Over 292,796

Introduction:

The Isaca CRISC Exam demonstrates a candidate’s skill and knowledge in evaluating and identifying organizational risks. It also proves the candidate’s ability to design, implement and maintain risk-based, effective and efficient information system. This certification gives the individual recognition as an expert risk professional.

The major topics included in this exam are: Information Systems Monitoring and Maintenance; Information Systems Control Design and Implementation; Risk Monitoring; Risk Response; Risk Identification, Assessment and Evaluation.

Exam description:

Why is this exam required?

The CRISC certification is ideal for business and IT professionals who work at the operational level to reduce risk. This certification creates opportunity for the following job positions:

• IT Professionals

• Risk Professionals

• Control Professionals

• Business Analysts

• Project Managers

• Compliance Professionals

• IS/IT Consultants

Associated exam:

There is no associated exam for this certification.

Pre requisites:

There is no official pre requisite for this exam. However, minimum three years of work experience in IS control and risk management is required.

Objectives of the exam:

The exam has five domains, each carrying different weights. A summary of the topics covered in each domain is given below:

-          Risk Identification, Assessment and Evaluation (31%)

This section includes the following topics: identifying, assessing and evaluating risk for executing the organization’s risk management strategy; identifying legal requirements and threats; identifying the risk factors; developing programs for risk awareness; understanding frameworks and best practices related to risk assessment; applying qualitative and quantitative risk evaluation methods; understanding the concepts of security; identifying threats related to project management and disaster recovery management.

-          Risk Response (17%)

This section covers the following topics: developing and implementing risk responses; identifying and evaluating options for risk response; applying risk criteria for developing risk profile; understanding the standards and best practices to risk response; understanding return of investment and cost-benefit analysis; understanding risk management policies; understanding the various project management tools; understanding the concept of residual risk.

-          Risk Monitoring (17%)

In this section, candidates must demonstrate their understanding of the following topics: ways to monitor risk and communicate information to the stakeholders; evaluating data that measures Key Risk Indicators; allow for independent risk assessment; understand the standards and best practices in relation to risk monitoring and risk ownership; understand the various methodologies of risk assessment.

-          Information Systems Control Design and Implementation (17%)

In this section, candidates must demonstrate their knowledge and skills in the following areas: designing and implementing information systems controls in line with the organization’s objectives and risk levels; analyzing objectives of business process; identifying resources required to operate and implement information systems controls; providing implementation progress reports; assessing tools in order to mechanize processes of information control; establishing criteria for control; understanding the frameworks and industry best practices in relation to information systems control implementation and design; understanding the various tools of business process; understanding the various testing methodologies; understanding the control practices in relation to business processes, information security, data management, project management;  understanding the architecture of information systems.

-          IS Control Monitoring and Maintenance (18%)

Following topics are included here: monitoring and maintaining information systems controls; identifying deficiencies of the information systems; assessing tools to mechanize the verification process of information systems control; identifying gaps between targeted and present process maturity; understanding standards and industry best practices in relation to information system control maintenance and monitoring; understanding the architecture of enterprise security; understanding the various maturity models; understanding the various security assessment tools; understanding metrics and control objectives in relation to information security, data management, system development life cycle, project management, disaster recovery management.

Career Prospects:

As information is the heart of a company, it is vital to have a risk management system to guard this information. Isaca CRISC certified professionals have the experience and knowledge required to control, assess and monitor a company’s IT systems. This certification is a prestigious credential which proves a professional’s expertise in risk management of an enterprise. The certification gives individuals a competitive edge over others and results in better career growth and higher earnings.

An Isaca CRISC certified professional increases value of an organization that is looking for managing IT risks. It also gives professionals to be part of an elite network and opens scope for achieving higher certifications in the field of risk management. It keeps the professionals up-to-date with the best practices used in the risk management area. This certification gives opportunity of becoming expert risk professionals, control professionals, business analysts, project managers and compliance professionals.