Exam Vouchers: CRISC Exam Voucher (CRISC_EXAMEN)

The ISACA CRISC certification is designed for those experienced in the management of IT risk and the design, implementation, monitoring and maintenance of IS controls.

After ordering, you will receive an email from Global Knowledge within 2 working days with a voucher code and registration instructions.

NB: This voucher can only be purchased if Candidate has previously purchased/attended the preparation course (ILT or E-Learning) at Global Knowledge: CRISC  "ISACA Certified in Risk and Information Systems Control (CRISC) incl QAE"

 Supporting Tasks

1. Collect, review, and evaluate existing information regarding the organization’s business and information system environments.

2. Identify potential or realized impacts of information system risk to the organization’s business objectives and operations.

3. Identify threats and vulnerabilities to the organization’s people, processes, and technologies.

4. Evaluate threats, vulnerabilities, and risk to create information system risk scenarios.

5. Establish accountability by assigning and validating appropriate levels of risk and control ownership.

6. Maintain or establish the information system risk register and incorporate it into the enterprisewide risk profile.

7. Assist key stakeholders in the selection of risk appetite and tolerance thresholds and the impact on business objectives.

8. Promote a risk-aware culture by contributing to the development and implementation of security/risk awareness and training.

9. Conduct a risk assessment by analyzing information system risk scenarios and events to generate a risk score/rating.

10. Identify the current state of existing controls and evaluate their effectiveness for information system risk treatment.

11. Determine if risk exceeds appetite and tolerance thresholds to recommend treatment options and rectify concerns.

12. Review the results of risk and/or control analysis to assess any gaps between current and desired states of the risk environment.

13. Collaborate with risk owners on the development of risk treatment plans.

14. Collaborate with control owners on the selection, design, implementation, and maintenance of controls.

15. Validate that risk responses have been executed according to risk action plans.

16. Define, implement, and refine key risk indicators (KRIs).

17. Collaborate with control owners on the identification and refinement of key performance indicators (KPIs) and key control indicators (KCIs).

18. Monitor and analyze key risk indicators (KRIs), key performance indicators (KPIs), and key control indicators (KCIs).

19. Review the results of control assessments to determine the adequacy, effectiveness, and maturity of the control environment.

20. Conduct aggregation, analysis, and validation of risk and control data.

21. Report relevant risk and control information to applicable stakeholders to facilitate risk-based decision-making.

22. Evaluate emerging technologies and changes to the environment for threats, vulnerabilities, and opportunities.

23. Evaluate alignment of business practices with risk management frameworks, standards, and regulations.

24. Facilitate tabletop exercises to verify and identify gaps in risk scenarios, capabilities, and responses.

Domain 1 – Governance (26%)

• Organizational Governance
• Strategy, Goals, and Objectives
• Organizational Structure, Roles, and Responsibilities
• Organizational Culture and Ethics
• Policies and Standards
• Business Processes and Resilience (e.g., DRP, BCP)
• Organizational Asset Management
• Risk Governance
• Enterprise Risk Management (ERM)
• Lines of Defence
• Risk Profile
• Risk Appetite and Risk Tolerance
• Risk Frameworks, Legal, Regulatory, and Contractual Requirements

Domain 2 – IT Risk Assessment (20%)

• Risk Identification
• Risk Events
• Threat Modeling and Threat Landscape
• Vulnerability Management
• Risk Scenario Development and Evaluation
• Risk Analysis
• Risk Assessment Concepts and Standards
• Business Impact Analysis (BIA)
• Risk Register
• Risk Analysis Methodologies
• Inherent and Residual Risk

Domain 3 – Risk Response and Reporting (32%)

• Risk Response
• Risk Response Options
• Risk and Control Ownership
• Vendor/Supply Chain Risk Management
• Issues, Findings, Exceptions and Exemptions Management
• Control Design and Implementation
• Control Frameworks, Types, and Standards
• Control Design, Selection, Implementation, and Analysis
• Control Testing Methodologies
• Risk Monitoring and Reporting
• Risk Action Plans
• Data Collection, Aggregation, Analysis, and Validation
• Risk and Control Metrics (e.g., KRIs, KCIs, KPIs)
• Risk and Control Monitoring Techniques
• Risk and Control Reporting Techniques (e.g., heatmap, scorecards, dashboards)
• Monitoring and Reporting of Emerging Risks

Domain 4 – Information Technology and Security (22%)

• Technology Principles
• Technology Roadmaps and Enterprise Architecture (EA)
• Operations Management (e.g., change management, assets, DevOps,
• problems, incidents)
• System Development Life Cycle (SDLC)
• Data Lifecycle Management
• Portfolio and Project Management (e.g. Agile)
• Technology Resilience and Disaster Response/Recovery
• Emerging Technologies
• Information Security Principles
• Security Concepts, Frameworks, and Standards
• Security/Risk Awareness and Training
• Data Privacy and Data Protection Principles

Three (3) or more years of experience in IT risk management and IS control.

No experience waivers or substitutions