Certified in Risk and Information Systems Control

Certified in Risk and Information Systems Control


Duration: 3 days

CRISC - The mark of excellence for a professional certification program is the value and recognition it bestows on the individual who achieves it. The Certified in Risk and Information Systems Control (CRISC) program, sponsored by ISACA, recognizes a wide range of professionals for their knowledge of enterprise risk and their ability to design, implement, monitor and maintain information systems (IS) controls to mitigate such risk.   

This three day training course prepares participants for the CRISC examination by providing a conducive learning environment where the skillsets and knowledge required of a information systems risk management professional can be acquired comprehensively. The Certified in Risk and Information Systems Control™ certification (CRISC™, pronounced “see-risk”) is designed for IT professionals who have hands-on experience with risk identification, assessment, and evaluation; risk response; risk monitoring; IS control design and implementation; and IS control monitoring and maintenance. The CRISC designation will not only certify professionals who have knowledge and experience identifying and evaluating entity-specific risk, but also aid them in helping enterprises accomplish business objectives by designing, implementing, monitoring and maintaining risk-based, efficient and effective IS controls.


This seminar has been designed to prepare Delegates for the CRISC examination by enabling them to supplement their existing knowledge and understanding so as to be better prepared to pass the exam, as defined by ISACA.
  • With the completion of this course, participants will be able to accomplish the following business objectives in their enterprise:
        o Designing, implementing, monitoring & maintaining risk-based,            effective IS controls
        o Compliance with regulatory requirements

  • Also covered are the 5 domains as required by ISACA:
        o Risk Identification Assessment and Evaluation (RI) 
        o Risk Response (RR) o Risk Monitoring (RM)
        o IS Control Design and Implementation (CD)
        o IS Control Monitoring and Maintenance (MM)
Risk Identification, Assessment and Evaluation
  • Collect information and review documentation to ensure that risk scenarios are identified and evaluated.

  • Identify legal, regulatory and contractual requirements and organizational policies and standards related to information systems to determine their potential impact on the business objectives.

  • Identify potential threats and vulnerabilities for business processes, associated data and supporting capabilities to assist in the evaluation of enterprise risk.

·Information Systems Control Design and Implementation
  • Interview process owners and review process design documentation to gain an understanding of the business process objectives.

  • Analyze and document business process objectives and design to identify required information systems controls.

  • Design information systems controls in consultation with process owners to ensure alignment with business needs and objectives.

  • Facilitate the identification of resources

Risk Response
  • Identify and evaluate risk response options and provide management with information to enable risk response decisions.

  • Review risk responses with the relevant stakeholders for validation of efficiency, effectiveness and economy.

  • Apply risk criteria to assist in the development of the risk profile for management approval.

  • Assist in the development of risk response action plans to address risk factors identified in the organizational risk profile.

  • Assist in the development of business cases supporting the investment plan to ensure that risk responses are aligned with the identified business objectives.

·Information Systems Control Monitoring and Maintenance
  • Plan, supervise and conduct testing to confirm continuous efficiency and effectiveness of information systems controls.

  • Collect information and review documentation to identify information systems control deficiencies.

  • Review information systems policies, standards and procedures to verify that they address the organization’s internal and external requirements.

  • Assess and recommend tools and techniques to automate information systems control verification processes.

Risk Monitoring
  • Collect and validate data that measure key risk indicators (KRIs) to monitor and communicate their status to relevant stakeholders.

  • Monitor and communicate key risk indicators (KRIs) and management activities to assist relevant stakeholders in their decision-making process.

  • Facilitate independent risk assessments and risk management process reviews to ensure that they are performed efficiently and effectively.

  • Identify and report on risk, including compliance, to initiate corrective action and meet business and regulatory requirements

Course ID:

Show Schedule for: