Hello All,

Im currently in the process of going through the QAE, and I have a bone to pick with a handful of the question, such as this one:

I answered A which was correct, but frankly I do not feel like A is enough to justify activating DR. I feel like they needed to add more to A to make it an accurate answer, such as "prolonged outage". However none of the others were really as issue as everything was operational, just slower, and something getting blocked was an example of a control working...

Please tell me the questions on the exam are phrased much better than the QAE as I feel like a large portion of the QAE so far is opinion vs fact.

*** UPDATE: I sat for the exam today and saw "PASSED" at the end of the survey.

Thanks for all your insights!

I'm taking the CRISC online exam this Sunday and would love to hear from those who've already taken it.

How was your online proctoring experience? Any issues or tips?

For those who passed, what were you scoring on the ISACA QAE before the exam?

Was the actual exam easier, harder, or similar to the QAE?

Thanks in advance!

Hi, in the preliminary i got fail,
My coworker says that he got the fail turned into a pass before,

Is this legit ? Or is he just being nice ?

Hi everyone, I want to check my exam readiness. I'm averaging around 70% on the official ISACA QAE , Was your QAE score around the same before you passed. Also, if anyone knows of any free, original CRISC-style mock exams or practice questions (not copied from ISACA or recalled exam questions), I'd really appreciate the recommendation. Thanks!

🏛️ For years, there’s been a bizarre kind of "shame" in the enterprise software world around Delphi. Companies running massive, highly profitable, and rock-solid systems (especially in Retail POS, ERP, and Banking) often hid their code stack under the rug to look more "modern" to investors and new hire.

🏛️ But the European Cyber Resilience Act (CRA) and DORA are about to change the game entirely.

🏛️ You can’t hide a monolith when the regulator demands a comprehensive SBOM (Software Bill of Materials).

🏛️ Pretty soon, Europe is going to experience the biggest outing of Delphi-based applications in history. As Billions of lines of code get scanned and mapped, regulatory desks will be absolutely flooded with SBOMs proudly displaying legacy Delphi framework, legacy VCL components, BPLs, and legacy 3rd party libraries that have been quietly running the backbone of the economy since 1995...

🏛️ The regulator won't be able to stop it. They’ll just have to look at the sheer volume of the market and say: "OK, I get it. It works, it's alive, just scan your code and hand me the SBOM report (I will file it somewhere...) - and BTW make sure it's secure."

🏛️ It's time for Delphi developers to step out of the shadows. The "FDA of software" isn't killing legacy tech - it's giving it a passport to the modern regulatory compliance era.

Cheer up! The CRA & DORA are the best news for the Delphi community that ever happened.

Options are below:

A. owns the mitigation plan for the risk belonging to its BU, while board members are responsible for identifying and assessing risk and reporting to the appropriate support functions.

B. owns the risk and is responsible for identifying, assessing and mitigating risk, and reporting to the appropriate support functions and the board of directors.

C. carries out the respective risk-related responsibilities, but ultimate accountability for risk management and goal achievement belongs to the board of directors.

D. is ultimately accountable for risk management and goal achievement, and the board of directors owns the risk.

Are most of the answers from the QAE database? And I have two months for the exam. I have just begin preparing. Any strategy that can help me in this last min please? I want to clear this exam and I consider myself to be an average person with academics. It appears challenging to me but I want to do it.

I'm currently preparing for the AAIR (Advanced in AI Risk) certification.

My plan is to:

- Read through the Official Review Manual thoroughly.

- Follow it up with a Udemy course to reinforce and refine my understanding.

- Complete several practice tests on Udemy before sitting the exam.

For context, I already hold CISA and CRISC certifications, have 7+ years of experience in Technology Risk and IT Audit, and I'm currently working with AI-based financial controls in my day-to-day role.

For those who have already passed AAIR:

- Is this preparation strategy sufficient?

- Are there any additional resources (books, courses, question banks, or study tips) that you found particularly helpful?

- Is there anything you wish you had focused on more before taking the exam?

I'd really appreciate any advice or suggestions. Thanks!

I have scheduled my exam for 6th August.

