CRISC Cram Sheet & Last-Minute Review
Updated 16 November 2026 · Fixed form, 150 questions, 4 hours, pass 450/800 · 4 domains, 2025 weights
CRISC asks what an IT risk practitioner should do: identify, assess, respond, monitor and report. Cramming pays off when you can tell risk ownership from control ownership and pick the response that fits appetite and tolerance. This sheet is weighted to the current four-domain outline.
The CRISC mindset
- Risk is owned by the business; the risk practitioner facilitates, analyses and reports.
- Always tie a response back to risk appetite and tolerance.
- Assess before you respond: a control chosen before the risk is understood is usually wrong.
- Report risk in business terms to the people who can act on it.
CRISC cram sheet by domain
Ordered by exam weight, so the top of the page is where most of the marks are.
Risk Response and Reporting
32% of the exam- Responses: mitigate, transfer, avoid, accept; each needs an owner and a rationale
- Risk owner vs control owner: accountability vs operation of the control
- Control design, selection, implementation and testing; control frameworks and types
- Metrics: KRIs (risk trend), KCIs (control effectiveness), KPIs (process performance)
- Reporting: heat maps, dashboards, scorecards; escalate when thresholds are breached
- Exceptions and exemptions need documented approval and an expiry
Governance
26% of the exam- Enterprise risk management; risk appetite set by the board and senior management
- Three lines model: operations own risk, risk and compliance oversee, internal audit assures
- Risk profile, culture and ethics; policies and standards
- Business processes and resilience (BCP, DRP) and asset management
- Frameworks and legal, regulatory and contractual requirements
Risk Assessment
22% of the exam- Risk identification: events, threat landscape, vulnerabilities, risk scenarios
- Risk analysis: likelihood and impact, qualitative vs quantitative methods
- Inherent risk (before controls) vs residual risk (after controls)
- BIA and the risk register: what each records and who uses it
- Threat modelling and scenario development with the business
Technology and Security
20% of the exam- Enterprise architecture and technology roadmaps; emerging technology risk
- Operations management: change, assets, problems, incidents; DevOps
- SDLC and project management risk; data lifecycle management
- Security principles, awareness and training; privacy and data protection
- Technology resilience and disaster recovery
Formulas and numbers to memorise
| Inherent vs residual risk | Before controls / after controls; residual must sit within appetite |
|---|---|
| Appetite vs tolerance | Amount of risk accepted / acceptable deviation from it |
| KRI, KCI, KPI | Risk early warning / control effectiveness / process performance |
| Exam | Fixed form, 150 questions, 4 hours, pass 450 on a 200–800 scale |
Common CRISC traps
- The risk practitioner accepting or owning the risk
- Choosing a control before the risk is assessed and the owner identified
- Confusing a KRI (risk) with a KCI (control) or KPI (performance)
- Reporting technical detail when the audience needs business impact
14-day CRISC cram plan
- Days 1–3Diagnostic across all 4 domains; rank them
- Days 4–8Risk Response and Reporting (32%) and Governance (26%); 60 questions a day
- Days 9–10Terms: appetite, tolerance, ownership, metrics, until each is one sentence
- Days 11–12A timed 150-question mock; review every miss
- Day 13Miss log and this sheet only
- Day 14Rest
Exam-day tactics
- About 1 minute 36 seconds per question; flag and return.
- Ask who owns the risk, then what fits the appetite, before choosing a response.
- Prefer the answer that keeps the business informed and accountable.
CRISC cram FAQ
What are the CRISC domain weights?
Governance 26%, Risk Assessment 22%, Risk Response and Reporting 32%, Technology and Security 20%.
Can you cram for CRISC?
With risk or control experience and one pass through the material, two weeks of focused scenario practice is realistic. The exam rewards judgment more than recall.
What is the CRISC passing score?
450 on a scaled range of 200–800.
Keep going
Turn this sheet into a score
Practise CRISC questions by weakest domain and see a readiness score that tells you when to book.
Start free