Yes, the Certified in Risk and Information Systems Control (CRISC) certification expires every 3 years. Like all ISACA certifications, CRISC requires 120 CPE hours per certification cycle, a minimum of 20 CPE hours annually, and payment of the annual maintenance fee. IT risk professionals must plan their continuing education throughout each cycle to keep their credential active.
CRISC covers four domains: IT Risk Identification, IT Risk Assessment, Risk Response and Reporting, and Information Technology and Security. As enterprise risk management practices evolve with new technologies, regulatory changes, and emerging threats, ISACA requires CRISC holders to demonstrate ongoing professional development in these areas.
CPE activities must relate to IT risk management, information security, governance, or related disciplines. ISACA provides flexibility in how you earn CPE hours, accepting everything from formal training courses to self-study, teaching, publishing, and professional contributions. Each CPE hour must be documented and is subject to potential audit by ISACA.
The 20-hour annual minimum ensures consistent engagement with professional development. Most IT risk professionals exceed this through their regular work activities—attending risk committee meetings, participating in framework implementations, and staying current with regulatory changes can all generate CPE-eligible activities.
| Certification | Cycle | CE Required | Annual Fee |
|---|---|---|---|
| CRISC | 3 years | 120 CPE hours | $85 |
| CISM | 3 years | 120 CPE hours | $85 |
| CISSP | 3 years | 120 CPE credits | $125 |
| CompTIA Security+ | 3 years | 50 CEUs | $50/yr |
If you don't meet CPE or fee requirements, ISACA revokes your CRISC certification. You cannot use the CRISC designation professionally until you either reinstate (within a limited ISACA-defined window) or retake and pass the full exam. The CRISC exam consists of 150 questions over 4 hours with a passing score of 450 out of 800.
Recertification also requires meeting the work experience requirement again—a minimum of 3 years in IT risk management and IS control, with at least 1 year in two of the four CRISC domains. Maintaining through CPEs is significantly easier than starting over.
If you hold multiple ISACA certifications, strategically choose CPE activities that qualify for several credentials simultaneously. Risk management conferences and GRC training often count toward CRISC, CISM, and CISA. Document each activity thoroughly, noting which domains it covers and retaining certificates of completion.
Consider joining your local ISACA chapter. Chapter meetings typically offer 1-2 CPE hours per event, and most chapters host monthly events. Over a year, regular attendance alone can generate 12-24 CPE hours while also expanding your professional network in the GRC community.
Yes, CRISC expires every 3 years. Renewal requires 120 CPE hours (20/year minimum) and the $85 annual maintenance fee for ISACA members ($185 for non-members).
120 CPE hours over 3 years, minimum 20 per year. Activities must relate to IT risk management, governance, or information security.
You lose the CRISC designation. ISACA may allow a limited reinstatement window. After that, you must retake the 150-question exam and meet experience requirements.
Self-study with practice questions counts toward your CPE hours.
Start Free CRISC Practice Test →