Executive Takeaways
- Passing threshold: 70% estimated (450 on a 200–800 ISACA scaled score across 150 scored questions).
- Exam structure: 150 Scenario-Based Multiple Choice Questions. Total 4 hours.
- Governing standards tested: ISACA Risk IT Framework, COBIT 2019, COSO ERM, ISO/IEC 31000 & ISO/IEC 27005.
- Unscored experimental pretest items are seeded throughout the exam—never let an unfamiliar question derail your clock.
The CRISC Psychometric Reality Filter
A 3-step mental model for handling high-difficulty ISACA items without losing pacing momentum.
- 1Respect the Blueprint Weights: Anchor your study hours to the highest-weighted domains (CRISC-1: Governance (Organizational Governance, Risk Strategy) (26% (39 Qs)) and CRISC-2: Risk Assessment (Risk Identification, Analysis, Evaluation) (22% (33 Qs))).
- 2Spot Pretest Anomalies: If a prompt tests an obscure edge case outside the published syllabus, treat it as an unscored experimental item, make your best analytical choice, and move on.
- 3Answer Every Single Item: ISACA uses rights-only scoring with zero penalty for incorrect guesses—never leave a question blank.
How ISACA Calculates Your Passing Score
The Certified in Risk and Information Systems Control Examination is administered via PSI Services under 2026 CRISC Job Practice (effective November 3, 2025). To pass, candidates must achieve: 70% estimated (450 on a 200–800 ISACA scaled score across 150 scored questions). Because ISACA equates exam forms statistically to account for slight variations in form difficulty, your goal is consistent mastery across the heavily weighted blueprint domains rather than perfection on obscure trivia.
What Makes This Exam Challenging
Aligning business risk appetite with technical control mitigation; distinguishing risk avoidance, mitigation, transfer, and acceptance in complex corporate scenarios. High-scoring candidates overcome this by anchoring every concept to ISACA's primary statutory and regulatory authorities (ISACA Risk IT Framework, COBIT 2019, COSO ERM) rather than memorizing surface-level definitions.