Cyber Security Category Banner Image

Certified in Risk and Information Systems Control (CRISC®)

  • Length 4 days
  • Price  NZD 3750 exc GST
Course overview
View dates &
book now

Why study this course

Modern businesses face a diverse collection of obstacles, potential dangers and risk exposure. ISACA’s Certified in Risk and Information Systems Control (CRISC®) certification indicates expertise in identifying and managing enterprise IT risk, and implementing and maintaining information systems controls. This course and certification is designed for mid-career IT and business professionals who identify and manage risk through the development, implementation and maintenance of appropriate information systems (IS) controls. CRISC certification confirms an individual’s skills and knowledge to secure the modern enterprise against escalating threats.

The CRISC Exam Preparation course is an intensive, four-day review program to prepare individuals who are planning to sit for the Certified in Risk and Information Systems Control (CRISC) exam. The course focuses on the key points covered in the CRISC Review Manual and includes class lectures, group discussions, exam practice and answer debriefs. The course is intended for individuals with familiarity with and experience in IT and enterprise risk management.

This course includes a digital courseware manual and access to the CRISC Questions, Answers and Explanations (QAE) database for 12 months.

Please note: The exam is not included in the course fee but can be purchased separately. Please contact us for a quote.

Aligns to certification

Request Course Information

What you’ll learn

CRISC validates your experience in building a well-defined, agile risk-management program, based on best practices to identify, analyse, evaluate, assess, prioritise and respond to risks. This enhances benefits realisation and delivers optimal value to stakeholders.

ISACA Accredited Elite Partner Logo

ISACA at Lumify Work

ISACA provides practical guidance, benchmarks and other effective tools for all enterprises that use information systems. Through its comprehensive guidance and services, ISACA defines the roles of information systems governance, security, audit and assurance professionals worldwide.

Lumify Work is an Accredited Elite Partner of ISACA.

Who is the course for?

This course is designed for mid-career IT and business professionals, including:

  • Security Directors, Managers, and Consultants

  • Compliance/Risk/Privacy Directors and Managers

  • IT Audit Directors, Managers, and Consultants

  • Compliance/Risk/Control Staff

Course subjects

Domain 1: Governance

A. Organisational Governance

  • Organisational Strategy, Goals, and Objectives

  • Organisational Structure, Roles, and Responsibilities

  • Organisational Culture

  • Policies and Standards

  • Business Processes

  • Organisational Assets

B. Risk Governance

  • Enterprise Risk Management and Risk Management Framework

  • Three Lines of Defence

  • Risk Profile

  • Risk Appetite and Risk Tolerance

  • Legal, Regulatory, and Contractual Requirements

  • Professional Ethics of Risk Management

Domain 2: IT Risk Assessment

A. IT Risk Identification

  • Risk Events (e.g., contributing conditions, loss result)

  • Threat Modelling and Threat Landscape

  • Vulnerability and Control Deficiency Analysis (e.g., root cause analysis)

  • Risk Scenario Development

B. IT Risk Analysis and Evaluation

  • Risk Assessment Concepts, Standards, and Frameworks

  • Risk Register

  • Risk Analysis Methodologies

  • Business Impact Analysis

  • Inherent and Residual Risk

Domain 3: Risk Response and Reporting

A. Risk Response

  • Risk Treatment / Risk Response Options

  • Risk and Control Ownership

  • Third-Party Risk Management

  • Issue, Finding, and Exception Management

  • Management of Emerging Risk

B. Control Design and Implementation

  • Control Types, Standards, and Frameworks

  • Control Design, Selection, and Analysis

  • Control Implementation

  • Control Testing and Effectiveness Evaluation

C. Risk Monitoring and Reporting

  • Risk Treatment Plans

  • Data Collection, Aggregation, Analysis, and Validation

  • Risk and Control Monitoring Techniques

  • Risk and Control Reporting Techniques (heatmap, scorecards, dashboards)

  • Key Performance Indicators

  • Key Risk Indicators (KRIs)

  • Key Control Indicators (KCIs)

Domain 4: Information Technology and Security

A. Information Technology Principles

  • Enterprise Architecture

  • IT Operations Management (e.g., change management, IT assets, problems, incidents)

  • Project Management

  • Disaster Recovery Management (DRM)

  • Data Lifecycle Management

  • System Development Life Cycle (SDLC)

  • Emerging Technologies

B. Information Security Principles

  • Information Security Concepts, Frameworks, and Standards

  • Information Security Awareness Training

  • Business Continuity Management

  • Data Privacy and Data Protection Principles

  • Secondary Classifications


There are no prerequisites for taking this course or the CRISC Exam. However, in order to apply for CRISC certification, the candidate must meet the necessary experience requirements as determined by ISACA.

To obtain the CRISC Certification, a candidate must pass the CRISC Exam and have the relevant full-time work experience in the CRISC exam content outline: Three or more years of experience in IT risk management and IS control.

Industry Association Recognition

This course is eligible for Continuing Professional Education (CPE) hours/points to assist in maintaining your ISACA certification.

  • Contact hours: 28 hours

  • Continuing Professional Education: 28 CPEs

If you wish to claim CPEs, Lumify Work can verify your attendance. Please complete this ISACA form and email us at [email protected].

Terms & Conditions

The supply of this course by Lumify Work is governed by the booking terms and conditions. Please read the terms and conditions carefully before enrolling in this course, as enrolment in the course is conditional on acceptance of these terms and conditions.

Request Course Information

Personalise your schedule with Lumify USchedule

Interested in a course that we have not yet scheduled? Get in touch, and ask for your preferred date and time. We can work together to make it happen.


  • Continue your learning experience online with Lumify Plus
    Lumify Plus is coming soon to New Zealand!
  • Cyber Risk and Audit Professional Bundle
    Do you want to show you have the skills to audit, control, monitor and assess your organisation’s information technology and business systems?
  • Cyber Risk and Governance Professional Bundle
    Are you interested in learning how to take a holistic approach addressing cyber threats and governing risk within organisations?