ISACA CRISC Practice Test

CRISC practice test: what's covered

• Certified in Risk and Information Systems Control

Free CRISC sample questions

1. A newly appointed CRO is building the enterprise risk management programme from scratch. Which step should be performed FIRST?

   • A. Publish a corporate risk register
   • B. Document the organization's risk appetite and tolerance after engaging the board
   • C. Implement a GRC platform
   • D. Roll out mandatory risk training for all staff
   Show answer

   Correct: B. CRISC manager-lens: governance comes BEFORE operations. Without a board-approved appetite/tolerance, the register has no yardstick — every risk looks equally important. B (publishing a register first) is the classic misconception: students rush to "do work" before establishing the governance baseline. Tools and training come after governance is defined.

2. The PRIMARY reason for aligning the IT risk management programme with the organization's strategy is to:

   • A. Reduce audit findings
   • B. Ensure risk decisions support achievement of business objectives and value delivery
   • C. Reduce IT spend
   • D. Comply with ISO 31000
   Show answer

   Correct: B. Risk management exists to ENABLE strategy, not to police it. ISACA emphasises business-value alignment. B reframes IT risk as compliance/cost, which is the most common junior-analyst mindset and the wrong CRISC answer.

3. Which of the following BEST describes risk appetite?

   • A. The maximum loss the organization can absorb without going bankrupt
   • B. The broad amount of risk an organization is willing to accept in pursuit of its objectives, approved by the board
   • C. The deviation from a specific risk threshold accepted by management
   • D. The total residual risk on the risk register
   Show answer

   Correct: B. Appetite (board-level, broad) → Tolerance (specific thresholds) → Capacity (max survivable loss). Option A describes capacity. Option C describes tolerance — the most common confusion on the CRISC exam.

4. Which THREE statements correctly distinguish risk appetite from risk tolerance? (Choose 3)

   • A. Appetite is qualitative and high-level; tolerance is quantitative and specific
   • B. Appetite is set by management; tolerance is set by the board
   • C. Tolerance defines acceptable deviation from appetite for specific risks
   • D. Appetite changes weekly; tolerance is fixed for life
   • E. Appetite informs strategy; tolerance informs day-to-day operating thresholds
   • F. Tolerance is always higher than appetite
   Show answer

   Correct: A and C and E. Appetite is the board-level "how much risk are we comfortable with"; tolerance translates that into measurable thresholds operations can enforce. B reverses the ownership; D and F are simply wrong — both can change as strategy evolves, and tolerance is bounded BY appetite, not higher than it.

5. In the Three Lines Model, who has PRIMARY responsibility for owning and managing risk on a day-to-day basis?

   • A. Internal audit (Third Line)
   • B. Operational management — the First Line
   • C. Risk and compliance functions (Second Line)
   • D. External auditors
   Show answer

   Correct: B. 1st Line owns + manages risk; 2nd Line oversees/advises; 3rd Line provides independent assurance. B (Risk/Compliance) is the common misconception — students think risk teams "own" risk, but they only oversee and advise. The business owns it.

Last updated: 2026-10-19

CRISC practice test FAQ

Related practice tests

• ISACA CDPSE practice test
• ISACA CGEIT practice test
• ISACA CISA practice test
• ISACA CISM practice test