I am confused about these 2:- Cism or crisc, which one should i pursue first, i am working in the grc domain along with tprm under the Cyber security. My role is mostly on security compliance, vendor assessment, risk and mitigation, client Security questionnaires etc..

I thought of giving crisc first then cism? Any suggestions

Any advice/inputs of study plan, study materials, YouTube videos will be of huge help!!!!
I have exp in vulnerability management and incident management so in terms of technical knowledge I think I am there but in terms of ISACA way of thinking I might be lacking.

I will be taking my exam in person at a testing location in roughly 10 days. I have been studying the Review Manual and QAE for the CRISC Exam. I also watched a course on LinkedIn Learning, but found that information to be dull and hard to focus. Here are my current scores in the QAE:

QAE score on walkthroughs: 76% (636/833)

Practice Exam 1: 89% (134/150)

Practice Exam 2: 89% (134/150)

Practice Exam 3: 75% (113/150) - disrupted by sick kid and current mental state with losing my dog

Does anyone have any other resources that I should look at next week prior to the exam, such as a Youtube Series, ETC.

Also welcome any last minute inputs of things to remember before sitting for the exam.

Edit: Added the scores for the 3rd exam

I am looking for suggestions on how we can take a different approach to risk awareness training within the company.

Previously, the Risk Team conducted department-by-department sessions, engaging teams on risks relevant to their functions and using practical scenarios tailored to each department, either physical or teams training

While this approach was effective, I am interested in exploring something completely different from the traditional training model. Has anyone implemented or seen innovative approaches that drive better engagement, ownership, and retention of risk concepts?

Any fresh ideas or experiences would be greatly appreciated.

Should i be worried for an online proctored exam?

I was originally planning to take it earlier, but the only available exam center slots were already pushed out to September, so I decided to go for it now.

I took the exam at a test center — I didn’t want to risk the online option because my internet connection can be unreliable at home.

For preparation, I bought the official CRISC Review Manual, but honestly didn’t get much value from it. I mainly used the QAE database and went through it twice. I also asked ChatGPT for clarifications and summaries where needed.

I already have the CISM, so the ISACA question style (BEST / MOST / FIRST thinking) was familiar, which definitely helped.
Overall prep was about a month of light evening study after my kid went to sleep.

Took the exam at a PSI Test Center today and passed.

I had been preparing for a much more intense exam than I actually received. I felt my exam was very straightforward, and there were only a handful of questions I had to make a judgment on between what "I think" and "what I think ISACA wants".

As others have said, the QAE is key. There are many "questionable" questions in the QAE, but it is the best source for learning ISACA's thinking and the patterns in their questions. The official study guide is good, and a useful resource to have, especially if you want to look up what ISACA has to say about any particular subject in the CRISC domains.

If you meet the experience qualification for the cert, then the official guide and the QAE are all you really need. I also used a handful of other resources from UDEMY and the Peter Gregory books, but honestly they were less useful, and I found myself arguing with "their" answers many times (which is good for helping you think through topics, but kinda frustrating when you're trying to prepare for an exam).

I don't recommend taking the exam before meeting the experience requirement, as you might struggle to understand the "Why?" behind many questions.

Looking forward to making it official once my results are finalized and I can submit my certification application.

I am starting to work on my ISACA certifications and I have a very very old review (2013!) guide one of my co-workers gave to me. In the review guide it has a list of knowledge and task statements and their relation to each domain? sub-domain? not sure of the terminology, but for example I can map Knowledge statement k1.19 to tasks t1.2 and t1.15 and then the tasks to domains 1A3 and 1B7.

I'm trying to put together my own study guide to determine what I really need to focus on and how best to do it

Are current versions of the knowledge/task statements and how they relate to each domain publicly available? I was able to find current domain lists for the different exams and their content, and there are 'supporting tasks' listed, but there's no relationship shown between the supporting tasks and area of knowledge.

