarios
Current state of controls
Changes in the risk environment
Project and program management
Risk and controls analysis
Risk analysis methodologies
Risk ranking
Documenting risk assessment

Domain 3: Risk Response and Mitigation
Aligning risk response with business objectives
Risk response options
Analysis techniques
Vulnerabilities associated with new controls
Developing a risk action plan
Business process review tools and techniques
Control design and implementation • Control monitoring and effectiveness
Type of risk
Control activities, objectives, practices and metrics
Systems control design and implementation
Impact of emerging technologies on design and implementation of controls
Control ownership
Risk management procedures and documentation
Domain 4: Risk and Control Monitoring and Reporting
Key risk indicators
Key performance Indicators
Data collection and extraction tools and techniques
Monitoring controls
Control assessment types
Results of control assessment
Change to the IT risk profile
Exam Preparation