You answer question 150, submit, and walk out of the testing room with the result you've been working toward for months. By the time you reach the car park, you're mentally updating your email signature.
Hold that edit for a few weeks. Passing makes you eligible to apply for CRISC. The CRISC endorsement process, which ISACA calls the application for certification, is what turns that result into the credential, and it comes with its own fee, its own paperwork, and its own deadline.
None of it is difficult. Most of the work is describing experience you already have in a form ISACA can check, then lining up the person who'll confirm it. The catch is time. A five-year window feels endless the week you pass. Two job changes and a manager who's moved to another company later, it starts to feel a lot shorter.
What Is the CRISC Endorsement Process?
The CRISC endorsement process is ISACA's application for certification. After you pass the exam, you pay a one-time US$50 processing fee, submit an application describing at least three years of qualifying work experience, and have a supervisor or manager verify that experience. ISACA reviews the application and grants the certification.
"Endorsement" is borrowed vocabulary, and ISACA's own pages never use it. On a CRISC application, the person who matters is whoever supervised the work you're claiming.
Part | What it involves | Who does it |
|---|---|---|
Fee | One-time US$50 application processing fee, paid once official scores are released | You, in your MyISACA account |
Application | Three or more years of CRISC work experience across at least two of the four domains, gained in the 10 years before you apply | You |
Verification | Confirmation that the experience you describe is accurate | Your supervisor or manager |
Decision | Review of the application and grant of the certification | ISACA |
Whether your experience qualifies in the first place is a separate question, covered in what the CRISC requirements are. For the exam and the four domains themselves, start with the CRISC certification guide.
Looking for some exam prep guidance and mentoring?
Learn about our personal mentoring
The CRISC Certification Process After the Exam, Step by Step
The CRISC certification process after the exam has six steps, and only two of them take real effort: writing up your experience and getting it verified. Everything else is a form, a payment, or a wait.
Step | What happens | Effort | Watch for |
|---|---|---|---|
1. Official result | ISACA sends your results and, if you passed, the details you need to apply | None | The fee can't be paid until official scores are out |
2. Pay the fee | US$50, one time, through MyISACA | Minutes | It's separate from the exam fee you've already paid |
3. Describe your experience | Write each role in terms of ISACA's task statements | A few hours | A pasted job description rarely shows the risk work |
4. Verification | A supervisor or manager confirms each role | Depends on them | Former managers who've moved on |
5. Submit | Online application, within five years of passing | Minutes | The 10-year lookback on experience |
6. Approval | ISACA grants the certification | Waiting | Maintenance obligations start here |
Most of what happens with CRISC after the exam can start before your official result arrives. Steps 3 and 4 don't depend on the score, so there's no reason to wait on them.
Step 1: Wait for Your Official CRISC Exam Result
ISACA sends your results after the exam and, if you passed, the details you need to apply for certification. Its instructions tie the application fee to official scores: you can pay it once they've been released.
Use the wait. Start drafting Step 3 while the job practice areas are still fresh from studying. If you're curious how your result was calculated, the CRISC passing score explained walks through the scaling.
Step 2: Pay the US$50 Application Processing Fee
The CRISC application processing fee is a one-time US$50 payment, made through your MyISACA account after your official scores are released. It's separate from the exam registration fee you paid before sitting the exam, and from the annual maintenance fee that starts once you're certified.
Pay it before you submit. It's the shortest step in the process, and the one people most often leave for last.
Step 3: Describe Your Experience in CRISC Task-Statement Language
The strongest CRISC application describes each role in the language of ISACA's 24 supporting task statements and names the domains the work falls under. ISACA is checking your experience against the CRISC job practice, so the closer your write-up sits to that job practice, the less anyone has to guess.
Most people paste in their job description. Job descriptions are written to recruit, so they list tools, teams, and systems: "administered the IAM platform," "supported SOX testing." A verifier reading that has to work out which part was risk work, and so does ISACA.
Here's the rewrite in practice, using three common duties and the task numbers from ISACA's CRISC exam content outline:
Duty as usually written | Rewritten in task-statement terms | Task statements | Domain |
|---|---|---|---|
Ran quarterly user access reviews for the finance ERP | Evaluated the effectiveness of access controls over the finance ERP each quarter, reviewed the results with control owners, and tracked remediation of stale accounts | 10, 14, 19 | 3 (Risk Response and Reporting) |
Maintained the IT risk register | Maintained the IT risk register, incorporated it into the enterprise risk profile, and reported the highest-rated risks to the steering committee monthly | 6, 21 | 2 (Risk Assessment) and 3 |
Reviewed vendor security questionnaires | Assessed the risk of new SaaS vendors before contract signature and recommended treatment where the risk exceeded tolerance | 9, 11 | 2 and 3 |
Take the first row. "Ran access reviews" describes a task. The rewrite describes what the task was for. Task 10 asks you to identify the current state of existing controls and evaluate their effectiveness, which is what a quarterly access review does. Task 19 covers reviewing the results of control assessments, which is the conversation with the people who own the accounts. Task 14 is collaboration with control owners on maintaining controls, which is chasing the stale accounts down. Same quarter of work, now readable by someone who wasn't there. And because control testing and vendor risk both sit in Domain 3 while the risk register sits in Domain 2, the three rows together clear the two-domain minimum on their own.
