CISA vs CRISC: should you audit IT or manage IT risk?
The CISA vs CRISC choice comes down to your work: take the CISA (Certified Information Systems Auditor) if you audit IT and report on whether its controls (safeguards) work. Pick the CRISC (Certified in Risk and Information Systems Control) if you find, rate and respond to IT risk. Both come from ISACA, an IT audit and risk association.
The exam and upkeep fees are identical. The CRISC asks for three years of work with no waivers; the CISA asks for five, and a degree or credential can replace up to three of them. In October 2026, the spelled-out CISA title appeared in 3 of the 8,110 US security-analyst ads on Adzuna, a job-ad search site, and the acronym CRISC in 31 (counted with different phrases).
Jump to: your situation · job ads · exam content · experience · cost · upkeep · difficulty · order
| CISA | CRISC | |
|---|---|---|
| Issuer | ISACA | ISACA |
| Written for | Information systems (IS) audit: testing whether controls work and reporting the results | IT risk management: finding and rating risks, choosing a response and keeping controls in place |
| Domains (exam topic areas) | 5 | 4 |
| Work needed before ISACA grants the title | 5 years of IS audit, control or security work | 3 years of IT risk management and IS control work |
| Years a waiver (a degree or credential that stands in for work) can cover | Up to 3 | 0 |
| Exam format | Four hours, 150 multiple-choice questions | Four hours, 150 multiple-choice questions |
| Exam fee, member / non-member | $575 / $760 | $575 / $760 |
| Maintenance fee per year, member / non-member | $45 / $85 | $45 / $85 |
Source: ISACA; each page and its read date is under Sources. Member prices need paid ISACA membership.
Show the numbers
| Country | CISA | CRISC |
|---|---|---|
| India | 2 of 250 | 6% |
| United Kingdom | 2 of 235 | 1 of 235 |
| United States | 3 of 8,110 | 31 of 8,110 |
| Brazil | 0 of 434 | 0 of 434 |
CISA or CRISC: which do employers name more?
Instant answer from October 2026 job ads. No email needed.
CRISC is named in more job ads in the United States.
Source: Adzuna job ads, October 2026.
Get your full report
Two optional questions shape your first step. No email needed.
On this page
- Which one fits your situation?
- CRISC vs CISA: what job ads mention
- What does each exam test?
- How many years of work does each one need?
- How much do the CISA and CRISC cost over three years?
- What does it take to keep each one active?
- CRISC vs CISA difficulty: which exam is harder?
- CRISC vs CISA certification: which should you take first?
- Should you start with Security+ instead?
- Can passing the CISA or CRISC exam get you a first job?
- What we did not check
- Sources
Which one fits your situation?
- No security, risk or audit job yet: you can take either exam, but ISACA grants neither title until you have the work. Your first step: pick one entry-level job title from our cybersecurity roadmap, read ten ads for it near you and note the certifications they name. If those ads name CompTIA Security+, CompTIA's entry-level security exam, that exam is a common first step, and a first job comes before either ISACA title.
- Working in IT audit or internal audit: take the CISA. Its five domains describe audit work, and ISACA counts audit, control and security years toward it.
- Working in IT risk or internal control (the checks a company runs on its own processes): take the CRISC. It also suits GRC staff (governance, risk and compliance: people who write policy, rate risks and check that rules are met). It needs three years of work, with no waiver.
- Holding a master's degree in information systems: the CISA waiver for that degree covers three years, so two years of audit, control or security work can qualify you. The CRISC still needs three years of risk and control work.
- Already certified in one of them: adding the other means a second exam and a second yearly fee, while one set of education hours can serve both (details under keeping each one active).
CRISC vs CISA: what job ads mention
We count job ads with a security-analyst title and check how many contain each search phrase anywhere in the text. The two columns use different phrases. CISA was searched by its spelled-out title, so ads that write only CISA are missed and its count is a lower bound (the true number is at least this high). CRISC was searched as a bare acronym, so ads that spell out its title are missed too. The columns are therefore not comparable, and we do not rank them.
| Country | Security-analyst ads | Spelled-out title Certified Information Systems Auditor | Acronym CRISC |
|---|---|---|---|
| United States | 8,110 | 3 | 31 |
| United Kingdom | 235 | 2 | 1 |
| India | 250 | 2 | 15 |
| Brazil | 434 | 0 | 0 |
Source: Adzuna API job ads with a security-analyst title, October 2026; in Brazil the title searched was analista de segurança. Analysis: CertWorthIt (method).