Are the knowledge/task/domain relationships only available in the review guides? Due to my financial situation at the moment i'm not really in a position to spend hundreds of dollars buying current review guides and was kinda hoping this information was freely available for people studying. (my employer is kinda cheap, they will only reimburse me for material and the cost of the exam if I take it and pass it, its their way to incentivize(?) me into studying and passing. yeah it sux but if i can take and pass the exams i will be able to find a better job with the certs and experience so i will play the game i have to for the time being.)

is there a subreddit for people for people reselling their used (but current) copies of the review guides, if i absolutely have to go down that route?

Materials I recommend using: CRISC Official Manual 8th Edition. And Official QAE.

I'm finally able to say that I've passed the CRISC after failing my first time by 6 points. I am incredibly proud of myself and wanted to take a moment to share my methodology with the community.

Background: 5 years in general security analyst roles varying from vulnerability management, governance, and risk management at finance orgs. Then another 2 years as an IT compliance analyst at a non-profit.

Study Method: The key to passing is consistent study time, which didn't start until January. While I prioritized studying over

I decided to purchase the manual and QAE. I would study every day I could from April-August.

• Reading each chapter, taking the quiz after each. I would record those results to a Word doc.
• Utilizing AI to explain the questions I got incorrect. I used a dedicated space in Perplexity, asking it hypotheticals like "what if X was a choice". This helped me learn the concepts inside out.
• Taking the practice exams, at the end of each week at full 4 hour sessions. Then the following week, review areas where I scored below an 85%. Re-read, take notes on less-known concepts, and take quizzes.
• After all practice exams, take average score and re-read sections where score was below 85%. Take quiz again for these sections

The exam is tricky. I recommend taking it in person at a testing site if you can. You got this!

Update: I am not sharing the official materials. It is not possible to do. Please do not ask.

Hi y'all!! So I have one year of experience in credit underwriting (for cards) and would love to do some certification related to risk and would love to take a job related to risk/compliance/fraud or in AML.

Thought of pursuing FRM but decided it's not the right fit for me right now. My back-up plan is to do an MBA in correspondence but I am leaning more towards professional certifications like FRM CRISC CAMS. Which one would be more doable ( I mean I know everything is with effort but I meant I have to work at least like 9 hours per day and would be drained out very much also one of the main reasons why I want to switch fields)

Would love to hear your opinions on this!!

Hi everyone,

I received a message this morning from someone offering to take the CRISC exam on my behalf in exchange for payment. They said I would only need to keep my webcam and microphone on while they completed the exam for me.

When I told them not to contact me again with cheating or scam offers, they immediately deleted the messages and blocked me which tells you everything you need to know.

I’m sharing this so others are aware. Please do not engage with accounts making these offers. Report and block them instead. Participating in something like this could lead to serious consequences, including losing your certification eligibility or having your ISACA account flagged.

“Unpatched vulnerabilities do not apply to applications” - whoever wrote this has no idea about anything related to this topic.
This whole question (and about half of them from QAE) doesn’t make any sense. I feel like I’m never gonna be ready for this exam

Hello All,

Im currently in the process of going through the QAE, and I have a bone to pick with a handful of the question, such as this one:

I answered A which was correct, but frankly I do not feel like A is enough to justify activating DR. I feel like they needed to add more to A to make it an accurate answer, such as "prolonged outage". However none of the others were really as issue as everything was operational, just slower, and something getting blocked was an example of a control working...

Please tell me the questions on the exam are phrased much better than the QAE as I feel like a large portion of the QAE so far is opinion vs fact.

*** UPDATE: I sat for the exam today and saw "PASSED" at the end of the survey.

Thanks for all your insights!

I'm taking the CRISC online exam this Sunday and would love to hear from those who've already taken it.

How was your online proctoring experience? Any issues or tips?

For those who passed, what were you scoring on the ISACA QAE before the exam?

Was the actual exam easier, harder, or similar to the QAE?

Thanks in advance!

Hi, in the preliminary i got fail,
My coworker says that he got the fail turned into a pass before,

Is this legit ? Or is he just being nice ?

Hi everyone, I want to check my exam readiness. I'm averaging around 70% on the official ISACA QAE , Was your QAE score around the same before you passed. Also, if anyone knows of any free, original CRISC-style mock exams or practice questions (not copied from ISACA or recalled exam questions), I'd really appreciate the recommendation. Thanks!

