64%

of enterprises have not conducted any AI-related incident response exercises. ISACA State of Cybersecurity 2026.

Certified in Risk and Information Systems Control (CRISC) certification

Untested Risk Is Unmanaged Risk.

Most enterprises have never rehearsed an AI-related incident. CRISC proves you can identify, assess and control IT risk, AI included, before it turns into the incident.

HRD Corp claimableYayasan Peneraju: may be eligibleKL, Penang or online

Exam

ISACA CRISC

Course

4 days

Course fee

RM9,000

Exam fee

Included

Next intake

25 Jan 2027

Quick answer

What is CRISC?

Certified in Risk and Information Systems Control (CRISC) is ISACA’s certification for IT risk management. It proves you can govern IT risk, assess it, respond with the right controls and report on it in business terms. One 4-hour, 150-question exam earns it, and you need three years of relevant experience to be certified.

Exam facts verified against isaca.org on 23 Oct 2026

FOR

IT risk, compliance, control and security professionals

ROLES

IT risk manager, risk analyst, compliance manager, control assurance lead

SKIP IF

You audit rather than own risk. Look at CISA

01

The Credential

What you study, practise and sit to earn it.

Pass the CRISC exam, show three years of experience across at least two of the four CRISC domains, and apply to ISACA. More than 46,000 people have earned CRISC since 2010.

COURSE

4 days, 4 domains

FOCUS

Managing IT risk and controls

EXAM

150 questions, 240 min

CREDENTIAL

ISACA CRISC

Awarded by

ISACA

Level

Professional, IT risk

Prerequisite

None to sit; 3 years’ experience to certify

Apply within

5 years of passing the exam

Upkeep

120 CPE hours per 3 years, 20 a year

Related

AAIR, CISA, CISM

02

Decide in 60 Seconds

Four options people weigh against each other.

If you want to

Choose

Why

Identify, assess and control IT risk

→

CRISC

Risk management linked to business goals

Audit IT systems, controls and governance

→

CISA

The global standard for IS audit and assurance

Manage an information security programme

→

CISM

Security governance and programme management

Learn the ISMS standard that frames risk treatment

→

ISO/IEC 27001 Foundation

Two-day grounding in ISO 27001

Exam open to all. Are you ready?
0/4

Tick what applies. 3 or 4: you are ready for this course. Fewer: start with ISO/IEC 27001 Foundation.

03

What the Exam Covers

Four domains from ISACA’s CRISC exam content outline. Bars to scale.

4 domains, 150 questionsLargest: Risk Response and Reporting, 32%

Risk Response and Reporting 32%
Governance 26%
Risk Assessment 22%
Technology and Security 20%

Source: ISACA CRISC exam content outline.

04

What the Course Covers

Four domains, each with exam-style practice.

Four days of instructor-led training that follows ISACA’s job practice domains, from setting risk appetite to designing, monitoring and reporting the controls.

Domain 1

Governance

  • Organisational governance
  • Risk governance: ERM, lines of defence, risk appetite and tolerance

Domain 2

Risk Assessment

  • Risk identification
  • Risk analysis

Domain 3

Risk Response and Reporting

  • Risk response
  • Control design and implementation
  • Risk monitoring and reporting

Domain 4

Technology and Security

  • Technology principles
  • Information security principles

150

questions on exam day, all scenario-based. Each domain includes case studies and exam-style practice so you learn how ISACA asks.

05

Why Now

How ready organisations are for the next incident, and why train with us.

64%

of enterprises have not conducted any AI-related incident response exercises

ISACA State of Cybersecurity 2026

45%

of cybersecurity professionals expect a cyber attack on their organisation in the next year

ISACA State of Cybersecurity 2026

48%

either do not know whether their organisation has AI incident playbooks, or say it does not

ISACA State of Cybersecurity 2026

6 hrs

Six Hours to Report. Who’s Watching the Alerts?