The UK and Indian security-analyst counts above are a rough picture, not a measure: the samples are small, so one posting more or less moves them visibly. In Brazilian security-analyst ads on Adzuna in October 2026, the spelled-out CISA title appeared in none of the 434 ads and the acronym CRISC in none of the 434 ads; Brazilian ads may use Portuguese wording, so English phrases can undercount there. For Mexico, Spain and Italy the sample was too small to report a figure.
Only analyst titles are in this count; the gaps are listed under what we did not check. Our cybersecurity-analyst page shows which certifications analyst ads name in each country.
Show the numbers
| Item | Ads | Share of ads |
|---|---|---|
| SIEM | 415 | 5.1% |
| CISSP | 338 | 4.2% |
| CompTIA | 162 | 2.0% |
| CISM | 134 | 1.7% |
| CompTIA CySA+ | 119 | 1.5% |
| CompTIA Security+ | 112 | 1.4% |
| Splunk | 100 | 1.2% |
| CEH | 81 | 81 of 8,110 |
| CRISC | 31 | 31 of 8,110 |
| CISA | 3 | 3 of 8,110 |
What does each exam test?
An auditor's exam and a risk manager's exam: the CISA covers auditing information systems, and the CRISC covers judging IT risk and choosing the controls that reduce it.
| CISA domain | Weight | CRISC domain | Weight |
|---|---|---|---|
| Information Systems Auditing Process | 18% | Governance | 26% |
| Governance and Management of IT | 18% | Risk Assessment | 22% |
| Information Systems Acquisition, Development and Implementation | 12% | Risk Response and Reporting | 32% |
| Information Systems Operations and Business Resilience | 26% | Technology and Security | 20% |
| Protection of Information Assets | 26% |
Source: exam content outlines published by ISACA for the CISA and the CRISC.
Business resilience is the ability to keep systems running through outages and disasters. Information assets are the data and systems an organization has to protect. Risk response is the decision on what to do about a risk (reduce it with a control, accept it, or another option) and the report of that decision to management.
The outlines overlap in governance and in security controls. The CISA auditor asks whether controls exist and work, and reports findings (the problems an audit records). The CRISC holder decides which risks need controls in the first place and tracks them, with Risk Assessment plus Risk Response and Reporting taking 54% of that exam.
The CISA outline in use took effect in 2024, according to ISACA's candidate guide, and the CRISC outline in 2025. Neither outline page we read on October 12, 2026, announced a later change.
Show the numbers
| Item | CISA | CRISC |
|---|---|---|
| Questions | 150 questions | 150 questions |
| Exam time | 240 minutes (4 h) | 240 minutes (4 h) |
| Passing score | 450 (scale 200–800) | 450 of 800 |
How many years of work does each one need?
Three years for the CRISC and five for the CISA, counted within the decade before your application. Either exam can come first; after passing, you get five years to send ISACA your application (the proof of your work experience).
CISA: five years, up to three waived
ISACA's "Get CISA certified" page asks for a minimum of five years of professional information systems auditing, control or security work. Its candidate guide caps waivers at three years, and ISACA's CISA requirements article lists the options. Waivers together cover no more than three years:
- 1 year: an associate degree (a two-year college degree), ISACA's IT Audit Fundamentals certificate or the CCAK (a cloud-audit certificate).
- 2 years: a bachelor's, master's or doctorate degree in any field, or a CIMA or ACCA qualification (from two UK-based accounting bodies).
- 3 years: a master's degree in information systems or a related field.
CRISC: three years, no waivers
The candidate guide sets the CRISC rule at three or more years in IT risk management and IS control, and it rules out any waiver or substitution. ISACA's "Get CRISC certified" page adds that the work must cover at least two of the four CRISC domains. That page's body text words the work differently; we follow the candidate guide.
Does holding one cut the experience needed for the other?
No, on the ISACA pages we read. A CISA holder still needs the full three years for the CRISC. The CISA waiver list names degrees, two audit certificates and two accounting qualifications, and the CRISC is not among them.
How much do the CISA and CRISC cost over three years?
ISACA's fees are the same for both. Assuming a first-try pass and three yearly maintenance fees, one for each year of the first cycle, either credential costs a non-member $1,065 over three years and a member $1,195 once three years of dues are counted. Dues assume $145 in each of the three years; we did not check the renewal price.
| Path over three years | Exam | Application fee | Maintenance fees | Membership dues | Total |
|---|---|---|---|---|---|
| One credential, non-member | $760 | $50 | $255 (3 years at $85) | none | $1,065 |
| One credential, member | $575 | $50 | $135 (3 years at $45) | $435 (3 years at $145) | $1,195 |
| Both, non-member | $1,520 (two exams at $760) | $100 (two at $50) | $510 (two fees for 3 years at $85) | none | $2,130 |
| Both, member | $1,150 (two exams at $575) | $100 (two at $50) | $270 (two fees for 3 years at $45) | $435 (3 years at $145) | $1,955 |
Source: ISACA fee, maintenance and membership pages and the exam candidate guide (version 1.26).
