Certified in Risk and Information Systems Control (CRISC)

Last checked October 22, 2026 against the official ISACA exam page.

1. Question 1Risk Response and Reporting

   A control owner says that a payment reconciliation control runs daily, but evidence shows it was skipped for three weeks. What should the risk practitioner do first?

   1. ARemove the control from the register because it has proven unreliable
   2. BTest the control design and operating effectiveness to establish the extent of the gap
   3. CApprove a one-year risk exception so the team can continue normally
   4. DReplace the control with an automated tool before any further testing
   Show answer and explanationHide answer

   Correct answer: B

   Before deciding on a response, the practitioner needs to know how far the failure reaches, which requires testing the control's design and how it operated over the period. Removing the control, granting a long exception, or replacing it all act before the facts are established.

2. Question 2Governance

   An enterprise risk committee notices that business units approve exceptions to security standards without anyone formally owning the residual risk. Which governance element is most directly missing?

   1. AA recurring awareness training program for business unit managers
   2. BNamed owners with documented authority to accept residual risk
   3. CA vulnerability scanning schedule covering every internet-facing application
   4. DA technology roadmap that retires unsupported platforms on a fixed cycle
   Show answer and explanationHide answer

   Correct answer: B

   Risk ownership assigns accountability and the documented authority to accept residual risk within the approved appetite. Training and scanning are useful controls, but neither establishes who may accept an exception. The roadmap addresses platform lifecycle rather than acceptance authority.

3. Question 3Risk Assessment

   A risk practitioner is building a scenario for ransomware affecting a claims processing system. Which element should be defined first?

   1. AThe target date of the next internal audit engagement
   2. BThe annual budget that has been approved for security tooling
   3. CThe list of cyber insurance vendors that could quote for the business
   4. DThe threat event, the asset it affects, and the vulnerability it would exploit
   Show answer and explanationHide answer

   Correct answer: D

   A risk scenario needs a threat event acting on a specific asset through a specific weakness, because the likelihood and impact estimates depend on those three elements. Budget, insurance vendors, and audit dates may matter later for response decisions, but they do not define the risk itself.

4. Question 4Technology and Security

   Which three controls help protect data across its lifecycle? (Choose three.)

   1. AClassifying data at creation so that handling rules follow it
   2. BEncrypting data at rest and in transit between systems
   3. CKeeping copies of all data indefinitely in case it is needed later
   4. DEnforcing secure deletion when the approved retention period ends
   5. EGranting every staff member read access to simplify support requests
   Show answer and explanationHide answer

   Correct answer: A, B, D

   Classification, encryption, and secure disposal address different lifecycle stages, from creation through to end of life. Indefinite retention and broad read access both increase exposure, and they conflict with the data minimisation that a lifecycle approach expects.

5. Question 5Risk Response and Reporting

   Which characteristic makes a key risk indicator (KRI) most useful for early warning?

   1. AIt moves before a loss occurs and has a threshold tied to risk appetite
   2. BIt reports a lagging figure taken from the most recent annual audit
   3. CIt is calculated only after the related incident has been formally closed
   4. DIt is reported only to the external regulator and not to management
   Show answer and explanationHide answer

   Correct answer: A

   An effective KRI is a leading signal whose threshold is set against appetite, so a breach prompts action before a loss happens. Lagging figures and post-incident measures describe what already occurred, and a regulator-only indicator gives management nothing to act on.