Malaysia’s Cyber Security Act 2024 (Act 854) came into force on 26 August 2024. Critical infrastructure entities must report a cyber security incident within six hours, and managed SOC monitoring services now need a licence. Meeting it starts with knowing your risks before they become incidents.

NACSA; Cyber Security (Notification of Cyber Security Incident) Regulations 2024

ISACA Accredited Elite Partner

Training aligned to ISACA’s CRISC job practice

Exam included

One fee covers training and your exam

HRD Corp registered

This course is HRD Corp claimable

KL, Penang or online

Instructor-led in class or live online

06

The Cost, All In

Every figure per person, in ringgit.

Fees

Four-day courseIncluded

CRISC exam registrationIncluded

Funding

HRD Corp claim for employersClaimable

Yayasan Peneraju financing (Bumiputera)May be eligible

Course with exam

RM9,000

Dates

Where

Fee

Mon 25 to Thu 28 Jan 2027

Kuala Lumpur or online

RM9,000 incl. exam

Mon 15 to Thu 18 Feb 2027

Kuala Lumpur or online

RM9,000 incl. exam

Tue 23 to Fri 26 Mar 2027

Kuala Lumpur, Penang or online

RM9,000 incl. exam

Mon 24 to Thu 27 May 2027

Kuala Lumpur or online

RM9,000 incl. exam

Training a team? We run private intakes on dates that suit your organisation, with HRD Corp claims handled alongside you.

07

Exam and Renewal

What exam day looks like, and what happens after you pass.

Certification

Certified in Risk and Information Systems Control (CRISC)

Questions

150 multiple choice

Duration

4 hours

Passing score

450 on a 200 to 800 scale

Delivery

PSI test centre or remote proctoring

Eligibility window

Six months from registration

ISACA exam fee

US$575 members, US$760 non-members

Through Trainocate

Included in the course fee

KEEP IT ACTIVE

Earn 120 CPE hours

Earn 120 continuing professional education hours over each three-year cycle, with at least 20 hours every year.

ALSO REQUIRED

Ethics and annual fee

Follow ISACA’s Code of Professional Ethics and pay the annual maintenance fee through MyISACA.

FAQ

Questions People Ask

What is CRISC?

Certified in Risk and Information Systems Control (CRISC) is ISACA’s IT risk management certification. It covers four domains: governance, risk assessment, risk response and reporting, and technology and security.

At Trainocate Malaysia the four-day CRISC course is RM9,000 per person, including the exam. The course is HRD Corp claimable, and Malaysian Bumiputera learners may be eligible for Yayasan Peneraju funding.

150 multiple-choice questions in four hours. You need a scaled score of 450 on a 200 to 800 scale. You can sit it at a PSI test centre or with remote proctoring.

Anyone can sit the exam. To be certified, you need three years of experience across at least two of the four CRISC domains, gained within the ten years before you apply. You have five years after passing to apply.

Yes. ISACA says CRISC prepares professionals to address emerging technology, including AI risk assessment. For deeper AI risk work, ISACA added the Advanced in AI Risk (AAIR) credential in 2026.

Take CRISC if you own, assess and manage IT risk. Take CISA if you audit IT systems and controls. Many professionals hold both.

Earn 120 CPE hours every three years, with at least 20 hours a year, follow ISACA’s Code of Professional Ethics, and pay the annual maintenance fee.

Own the Risk Conversation

Pick an intake. An advisor confirms fees, HRD Corp claims and Yayasan Peneraju eligibility with you.

  • Next intake: 25 to 28 Jan 2027
  • RM9,000, exam included

Sources

  1. ISACA: CRISC certification
  2. ISACA: CRISC exam content outline
  3. ISACA: Get CRISC certified
  4. ISACA: Exam Candidate Guide v1.26 (PDF)
  5. ISACA: State of Cybersecurity 2026 press release (22 Sep 2026)
  6. ISACA: 2026 press releases (AAIR launch, 15 Apr 2026)
  7. Trainocate: CRISC course page
  8. NACSA: Cyber Security Act 2024 (Act 854)
  9. MAICSA: Act 854 regulations summary