CRISC Exam Results and Retake Rules

When you receive a CRISC result

At the conclusion of the exam, candidates receive a preliminary pass or fail status. The official score report follows through the email address in your ISACA profile and MyISACA under Certifications and CPE Management. The 2026 Candidate Guide says official results are generally available within 10 working days. Keep contact information current and check both email and the account if the notice is not visible.

The official score is scaled from 200 to 800, with 450 or higher passing. It is not a raw percentage correct. ISACA does not provide question-level results. Domain feedback can guide review, but it does not tell you exactly which item you missed and it is not a separate score threshold for each area.

Retake limits and waiting periods

The 2026 Candidate Guide allows four attempts within a rolling 12-month period. After an unsuccessful first attempt, wait at least 30 days before the second. After an unsuccessful second attempt, wait 90 days before the third. After a third failure, wait 90 days before the fourth. The rolling period is tied to the first attempt, not a reset on January 1.

A retake is a new registration at the full member or nonmember rate. Plan both the waiting interval and appointment availability. The failed score report may arrive after the date you would like to test again; the interval is measured from the exam attempt, while registration and scheduling remain separate steps. Confirm the earliest available date in your ISACA account and the provider scheduler.

Candidates who pass cannot take the same exam during the five-year application period. A certified CRISC holder is restricted from retaking the same exam while they hold the credential. Passing should lead to the certification application or, for someone not yet experience-qualified, a plan to complete the experience requirement before the five-year window ends.

Use domain feedback after a failed attempt

Start with the official score report, then compare its domain information with your practice log. Identify whether the challenge was one or more content areas, or a decision pattern that crossed domains. A low Technology and Security indicator might reflect unfamiliar architecture topics, but it could also be a broader difficulty applying risk to technology choices. The domain label is a starting point for investigation.

1. Record what happened during the exam: time pressure, fatigue, interface issues, or repeated uncertainty.
2. Map domain feedback to the current 2025 CRISC outline and the tasks within the domain.
3. Review missed practice questions and label the cause: knowledge gap, wrong owner, premature control, weak assessment, or misread qualifier.
4. Choose a focused resource or study activity that addresses the cause, not just the domain name.
5. Practise new mixed scenarios and explain why each alternative is weaker.
6. Schedule after the mandatory wait, when you are ready and a suitable appointment is available.

A practical 30-day retake cycle could devote the first few days to reviewing the report and error pattern, the next two weeks to targeted learning and fresh scenarios, and the final period to timed mixed practice and logistics. This is an example, not a required or guaranteed timeline. A candidate with broader gaps may need longer, and should not retake simply because the minimum waiting period has elapsed.

Requesting a rescore

A candidate who fails may submit a written rescore request through ISACA support within 30 days after official result release. The 2026 guide lists a US$75 fee and says PSI performs the rescore. Because ISACA does not issue question-level results, the rescore is not a chance to review individual answers or argue about a particular question's difficulty.

If you experienced a testing administration issue, the candidate guide describes a separate way to report it. Record what happened, when it happened, the proctor interaction, and any impact on your exam. Submit through the official channel and within the policy deadline. A concern about exam delivery is different from disagreeing with the content of an item.

Example retake timelines

Attempt one on October 8

A candidate does not pass on October 8. Under the minimum 30-day interval, the second attempt cannot occur before the waiting period has elapsed. This is not an appointment reservation. The candidate must register again, pay the full applicable fee, and find an available provider slot within the new eligibility period.

Attempt two on November 15

If the candidate sits again on November 15 and does not pass, the next minimum waiting period is 90 days after the second attempt. The official result may arrive later, but the policy's interval is tied to the exam date. Check the account for registration status and available appointments before choosing a new study calendar.

These dates demonstrate the intervals only. The account and current Candidate Guide control the actual scheduling conditions, six-month eligibility window, extension, and appointment change rules. If registration eligibility is near expiry, the candidate must also consider whether an extension is available.

After a pass

A pass is an exam result, not the CRISC designation. If you already have three years of qualifying professional work across at least two domains, prepare the verified experience application and pay the one-time US$50 fee. If you do not yet meet the requirement, track the pass date and continue gaining experience. You must apply within five years, and experience must be within the ten years before applying.

• Do not treat 450 as a raw percentage or question count.
• Do not expect question-level feedback; ISACA does not provide it.
• Respect the 30- and 90-day retake intervals and four-attempt rolling limit.
• Budget the full exam price for every retake.
• Use domain feedback with task statements and practice evidence to focus review.
• After passing, track the certification experience application separately from the exam result.

