De CRISC training en het examen bestaan uit onderstaande vier ‘job practice area’s’. ISACA toetst de invulling ervan continu aan de actualiteit zodat de training aan blijft sluiten op het hedendaagse profiel van de Risk Professional:

1. Risk Identification (27%)
Identify the universe of IT risk to contribute to the execution of the IT risk management strategy in support of business objectives and in alignment with the enterprise risk management (ERM) strategy.

2. Risk Assessment (28%)
Analyze and evaluate IT risk to determine the likelihood and impact on business objectives to enable risk-based decision making.

3. Risk Response and Mitigation (23%)
Determine risk response options and evaluate their efficiency and effectiveness to manage risk in alignment with business objectives.
4. Risk and Control Monitoring and Reporting (22%)
Continuously monitor and report on IT risk and controls to relevant stakeholders to ensure the continued efficiency and effectiveness of the IT risk management strategy and its alignment to business objectives.