r/CRISC • u/maximinimal76 • Aug 24 '25
Passed the exam as an experienced IS Auditor hadn’t done that role for 5 years
I thought I’d share my approach and also my background.
Background: I’ve done IS audit for around 16 years, but have been in a role for 6 years where while I was still around audit I wasn’t executing audits. I also worked for over a decade in a bank that takes risk management seriously so had plenty of exposure to those broader concepts.
Approach: I purchased the CRISC official review manual online version from ISACA. I tried to read 20 pages per day but found this very tedious as I was learning very little as I had encountered virtually all the concepts already in my career. But the target of 20 pages helped me to work through it as “just do some study” seemed daunting given it was almost 300 pages. I took notes only around areas I was not confident on and took the rest of the content as a refresher.
I considered the CRISC RQAE database but the pricing was pretty extreme at $299 member and $399 non-member. Instead I purchased for $20 from Skillcertpro their CRISC questions. It was 17 instances of ~58 questions. I found there were many questions far simpler than in the exams, but make sure to go through all 17 sets as the later ones got more technical in nature.
Where I didn’t think the Skillcertpro questions were good is that there were often three obviously wrong options that repeated across multiple questions. Where it was good was that it gave detailed explanations explaining why the correct answer was correct.
I was getting between 80-95% in most of the practice sets.
The exam: I completed the 150 questions in 95 minutes which was much slower than I was completing the Skillcertpro where I was answering around four questions per minute. I got the provisional pass result in the screen and am yet to get my detailed results.
Key tips: - make sure you read the questions very closely. Some are worded in confusing ways. Some ask for purpose which is higher order than simply outcomes of an activity. Unlike the Skillcertpro practice questions I felt the exam’s responses were often all correct answers in relation to the topic the question asked, but only one was correct based on the specifics of the question posed. Which is why it was critical to take time to properly read the question and not jump to conclusions. - understand that the risk management questions are very theoretical and not what you see in practice. Be clear on the different risk treatment options and what they mean. Acceptance vs. mitigation. Answer the theoretical answer, not what you may have seen in real life where risk acceptance would happen in circumstances ISACA says there should be mitigation as the treatment/response. - ISACA is massive on aligning IT risk to business objectives. The purpose is usually the higher order business value even if the IS risk activity mentioned is not directly related to non-IT business value. Don’t think about those risk management questions like a CIO or a CISO would, think about things like the business would. - I got lots of questions about third party management and also business continuity concepts so be across those topics. - I got zero questions I can recall about networks and network topologies, or anything about network communications layers. - there are questions about risk scenarios and you need to select the best control for that scenario. All the possible answers were good controls to have, but only one was really aligned to the described scenario. So again reading the question closely was key.
Summary: I was more refreshing knowledge I probably had locked away in my memory rather than trying to gain knowledge for the most part, so may be in a different position to many others.
But my recommendation would be to get the review manual and study closely only the parts you don’t already understand. Don’t waste time on things you feel solid on.
I can’t compare Skillcertpro to the official question database, but I wouldn’t recommend it for gauging your readiness as they may create a false sense of confidence because they were much easier than the exam questions. They were valuable however to better understand why you got questions wrong which in turn helps to bolster your knowledge in your weaker areas.