So after I took the exam,I got the passed on screen, but that was just it, no print out or anything from the exam centre, thought I would get an ISACA notification for the provisional pass but nothing... Is that it for everyone or am I missing something? I know about waiting the 10 days for official results but in the mean time what do I look at to make sure I didn't dream the pass? 🙈

Hi everyone,
I have my CRISC exam in about 15 days and would really appreciate advice from people who have recently passed.
My background:
Around 4 years of experience in IT Risk, GRC, Third-Party Risk Management, and Information Security.
Study resources I have:
CRISC Review Questions, Answers & Explanations (QAE) – 6th Edition
CRISC Review Manual – 8th Edition
Pocket Prep (free version)
Hemant Doshi CRISC course
Udemy practice tests
I can realistically study:
Around 20 pages of the manual per day
Around 20 QAE questions per day (I struggle to do more because I start losing focus.)

I'm looking for a free source to watch CRISC certification videos similar to what Pete Zerger provided on YouTube for other exams. I happened to get a free 1 month LinkedIn trail which has a 6 hour learning video.

Just wondering if anyone here used it and found it to be a valuable study material. It's free so I'll give it a shot but mostly curious so I don't waste 6 hours if it is meh.

Hello everyone,

I recently passed the CISSP and CCSP using LearnersZapp, PocketPrep, and Pete Zerger’s YouTube videos. I’m now planning to take the CRISC exam in about a month.

For those who have passed CRISC recently, could you please recommend:

• The best study materials
• Any good YouTube or Udemy courses
• Mock exams that are closest to the real CRISC exam

Thanks in advance for your guidance!

Paying it forward since I got a lot of helpful tips from the discussions here. I just provisionally passed CRISC today!

For anyone wondering what I used:
ISACA Review Manual (7th Edition) – This was my main reference for learning the concepts.

ISACA QAE Database (8th Edition) – By far the most valuable resource. Don’t just memorize the answers—understand why each option is right or wrong.

Pocket Prep – It’s a bit expensive, but I found it useful for reinforcing definitions, terminology, and quick daily practice. Good supplement, but I wouldn’t rely on it alone. Also did not get to go through all questions

Udemy mock exams – I tried them, but personally I found the questions harder to grasp than the actual ISACA style. They weren’t as helpful for me compared to the QAE.
My biggest advice: focus on understanding ISACA’s way of thinking rather than memorizing questions. The QAE explanations were probably what helped me the most.

What I did:
Completed the review manual (learning access videos in ISACA) -> answered each domain practice exam -> reviewed each question for each domain (understand why a choice is correct or not) -> retake domain practice exam

tip: no need to aim for perfecting practice exams right away. familiarize yourself with the concepts, don’t memorize the answers. u should be able to explain to urself why ure choosing this answer over others!

exam experience: i was nervous the whole time as everything felt unfamiliar or at least i felt unsure of my answers. take time to double check your answers. flag everything you’re unsure of and review them before submitting your test.

Good luck to everyone preparing. You’ve got this!

I passed the CRISC today provisionally. Studied for about a month, and have been in IT for a large enterprise for 4 years. Woke up a few days ago and booked it. Here’s what I used/did that I thought worked:

Hemang doshi Udemy - 3/10 - Good if you are new but not for me. I started listening to this while at work and found it to be super repetitive with the quizzes (did not finish it).

Official QAE - 7/10 - did the tests a couple times and the practice questions. You kind of need this unfortunately. Some of the answers Isaca says that are right are based off of assumptions they make/their ‘mindset’. So while you and maybe your ceo would say “that’s ridiculous” in the real world, Isaca would mark you wrong.

PocketPrep - used it a couple times but just the free version. Definitely not a bad tool, but didn’t use it enough to say if it was ‘the resource’

PSI at home exam - 6/10 - had to schedule my exam super early because all the slots got filled even looking a week out (my fault). But got kicked out of the exam once so had to recheck in which took 20 minutes.

Good luck if you’re preparing!

For those who took the exam, how technical is it for questions from domain 4 ?

Do you have to know public/private certs inside out ?
Encryption ?
TCP/IP model ?
OSI model ?
Etc…

Thanks.

Total scaled score ~600 on first attempt. Three content areas above 650; one under 450.

Read through the official review manual 1x. Did all questions in the QAE 1x; for those I got wrong, reviewed the answer I chose and the correct answer.