On one credential, joining ISACA does not pay off. The dues total $435 over three years, while member pricing knocks $185 off the exam and $40 a year off the maintenance fee, $305 in all. With two credentials the member savings reach $610, which puts the member route at $1,955 and the non-member route at $2,130, $175 apart. Local chapter dues (fees for ISACA's regional branches), courses and books are outside every total.
Every failed attempt costs the full registration fee again. ISACA's candidate guide permits four tries in any rolling 12 months, spaced at least 30, 90 and 90 days apart. You have six months from registration to take the exam, and ISACA sells one six-month extension for $75.
Show the numbers
| Item | Fee |
|---|---|
| CISA: Fees to get certified: Exam | $760 |
| CISA: Fees to get certified: Annual fee, $85 a year × 3 years | $255 |
| CRISC: Fees to get certified: Exam | $760 |
| CRISC: Fees to get certified: Annual fee, $85 a year × 3 years | $255 |
What does it take to keep each one active?
Both follow one rule: 120 hours of continuing professional education (CPE: logged learning such as courses, webinars and conferences) per three-year cycle, at least 20 of them each year, plus the yearly maintenance fee. ISACA audits a random sample of holders' reported hours each year.
A holder of both pays two yearly fees, $170 without membership or $90 with it. The reduced fee ($50 for non-members, $25 for members) starts only at a person's third ISACA credential, so each of the pair is billed at the normal rate. The CPE hours need not double: ISACA's CRISC maintenance page says one hour can count toward several ISACA credentials when the activity fits the job knowledge of each, so a course on IT controls could serve both.
CRISC vs CISA difficulty: which exam is harder?
The harder exam is the one further from your daily work, because ISACA publishes no pass rate for either on the pages we read. The formats match: 150 multiple-choice questions in four hours, taken at a test center run by PSI (the testing company ISACA uses) or remotely with a proctor (an exam supervisor who watches over webcam). Both need 450 on ISACA's scaled score, a range of 200 to 800 that is not a percentage of correct answers.
In our reading, the exam further from your daily work is the harder one. An auditor meets the CISA's auditing-process domain as familiar ground. A risk analyst meets the CRISC's Risk Response and Reporting domain, 32% of that exam, the same way. A beginner has no job to draw on for either, and no source we read ranks the two for a beginner, so start with the first step under your situation.
CRISC vs CISA certification: which should you take first?
Your current job sets the order. Take the CISA first if you test controls and write audit reports, and the CRISC first if you rate risks and decide on responses. On the ISACA pages we read, neither credential is listed as counting toward the other's experience rule, so taking one first gives no shortcut on paper.
If you plan to hold both, the CRISC's three years are the shorter rule for someone without a degree waiver, and the CISA's can be as short as two years with a master's degree in information systems. Both rules name control work, so some years could fit both; we found no ISACA statement on counting the same years twice. Once you hold both, one CPE hour can serve the two, as described under keeping each one active.
ISACA's third credential in this group is the CISM (Certified Information Security Manager, for people who run a security program). Our CISA vs CISM and CISM vs CRISC comparisons cover it.
Should you start with Security+ instead?
Yes, if you have no security, risk or audit job and the ads you read name it; if they do not, start with the entry-level job step in the situation list. A poster aiming at governance, risk and compliance work asked whether to go straight for the CISA or the CRISC or begin with a foundational certification such as Security+ (r/SecurityCareerAdvice). ISACA grants the CRISC after three years of work and the CISA after five, fewer with a CISA waiver, while Security+ is CompTIA's entry-level security exam; our Security+ page covers what it asks for.
Can passing the CISA or CRISC exam get you a first job?
Not by itself: no source we read says either exam alone gets you a first job. Two posters asked versions of this: a student planning to apply for junior roles with the CISA as a differentiator (r/SecurityCareerAdvice), and someone asking about their chances after passing (r/ITCareerQuestions).
Passing makes you a candidate, not a holder: ISACA grants the title only once your experience is verified. Read ten junior IT-audit or GRC-analyst ads near you; if they ask for experience you lack, an entry job in IT audit, IT support or security builds the years both credentials need. Someone weighing the CISSP (a senior-level security certification) while CISA material is fresh will find that pairing in our CISA vs CISSP comparison, and our guide to certifications worth getting gives the wider view.
