u/naras007

I'm trying to understand the practical difference between passing an ISACA exam and obtaining the certification.

Does ISACA not issue a pass result unless you're certified? Do recruiters and hiring managers value an exam pass on its own, or does it only become meaningful once you're certified? At the end of the day, certifications alone don't matter much if someone doesn't have the skills to perform the role. If a candidate has passed the exam without formal 'certificate', how is that generally viewed during the recruitment process or once they're on the job?

My assumption is that the real value lies in the knowledge and skills gained while preparing for the exam, with the certification serving as formal validation of that achievement. I'd be interested to hear how recruiters, hiring managers, and those who've been through the process see it. I'm not interested to review the benefits of accessing additional material, professional networking, attending events etc. as most of us don't value them without the real experience to perform the role.

I'm generally curious about the distinction, not trying to challenge the value of 'certification'. I may be missing something, and I'm happy to be corrected.

Hi,

I'm new to ISACA. I recently received a 50% off ISACA membership offer via email and purchased the membership at the discounted price. My membership is valid until 31-Dec-26.

I understand that once I register for the CRISC exam, I have 6 months to schedule and take it.

My question is: If I register for the CRISC exam on 31-Dec-26 (the last day of my membership) using the member discount, can I schedule the exam anytime up to 30-June-27?

Also, would I need to renew my ISACA membership after 31-Dec-26 to remain eligible to take the exam, even though I registered and received the member discount while my membership was still active?

Has anyone been in a similar situation or knows how ISACA handles this?

Thanks in advance!

Curious to hear from people working in Technology Risk, Operational Resilience, Cyber, or GRC: how are these roles changing with the rise of AI.

Are responsibilities shifting more toward AI governance, strategic oversight, and risk interpretation, while repetitive control/testing work becomes automated?

Would love to hear real industry observations on how the profession is transitioning.

I’m an architect with 25+ years of experience, primarily in financial services, and I’m now considering a move toward operational risk architecture roles.
As a first step, I’m planning to pursue CRISC certification to strengthen my risk management knowledge and align my profile more closely.
What I’m trying to understand is how difficult it might be to pivot my career in this direction at this stage. Are there professionals here who have transitioned from architecture into risk-related roles? Does an architecture background help in operational risk, governance, resilience, or control design discussions, or do organisations generally prefer candidates with a more traditional risk/compliance background?
I’d also appreciate any advice on how recruiters and hiring managers might view such a transition, especially when applying for operational risk architecture or technology risk roles over the coming months.
Would love to hear from anyone who has made a similar move or worked with professionals who have.

I’m an architect with 25+ years of experience, primarily in financial services, and I’m now considering a move toward operational risk architecture roles.
As a first step, I’m planning to pursue CRISC certification to strengthen my risk management knowledge and align my profile more closely with risk-focused roles.
What I’m trying to understand is how difficult it might be to pivot my career in this direction at this stage. Are there professionals here who have transitioned from architecture into risk-related roles? Does an architecture background help in operational risk, governance, resilience, or control design discussions, or do organisations generally prefer candidates with a more traditional risk/compliance background?
I’d also appreciate any advice on how recruiters and hiring managers might view such a transition, especially when applying for operational risk architecture or technology risk roles over the coming months.
Would love to hear from anyone who has made a similar move or worked with professionals who have.