Use a failed report to choose a narrower study target A result report is a decision point. If the candidate passed, the relevant next step is certification, which requires the experience application and fee. If the candidate did not pass, the report's broad domain feedback can help set a revision priority. It does not reveal the exact questions missed, so trying to reconstruct items from memory is both unreliable and a poor use of study time. Translate one lower-performing domain into behaviors. If Governance needs attention, practise matching risk authority to the correct owner and distinguishing oversight from implementation. If Risk Assessment is weak, practise defining a scenario before estimating its likelihood and impact. If Risk Response and Reporting needs work, compare treatment options and ask what evidence a decision maker needs. If Technology and Security is weak, connect safeguards to the risk they reduce rather than memorizing product names. Keep a small error log with four columns: scenario clue, decision asked for, concept involved, and why the chosen distractor was attractive. This focuses review on reasoning rather than item recall. After learning the concept, solve a new example. If the same mistake reappears, change the study method before buying another attempt. A retake calendar with study time built in Suppose attempt one occurs on October 8. A 30-day wait is a minimum interval. It does not require the candidate to sit exactly on the first eligible date. The candidate can use the interval to review domain feedback, revisit the relevant outline tasks, and practise fresh questions. Registration, full payment and provider appointment availability are separate requirements. If the second appointment is November 15 and the candidate fails again, the next minimum interval is 90 days from that attempt. The score report may arrive later, but it does not change the date on which the waiting period is measured. The candidate should plan around the appointment date, then verify the available registration and calendar in the account before selecting a new time. A practical retake plan has a readiness gate. Before booking, the candidate should be able to explain the risk decision chain, finish a representative timed set, and support choices with facts in the stem. A candidate who only repeats a memorized bank may see a higher score on familiar items without improving transfer. Mix topics and vary the scenario so the next attempt tests understanding. Protect the registration window and budget as well. Each attempt uses a new full-fee registration. An eligible extension adds time to sit under a registration, not an additional sitting. A retake must fit its own registration and appointment rules. Save payment and appointment confirmations, and keep the new study schedule separate from the official waiting interval so neither is mistaken for the other. After a pass, follow through promptly. The exam result does not automatically complete certification. Confirm the experience requirements, application deadline, and application fee. If the candidate is not yet eligible, retain the score and application timeline details rather than assuming passing alone grants the designation.

Use a failed report to choose a narrower study target A result report is a decision point. If the candidate passed, the relevant next step is certification, which requires the experience application and fee. If the candidate did not pass, the report's broad domain feedback can help set a revision priority. It does not reveal the exact questions missed, so trying to reconstruct items from memory is both unreliable and a poor use of study time. Translate one lower-performing domain into behaviors. If Governance needs attention, practise matching risk authority to the correct owner and distinguishing oversight from implementation. If Risk Assessment is weak, practise defining a scenario before estimating its likelihood and impact. If Risk Response and Reporting needs work, compare treatment options and ask what evidence a decision maker needs. If Technology and Security is weak, connect safeguards to the risk they reduce rather than memorizing product names. Keep a small error log with four columns: scenario clue, decision asked for, concept involved, and why the chosen distractor was attractive. This focuses review on reasoning rather than item recall. After learning the concept, solve a new example. If the same mistake reappears, change the study method before buying another attempt. A retake calendar with study time built in Suppose attempt one occurs on October 8. A 30-day wait is a minimum interval. It does not require the candidate to sit exactly on the first eligible date. The candidate can use the interval to review domain feedback, revisit the relevant outline tasks, and practise fresh questions. Registration, full payment and provider appointment availability are separate requirements. If the second appointment is November 15 and the candidate fails again, the next minimum interval is 90 days from that attempt. The score report may arrive later, but it does not change the date on which the waiting period is measured. The candidate should plan around the appointment date, then verify the available registration and calendar in the account before selecting a new time. A practical retake plan has a readiness gate. Before booking, the candidate should be able to explain the risk decision chain, finish a representative timed set, and support choices with facts in the stem. A candidate who only repeats a memorized bank may see a higher score on familiar items without improving transfer. Mix topics and vary the scenario so the next attempt tests understanding. Protect the registration window and budget as well. Each attempt uses a new full-fee registration. An eligible extension adds time to sit under a registration, not an additional sitting. A retake must fit its own registration and appointment rules. Save payment and appointment confirmations, and keep the new study schedule separate from the official waiting interval so neither is mistaken for the other. After a pass, follow through promptly. The exam result does not automatically complete certification. Confirm the experience requirements, application deadline, and application fee. If the candidate is not yet eligible, retain the score and application timeline details rather than assuming passing alone grants the designation.