What we did not check
- Other job titles. IT-audit, IT-risk and GRC ads, where ISACA aims both credentials, are outside our count, so the figures measure the two away from their main market.
- Ads that write only CISA. See the job-ads section above.
- Salary. We found no dated source comparing pay for CISA and CRISC holders; both need years of work first, so any pay gap would mix seniority with the credential.
- Pass rates and study time. No ISACA page we read states a pass rate. Study-time statements for either credential were too few in the Reddit posts we collected to report a figure.
- Counting the same years toward both experience rules, and whether ISACA gives CISA holders any credit toward the CRISC.
- The month the CRISC outline took effect in 2025, ISACA membership renewal prices and local chapter dues.
Sources
We read the ISACA pages between October 7 and October 12, 2026. On October 12, 2026, we re-read the CISA page, the "Get CISA certified" page and both exam content outlines; the maintenance and membership pages were read on October 11, 2026, and the CISA requirements article on October 8, 2026.
- ISACA credential pages: CISA overview, Get CISA certified, CISA content outline, CRISC overview, Get CRISC certified, CRISC content outline and Maintain CRISC certification.
- ISACA rules and fees: exam candidate guide, version 1.26, CISA requirements support article and membership page.
- Job ads: security-analyst ads from the Adzuna API for October 2026, analyzed by CertWorthIt (method).
- Reddit: posts from r/SecurityCareerAdvice and r/ITCareerQuestions, linked where cited; no usernames.
Questions people ask
Is the CISA or the CRISC harder?
ISACA publishes no pass rate for either exam on the pages we read, so no official figure answers this. The CISA (Certified Information Systems Auditor) and the CRISC (Certified in Risk and Information Systems Control) use one format: 150 multiple-choice questions in four hours. Each needs a passing score of 450 on a scaled range of 200 to 800, which is not a percentage of right answers. In our reading, the harder exam is the one further from your job. The CISA tests auditing information systems across five domains (exam topic areas); the CRISC tests managing IT risk across four.
Which needs less experience, the CISA or the CRISC?
On paper the CRISC (Certified in Risk and Information Systems Control) asks for three years of IT risk management and information systems control work, with no waivers (a degree or credential accepted in place of work). The CISA (Certified Information Systems Auditor) asks for five years of information systems audit, control or security work, but waivers can replace up to three of them. With a master's degree in information systems, two years of work can be enough for the CISA. For both, the years must fall within the ten years before you apply.
Can you hold both the CISA and the CRISC?
Yes. The maintenance page of ISACA, the IT audit and risk association, sets fees for people who hold several of its credentials, and we found no rule against this pair. Holding both the CISA and the CRISC means two yearly maintenance fees: $85 each without ISACA membership or $45 each with it, so $170 or $90 a year. Each credential needs 120 hours of continuing professional education (CPE: logged learning such as courses and webinars) per three years, and ISACA's CRISC maintenance page says one hour can count toward several ISACA credentials when the activity fits each one.
How much do the CISA and CRISC cost over three years?
ISACA, the IT audit and risk association, charges the same fees for the CISA and the CRISC. With a first-try pass, either one costs a non-member $1,065 over three years: $760 for the exam, a one-time $50 application fee after passing and three yearly maintenance fees of $85. A member pays $575 plus $50 plus three fees of $45, for $760, or $1,195 once three years of ISACA membership dues at $145 a year are added (member prices need paid membership). Both credentials together cost a non-member $2,130. Each failed attempt costs the full exam fee again.
Can a beginner take the CISA or the CRISC exam?
Yes, a beginner can register for either exam from ISACA, the IT audit and risk association, but ISACA grants the title only after the work experience is proven, and you have five years after passing to apply. The CRISC needs three years of IT risk and control work with no waivers. The CISA needs five years of audit, control or security work, and a degree can replace up to three of them. In our reading, a person with no security, risk or audit job may start with an entry-level security exam such as CompTIA Security+, if job ads name it, and a first job in the field.
How often do US security-analyst job ads name the CISA and the CRISC?
In October 2026, the spelled-out title Certified Information Systems Auditor appeared in 3 of the 8,110 US security-analyst ads we counted on Adzuna, a job-ad search site, and the acronym CRISC in 31. We searched the CISA by its full title and the CRISC by its acronym, so the two counts do not rank the credentials. The CISA count is a lower bound (the true number is at least that high) because ads that write only CISA are missed. IT-audit and IT-risk ads, where ISACA aims both credentials, were not part of the count.