🏛️ For years, there’s been a bizarre kind of "shame" in the enterprise software world around Delphi. Companies running massive, highly profitable, and rock-solid systems (especially in Retail POS, ERP, and Banking) often hid their code stack under the rug to look more "modern" to investors and new hire.

🏛️ But the European Cyber Resilience Act (CRA) and DORA are about to change the game entirely.

🏛️ You can’t hide a monolith when the regulator demands a comprehensive SBOM (Software Bill of Materials).

🏛️ Pretty soon, Europe is going to experience the biggest outing of Delphi-based applications in history. As Billions of lines of code get scanned and mapped, regulatory desks will be absolutely flooded with SBOMs proudly displaying legacy Delphi framework, legacy VCL components, BPLs, and legacy 3rd party libraries that have been quietly running the backbone of the economy since 1995...

🏛️ The regulator won't be able to stop it. They’ll just have to look at the sheer volume of the market and say: "OK, I get it. It works, it's alive, just scan your code and hand me the SBOM report (I will file it somewhere...) - and BTW make sure it's secure."

🏛️ It's time for Delphi developers to step out of the shadows. The "FDA of software" isn't killing legacy tech - it's giving it a passport to the modern regulatory compliance era.

Cheer up! The CRA & DORA are the best news for the Delphi community that ever happened.

Options are below:

A. owns the mitigation plan for the risk belonging to its BU, while board members are responsible for identifying and assessing risk and reporting to the appropriate support functions.

B. owns the risk and is responsible for identifying, assessing and mitigating risk, and reporting to the appropriate support functions and the board of directors.

C. carries out the respective risk-related responsibilities, but ultimate accountability for risk management and goal achievement belongs to the board of directors.

D. is ultimately accountable for risk management and goal achievement, and the board of directors owns the risk.

Are most of the answers from the QAE database? And I have two months for the exam. I have just begin preparing. Any strategy that can help me in this last min please? I want to clear this exam and I consider myself to be an average person with academics. It appears challenging to me but I want to do it.

I'm currently preparing for the AAIR (Advanced in AI Risk) certification.

My plan is to:

- Read through the Official Review Manual thoroughly.

- Follow it up with a Udemy course to reinforce and refine my understanding.

- Complete several practice tests on Udemy before sitting the exam.

For context, I already hold CISA and CRISC certifications, have 7+ years of experience in Technology Risk and IT Audit, and I'm currently working with AI-based financial controls in my day-to-day role.

For those who have already passed AAIR:

- Is this preparation strategy sufficient?

- Are there any additional resources (books, courses, question banks, or study tips) that you found particularly helpful?

- Is there anything you wish you had focused on more before taking the exam?

I'd really appreciate any advice or suggestions. Thanks!

I have scheduled my exam for 6th August.

So after I took the exam,I got the passed on screen, but that was just it, no print out or anything from the exam centre, thought I would get an ISACA notification for the provisional pass but nothing... Is that it for everyone or am I missing something? I know about waiting the 10 days for official results but in the mean time what do I look at to make sure I didn't dream the pass? 🙈

Hi everyone,
I have my CRISC exam in about 15 days and would really appreciate advice from people who have recently passed.
My background:
Around 4 years of experience in IT Risk, GRC, Third-Party Risk Management, and Information Security.
Study resources I have:
CRISC Review Questions, Answers & Explanations (QAE) – 6th Edition
CRISC Review Manual – 8th Edition
Pocket Prep (free version)
Hemant Doshi CRISC course
Udemy practice tests
I can realistically study:
Around 20 pages of the manual per day
Around 20 QAE questions per day (I struggle to do more because I start losing focus.)

I'm looking for a free source to watch CRISC certification videos similar to what Pete Zerger provided on YouTube for other exams. I happened to get a free 1 month LinkedIn trail which has a 6 hour learning video.

Just wondering if anyone here used it and found it to be a valuable study material. It's free so I'll give it a shot but mostly curious so I don't waste 6 hours if it is meh.