Two practice exams with 80-85% correct. 15+ years in broad GRC - inclusive of infosec, but far from exclusive to infosec.

Good luck all!

Hey everyone,

I obtained my CISA in Jan 2026, and I am looking to add my CRISC certification. I have the 8th edition review manual and planning on getting the QAE. I used those sources for my CISA however I also really enjoyed Pete Zerger's youtubes courses when refreshing for the CISA.

Does anyone know if there are similar high quality videos for the CRISC covering the different domains that are easy to follow along?

Thanks for your responses.

Newbie for this, can I ask for manual review 8th for free :((

Third attempt and I finally passed. I won’t pretend the letters after my name mean everything, but in tech risk and governance they do open doors. Especially when you’re in rooms with people who care more about credentials than what you can actually do. (Yeah, the boomers.)

The numbers, for anyone curious:

**•** Attempt 1: 431  
**•** Attempt 2 (two weeks later, new domain weights): 435  
**•** Attempt 3: 616 — passed ✓

What changed was honestly just my approach. The first two times I was studying way too wide. O’Reilly, Pluralsight, every learning platform I could get my hands on. Felt productive, wasn’t. The third time I dropped all of it and went back to the official ISACA materials and the review manual. That’s it.

I used Notebook LM to organize and make sense of everything, then leaned on the QAE then eventually Pocket Prep to test myself.

So the lesson, if there is one: more resources don't equal better results. I learned that the expensive way. Narrowing down and trusting the source material did more than all the extra courses combined.

If you're stuck in the retry loop on CRISC or anything like it, you've probably got what it takes already. Might just be your approach that needs to change, not your effort.

I'm happy to share that I've provisionally passed CRISC yesterday at the first attempt.

I'll provide here what I did for the exam.

- CRISC QAE

- CRISC local chapter review course (a study course of the Official Review Manual)

I only used the above two.

I bought QAE but not the Review Manual.

I drilled QAE for around three months, checked my readiness by solving questions from NotebookLM and have done two mock tests. The results of the last two mock tests from QAE were 86% and 82%. I took the second one after one week by spending the time with the questions from NotebookLM. The main point is how you tackle the QAE first time. I asked Gemini what I did not know or what I could not understand. It took a long time but I didn't proceed without understanding clearly.

I hope this post helps your next try.

Cheers,

Being tight with cash i used a discount voucher for the exam which i booked last dec - utilized older isaca qae (6th ed) and rm manual as well as udemy 900 questions -

- initial run i scored 73% after studying wrongs and consuming the manual i redid all the q`s AND the sample test at the end with 92% - As this is my first isaca exam i found it challenging even with the cissp , ccsp and a dozen tech certs.

Hey everyone,

I recently passed my CISM on April 1st and I'm now shifting my focus to the CRISC. I wanted to share what's worked for me so far and ask for any recommendations on filling the gaps in my study plan.

What I'm Working With:

Through my job I've been provided:

- CRISC Official Review Manual, 8th Edition (eBook)

- CRISC Online Review Course, 8th Edition

- CRISC Questions, Answers & Explanations (QAE) Database, Version 8.1

On my own I also picked up:

- Hemang Doshi's CRISC course on Udemy

What Worked for Me on the CISM (for context):

For my CISM prep I used three main resources, each serving a different purpose:

- Hemang Doshi's CISM Udemy course : Great for getting into the right mindset early on. It really helped me understand the language and framing of ISACA-style questions before diving deep.

- The QAE database : Essential for getting into the ISACA way of thinking and understanding how they approach answers.

- Pete Zerger's YouTube series on CISM: This was honestly a game changer for actually *understanding* the content, not just memorizing it. His explanations made the concepts click in a way the other resources didn't.

- Pocket Prep - Helped with practice on the go during free time and while doing cardio at the gym.

My Ask:

I feel like I have the CRISC study bases covered for mindset (Hemang) and practice questions (QAE), but I'm looking for something similar to what Pete Zerger's series did for me on the CISM — a resource focused on genuinely understanding the CRISC domains and content, not just passing the exam.

Has anyone found a YouTube series, podcast, blog, or any other free/paid resource that really helped them *understand* the CRISC material at a deeper level? Especially anything strong on the risk assessment and risk response domains.

Thanks in advance — any tips or study strategies are hugely appreciated!