Passing the CRISC exam is less like memorizing a legal code and more like being the judge who sets the precedent. You aren't just applying rules; you're establishing the soundest judgment in a situation where multiple options seem legally defensible, but only one truly serves the business's best interest.
The 2026 CRISC exam has 150 multiple-choice questions to be answered in four hours. A scaled score of 450 out of 800 is required to pass. Crucially, no calculator of any kind is provided, meaning all quantitative risk calculations must be performed mentally.
Key facts
- Official Body
- ISACA
- Questions
- 150 multiple-choice questions
- Time Limit
- 4 hours (240 minutes)
- Passing Score
- 450 on a scaled score of 200–800
- Calculator Policy
- Strictly prohibited; no on-screen or personal calculator is provided.
- Primary Source
- ISACA's CRISC Review Manual (CRM) is the definitive study text.
- Pass Rate
- ISACA does not publish official pass rates, but the exam is widely considered challenging, with industry estimates often placing the pass rate around 55%.
What Is the 2026 CRISC Exam Format?
The CRISC exam uses 150 multiple-choice questions over a four-hour session to evaluate your ability to apply risk management principles. But don't let "multiple-choice" fool you into thinking this is a simple test of memory.
Myth: The CRISC exam is about memorizing frameworks and definitions. Reality: The exam is a rigorous test of your professional judgment. The questions are scenario-based, often presenting several plausible options. Your task is to select the best course of action based on the ISACA mindset, which is detailed throughout the official CRISC Review Manual (CRM). This is the single most important book for your prep.The 150 questions are distributed across four domains, with specific weightings that signal where you should focus your study time.
| CRISC Domain Name | Weighting | What It Really Means |
|---|---|---|
| Domain 1: Governance | 26% | Can you build and maintain a risk framework that aligns with business goals? |
| Domain 2: IT Risk Assessment | 20% | Can you effectively identify and analyze IT risks to gauge their business impact? |
| Domain 3: Risk Response and Reporting | 30% | Can you choose the right risk response and communicate the risk posture clearly? |
| Domain 4: Information Technology and Security | 24% | Do you understand the technical landscape where these risks live? |
Domain 3 carries the most weight for a reason. Identifying risk is one thing; deciding what to do about it and explaining that decision to leadership is the core function of a CRISC professional.
Studying for CRISC? Benchmark your score in 5 minutes.
Get an instant weak-spot assessment and a custom 12-week study plan PDF generated for your exam window.
Developing this "ISACA mindset" is non-negotiable. It requires practice with questions that force you to weigh business objectives, cost-benefit, and urgency. VoraPrep's adaptive question bank is built around this principle, with detailed rationales that explain not just the right answer, but why the distractors are tempting but ultimately inferior.
Calculate Your CRISC Score & Study Hours by Domain
Adjust your practice scores across official CRISC blueprint domains to predict your pass probability and generate a domain-weighted study schedule.
What Are the CRISC Exam Day Rules and Procedures?
For the 2026 CRISC exam, you must follow strict protocols at the PSI or Prometric testing center. Understanding these rules prevents unnecessary stress on exam day.
Step 1: Register and Schedule Your Exam
Your journey begins on the ISACA website, where you'll register and pay the exam fee. After receiving confirmation, you can schedule your appointment at a local testing center. Book this as early as possible, as prime slots fill up quickly. Always confirm current fees and registration windows on the official ISACA CRISC page.
Step 2: Arrive and Check In
Plan to arrive at the testing center at least 30 minutes early. The check-in process is thorough and includes:
- ID Verification: You'll need two forms of valid, unexpired ID. Your primary ID must be a government-issued photo ID (passport, driver's license) with a signature. The name must perfectly match your registration.
- Security Screening: Expect biometric checks (like a fingerprint or palm scan) and a security pat-down or inspection with a metal detector wand.
- Locker Storage: You cannot bring anything into the testing room. All personal items, including your phone, watch, wallet, and even a water bottle, must be stored in a provided locker.
Step 3: Manage Your Time During the Exam
The four-hour (240-minute) timer starts the moment you begin. You can take unscheduled breaks, but the clock does not stop.
This is where strategy comes in. With 96 seconds per question, you cannot afford to get stuck. If a question seems too complex or you're unsure after a minute, flag it for review and move on. Answer every other question first, then return to your flagged items with the remaining time. This ensures you don't miss easy points at the end of the exam because you ran out of time on a single hard question.
The CRISC Calculator Policy: There Isn't One
The 2026 CRISC exam has a strict no-calculator policy. You are not allowed to bring a personal calculator, and unlike some other exams, no on-screen calculator is provided. All calculations must be performed mentally.
This policy sends a clear signal: ISACA cares about your conceptual understanding of risk quantification, not your ability to perform complex math. The calculations required are straightforward and typically involve core risk formulas.
- Annualized Loss Expectancy (ALE): SLE × ARO
- Return on Security Investment (ROSI): (Risk Mitigation Value − Control Cost) ÷ Control Cost
- Basic percentages and probabilities
You must be comfortable with these formulas and be able to compute them quickly in your head or on the provided scratch paper/whiteboard.
- Calculate Single Loss Expectancy (SLE): SLE = AV × EF. So, SLE = $50,000 × 0.40. (Mental math: 10% of 50k is 5k, so 40% is 4 × 5k = $20,000).
- Determine Annualized Rate of Occurrence (ARO): "Once every two years" means the ARO is 1 ÷ 2 = 0.5.
- Calculate ALE: ALE = SLE × ARO. So, ALE = $20,000 × 0.5. (Mental math: half of $20,000 is $10,000).
The ALE is $10,000. The exam tests if you know the steps and can execute simple multiplication, not advanced calculus. Practice these drills until they are second nature.
How Should You Prepare for the CRISC Exam?
A passing score requires an active, analytical study approach focused on judgment. Passive reading won't get you there. A typical candidate needs 100-140 hours of focused preparation.
Your Weekly Study Drill
Integrate these specific actions into your study plan each week.
- Prioritize the CRISC Review Manual (CRM): While frameworks like COBIT and NIST are important, the CRM is the primary authority for the exam. It's written by ISACA and explains concepts from their specific point of view. Your understanding must align with the CRM.
- Deconstruct Every Practice Question: Don't just answer and check if you were right. For each question, articulate why the correct answer is the best and, more importantly, why the other three options are inferior. This builds the critical thinking muscle the exam targets. Explore a range of scenario-based practice questions to hone this skill.
- Practice Mental Math: Dedicate 10-15 minutes each study session to performing risk calculations (like ALE and ROSI) without a calculator. Use simple numbers to master the process. This removes a major source of anxiety on exam day.
- Use an Adaptive Study System: Don't waste time reviewing concepts you've already mastered. A complete course like VoraPrep uses an adaptive engine to identify and target your weak areas. Paired with a personalized study plan and our 24/7 tutor, Vory, you can focus your limited study hours for maximum impact.
By focusing on these drills, you move from passively consuming information to actively developing the judgment required to pass.
Ready to Pass Your CRISC Exam? Stop guessing and start preparing with a proven system. VoraPrep's complete 6-pillar CRISC course provides interactive lessons, adaptive practice, 1:1 exam simulation, and a 24/7 Vory tutor to guide you to a passing score. Visit voraprep.com to get started. Start Your Free 14-Day Trial at voraprep.com →