CRISC is the most respected credential for IT risk management professionals with over 46,000 holders globally. It is heavily weighted toward financial services and enterprise risk functions where connecting IT risk to business impact is a daily requirement. The CRISC exam is 150 multiple choice questions across four domains, but the real work is applying risk frameworks to complex business scenarios, designing IS controls, and reporting risk in board-level language. XCRISC builds this applied capability.
Across five instructor-led days, XCRISC covers all four CRISC domains as updated by the November 2025 ISACA CRISC job practice revision: IT Risk Identification, IT Risk Assessment, Risk Response and Mitigation, and Risk Control Monitoring and Reporting. The November 2025 update introduced AI risk assessment and AI data governance into the CRISC job practice, and XCRISC covers this in depth. Every domain is applied to realistic enterprise and financial services risk scenarios.
On Day 5, participants conduct a supervised enterprise risk assessment for a simulated organisation and design IS controls to address identified risks. A senior IT risk practitioner assesses risk identification, assessment methodology, control design, and reporting quality. XCRISC certificate and Practitioner Assessment Report issued. Aligned with ISACA CRISC four domains (November 2025 revision), ISO 31000, NIST RMF, COBIT 2019, FAIR methodology, ISO 27005, DORA Articles 6 to 16, and Federal Reserve SR 11-7 for model risk.