Read down the right-hand columns of ISACA's task list and a pattern shows up. The verbs are about ownership, appetite and tolerance, and reporting to stakeholders so they can make risk-based decisions. Very few are about configuring anything. That's the same lens the exam grades on: CRISC tests business judgment, and strong technical instincts often pick the wrong answer. If your write-up reads like a change log, that's a hint about how you approached the exam questions too, and it's worth understanding how CRISC exam questions reward business-first reasoning before your next certification.
If you need plain vocabulary to sort your duties before matching them to task numbers, NIST SP 800-39 on managing information security risk frames the work as assessing, responding to, and monitoring risk. Sorting each duty into one of those buckets first makes the task numbers much quicker to find.
Step 4: Get Your Experience Verified by a Supervisor or Manager
ISACA requires your CRISC experience to be verified by a supervisor or manager. Every role you list needs someone in that position who can confirm what you did and when you did it.
Picture it from their side. You message a manager you reported to three years and two reorganizations ago and ask them to confirm your experience for CRISC. They remember you were good. They don't remember whether you ran the vendor assessments or sat in on them. A careful manager won't sign off on detail they can't recall, and a vague confirmation helps nobody.
So make it easy before you ask:
- Ask first, in a sentence or two. Tell them what CRISC is, what you're asking them to confirm, and roughly when the request will reach them.
- Send a one-page summary. Your title, the dates you reported to them, and the rewritten duties from Step 3 for that role. They're confirming your description, so give them the description.
- Line up verifiers for every role. If your three years span two employers, you'll need someone from each.
If a former manager can't be reached, ISACA's public certification pages don't spell out what happens next. Contact ISACA support before you submit and get their answer in writing, rather than guessing at a substitute.
Step 5: Submit the Application Within Five Years of Passing
ISACA requires you to submit your CRISC application within five years of the date you passed the exam. The experience you claim has to fall within the 10 years before your application date. Applications are submitted online, and non-English application forms are available for candidates who passed from August 2021 onward.
The two windows interact. Say you pass in November 2026 with 18 months of qualifying experience. You'd reach three years around May 2028, and you'd have until November 2031 to apply. That's plenty of room, with one trap: every year you wait, the 10-year lookback moves forward, and your oldest roles get closer to dropping out of it.
The generous window is also why sitting the exam before your third year of experience is a reasonable plan. The exam is the part with an uncertain outcome. The application is a form with a long deadline. Pass while the material is fresh, then apply when the experience catches up. If you're still early in a risk career, CRISC for beginners covers how people build toward it, and a focused CRISC study plan covers the exam side.
Step 6: ISACA Reviews Your Application and Grants CRISC
Once ISACA approves your application, you're CRISC certified. ISACA's CRISC pages don't publish a fixed review time, so plan around a wait rather than a date.
From approval, you can put CRISC after your name. ISACA doesn't let individuals use the CRISC logo on business cards, websites, or marketing material, so the acronym is the way to show it. Approval also starts your maintenance obligations: annual CPE hours and an annual maintenance fee, which the CRISC requirements guide covers in detail.
If you're already thinking about what comes after CRISC, the CRISC and CISM combination is where a lot of risk professionals look next.
Certification in 1 Week
Study everything you need to know for the CISSP exam in a 1-week bootcamp!
Frequently Asked Questions
The CRISC application processing fee is a one-time US$50, paid through your MyISACA account after your official exam scores are released. It's separate from the exam registration fee and from the annual maintenance fee that applies once you're certified.
You have five years from the date you pass the CRISC exam to submit your application for certification. The experience you claim must have been gained within the 10 years before your application date, so roles from early in your career can age out if you wait too long.
ISACA requires a supervisor or manager to verify your CRISC work experience. Each role you list in the application needs a verifier who supervised that work. If a former manager can't be reached, contact ISACA support before submitting and confirm what they'll accept.
You can put CRISC after your name once ISACA approves your application and grants the certification. Passing the exam makes you eligible to apply, and the credential follows approval. After that, ISACA permits the acronym after your name but doesn't allow individuals to use the CRISC logo.
Before Any of This: Pass CRISC on Your First Attempt
Every step above starts with an email that says you passed. The free CRISC Exam Strategy Guide is built for getting that email: a two- or three-pass approach for working through 150 questions in four hours, and a way to pick the answer that serves enterprise risk and business objectives when the technically tidy option is sitting right next to it. It's a small slice of the exam strategy our students get in the full course, and a useful one on its own.
The DestCert CRISC Bootcamp is the fastest way through the exam. It's taught live on Zoom by Kelly Handerhan, the instructor behind "Why you WILL pass the CISSP," who holds CRISC alongside CISA, CISM, CISSP, and CCSP, with more than 20 years in IT and cybersecurity and over a decade managing IT projects.
You ask your questions as they come up, take knowledge assessments at the end of each day, and leave with full CRISC MasterClass access so your review after the Bootcamp goes straight to your weak spots. Our students have a 93.6% first-attempt pass rate, and nearly 100% of those who need a second attempt pass on that one.
John is a major force behind the Destination Certification CISSP program's success, with over 25 years of global cybersecurity experience. He simplifies complex topics, and he utilizes innovative teaching methods that contribute to the program's industry-high exam success rates. As a leading Information Security professional in Canada, John co-authored a bestselling CISSP exam preparation guide and helped develop official CISSP curriculum materials. You can reach out to John on LinkedIn.
