I am confused about these 2:- Cism or crisc, which one should i pursue first, i am working in the grc domain along with tprm under the Cyber security. My role is mostly on security compliance, vendor assessment, risk and mitigation, client Security questionnaires etc..
I thought of giving crisc first then cism? Any suggestions
I was originally planning to take it earlier, but the only available exam center slots were already pushed out to September, so I decided to go for it now.
I took the exam at a test center — I didn’t want to risk the online option because my internet connection can be unreliable at home.
For preparation, I bought the official CRISC Review Manual, but honestly didn’t get much value from it. I mainly used the QAE database and went through it twice. I also asked ChatGPT for clarifications and summaries where needed.
I already have the CISM, so the ISACA question style (BEST / MOST / FIRST thinking) was familiar, which definitely helped.
Overall prep was about a month of light evening study after my kid went to sleep.
Took the exam at a PSI Test Center today and passed.
I had been preparing for a much more intense exam than I actually received. I felt my exam was very straightforward, and there were only a handful of questions I had to make a judgment on between what "I think" and "what I think ISACA wants".
As others have said, the QAE is key. There are many "questionable" questions in the QAE, but it is the best source for learning ISACA's thinking and the patterns in their questions. The official study guide is good, and a useful resource to have, especially if you want to look up what ISACA has to say about any particular subject in the CRISC domains.
If you meet the experience qualification for the cert, then the official guide and the QAE are all you really need. I also used a handful of other resources from UDEMY and the Peter Gregory books, but honestly they were less useful, and I found myself arguing with "their" answers many times (which is good for helping you think through topics, but kinda frustrating when you're trying to prepare for an exam).
I don't recommend taking the exam before meeting the experience requirement, as you might struggle to understand the "Why?" behind many questions.
Looking forward to making it official once my results are finalized and I can submit my certification application.
Materials I recommend using: CRISC Official Manual 8th Edition. And Official QAE.
I'm finally able to say that I've passed the CRISC after failing my first time by 6 points. I am incredibly proud of myself and wanted to take a moment to share my methodology with the community.
Background: 5 years in general security analyst roles varying from vulnerability management, governance, and risk management at finance orgs. Then another 2 years as an IT compliance analyst at a non-profit.
Study Method: The key to passing is consistent study time, which didn't start until January. While I prioritized studying over
I decided to purchase the manual and QAE. I would study every day I could from April-August.
The exam is tricky. I recommend taking it in person at a testing site if you can. You got this!
Update: I am not sharing the official materials. It is not possible to do. Please do not ask.
Hi y'all!! So I have one year of experience in credit underwriting (for cards) and would love to do some certification related to risk and would love to take a job related to risk/compliance/fraud or in AML.
Thought of pursuing FRM but decided it's not the right fit for me right now. My back-up plan is to do an MBA in correspondence but I am leaning more towards professional certifications like FRM CRISC CAMS. Which one would be more doable ( I mean I know everything is with effort but I meant I have to work at least like 9 hours per day and would be drained out very much also one of the main reasons why I want to switch fields)
Would love to hear your opinions on this!!
Hi everyone,
I received a message this morning from someone offering to take the CRISC exam on my behalf in exchange for payment. They said I would only need to keep my webcam and microphone on while they completed the exam for me.
When I told them not to contact me again with cheating or scam offers, they immediately deleted the messages and blocked me which tells you everything you need to know.
I’m sharing this so others are aware. Please do not engage with accounts making these offers. Report and block them instead. Participating in something like this could lead to serious consequences, including losing your certification eligibility or having your ISACA account flagged.
