ISACA study plan
CRISC study plan
A step-by-step CRISC study plan: the exact order to study in, how long to spend on each stage, and when to start practice questions. Follow it top to bottom.
The real CRISC is 150 questions in 240 minutes, pass mark 450 / 800. For the full domain-by-domain breakdown behind each stage, read the CRISC study guide.
Your step-by-step plan
Map the blueprint and book a date
Day 1Read the four CRISC domains and their weights so you know where the marks are. Book a provisional date now: a fixed date turns open-ended study into a plan and is the strongest predictor of actually sitting. Note that Risk Response and Reporting is the largest domain and Governance is the second largest, so together they dominate the exam.
Internalise the practitioner mindset
Week 1Before drilling any domain, lock the two reflexes the whole exam rests on: align decisions with risk appetite and approved objectives, and keep accountability with the business owner rather than the practitioner. Use the recall prompts in this guide: cover the answer, choose the move from who owns the risk and what the appetite is, then reveal. If you cannot pick without the explanation, you do not own it yet.
Go deep on Response and Reporting, then Governance
Weeks 1 to 3These two are the bulk of the exam, so they get the most time. Drill the four treatment options and cost-benefit selection, the KRI, KPI and KCI metric families, and audience-tailored reporting. In Governance, fix the three lines of defence, appetite versus tolerance, and continuous regulatory horizon scanning. Practise on scenario questions and read the worked explanation on every one, including the ones you got right, watching for the appetite or ownership cue that picks the answer.
Lock risk assessment fundamentals
Weeks 3 to 4Make the four-part risk scenario and the inherent-versus-residual distinction automatic, reasoning from control operating effectiveness rather than gross ratings. Add the emerging-technology risks: training-data bias for AI fairness and fabricated confident output for large language models. Reject any answer that is really an inventory rather than an analysable scenario.
Cover the technology and security knowledge
Week 4This domain rewards tying each technical concept to the business requirement that drives the answer: RPO drives backup frequency, the business impact analysis drives recovery order, enterprise architecture review surfaces duplication before purchase, and data minimisation limits collection to the stated purpose. These are dependable marks once you learn them as risk decisions, not isolated facts.
Drill weak domains, then space the review
Week 5Use your per-domain accuracy to attack the domains dragging you down, not to re-read what you already know. Then space it: revisit each domain's recall prompts after a few days and again a week later. Spacing roughly doubles what sticks compared with cramming.
Sit a timed mock and calibrate
Weeks 5 to 6Take at least one full timed mock under exam conditions to rehearse pacing and the flag-and-return habit across the full question set. Treat the score as a per-domain readiness signal, not a single number, and review every missed question, naming the appetite, ownership or cost cue you misread, before you book or sit.
Ready to start stage one?
Free CRISC questions with worked explanations. No sign-up.
Frequently asked questions
How long does this CRISC study plan take?
It is 7 stages, paced by how much time you can give it each week - most candidates work through it in 2 to 6 weeks. Each stage below has a suggested duration; slow down on any stage where the recall checks in the study guide are not landing before moving on.
What order should I study CRISC in?
Follow the stages in order below. They are sequenced deliberately: foundational material first, then the domains weighted heaviest on the exam, then timed practice, with review passes built in rather than left to the end.
Do I need practice questions as part of this plan?
Yes. Reading alone does not surface what you have not actually learned. This plan builds in graded practice, and the full 290-question bank is free to use as you work through each stage.
Is this plan enough on its own, or do I need the full study guide too?
This page is the plan: what to do and in what order. The study guide adds the domain-by-domain breakdown, easy-to-confuse traps, and worked examples behind each stage - read it alongside this plan, not instead of it.
Examworthy is not affiliated with or endorsed by ISACA. This study plan is original material based on the public exam blueprint. We never reproduce live exam items. CRISC and related marks belong to their respective owners.