CRISC® (Certified in Risk and Information Systems Control) Exam Preparation Bootcamp
Tingkatkan Keahlian IT Risk Management dan Peluang Lulus Sertifikasi CRISC Bersama Certified Trainer Berpengalaman
Di era transformasi digital, organisasi menghadapi berbagai risiko yang semakin kompleks akibat ketergantungan terhadap teknologi informasi, data, cloud computing, cybersecurity, third-party services, artificial intelligence, dan berbagai sistem digital lainnya.
Pengelolaan risiko TI tidak lagi hanya menjadi tanggung jawab departemen IT. Organisasi membutuhkan profesional yang mampu mengidentifikasi risiko, melakukan risk assessment, menentukan risk response, merancang dan mengevaluasi controls, serta memastikan bahwa risiko TI dikelola sesuai dengan enterprise objectives, risk appetite, dan risk tolerance.
Certified in Risk and Information Systems Control (CRISC®) dari ISACA merupakan sertifikasi internasional yang berfokus pada kompetensi profesional dalam IT risk management dan information systems controls.
CRISC dirancang untuk para profesional yang bertanggung jawab dalam identifikasi dan pengelolaan risiko, pengembangan dan implementasi controls, risk monitoring, serta pengambilan keputusan berbasis risiko.
Program CRISC Exam Preparation Bootcamp dirancang untuk membantu peserta memahami konsep IT risk management secara menyeluruh, memahami hubungan antara business objectives dan IT risk, menganalisis risk scenarios, menentukan risk treatment yang tepat, memahami control design dan implementation, serta meningkatkan kemampuan menjawab scenario-based examination questions.
Struktur ujian CRISC saat ini mencakup empat domain: Governance, Risk Assessment, Risk Response and Reporting, serta Technology and Security. Bobot masing-masing domain adalah 26%, 22%, 32%, dan 20%.
Mengapa Mengikuti Bootcamp Ini?
- Comprehensive review of all four CRISC exam domains.
- Delivered by Hery Purnama – Certified Trainer.
- More than 15 years of professional experience in IT Governance, IT Risk Management, IT Audit, Information Security and Project Management.
- Exam-oriented learning approach.
- Enterprise and IT risk management perspective.
- Scenario-based discussion and case studies.
- Practice questions with detailed explanations.
- Risk assessment and risk scenario analysis.
- Risk response and treatment analysis.
- Control design and implementation discussion.
- Risk monitoring, metrics and reporting.
- Understanding the ISACA risk management perspective.
- Exam strategies and time management techniques.
- Interactive discussion and question & answer session.
2-Day CRISC® Exam Preparation Bootcamp Syllabus
Program ini mengacu pada CRISC Examination Content Outline Effective 2025 yang diterbitkan oleh ISACA dan mencakup empat domain utama: Governance, Risk Assessment, Risk Response and Reporting, serta Technology and Security.
Day 1
Introduction to CRISC Certification
Understanding CRISC
- Introduction to ISACA
- Understanding the CRISC Certification
- Role of the IT Risk Professional
- CRISC Job Practice Areas
- CRISC Examination Structure
- Exam Question Characteristics
- Enterprise Risk Management Perspective
- IT Risk Management Perspective
- Information Systems Controls
- Business and IT Risk Alignment
- Certification Requirements
- CRISC Exam Preparation Strategy
- How to Approach CRISC Scenario-Based Questions
Understanding the ISACA Risk Mindset
- Business Objectives and Risk
- Risk versus Opportunity
- Risk Ownership
- Control Ownership
- Risk Appetite
- Risk Tolerance
- Inherent Risk
- Residual Risk
- Risk Profile
- Risk Scenarios
- Risk-Based Decision Making
- Risk and Control Alignment
- Risk Monitoring and Reporting
Domain 1 – Governance
26% of the CRISC Examination
Domain 1 berfokus pada governance yang menjadi dasar bagi enterprise risk management, termasuk organizational governance, risk governance, business objectives, roles and responsibilities, policies, risk appetite, risk tolerance, serta regulatory and contractual requirements.
A. Organizational Governance
- Strategy, Goals and Objectives
- Organizational Structure
- Roles and Responsibilities
- Accountability
- Organizational Culture
- Business Ethics
- Policies and Standards
- Business Processes
- Business Resilience
- Disaster Recovery Planning
- Business Continuity Planning
- Organizational Asset Management
- IT and Business Alignment
B. Risk Governance
- Enterprise Risk Management
- Risk Governance
- Lines of Defense
- Risk Profile
- Risk Appetite
- Risk Tolerance
- Risk Frameworks
- Legal Requirements
- Regulatory Requirements
- Contractual Requirements
- Risk Governance Structure
- Risk Ownership
- Control Ownership
- Risk Communication
Practice Session – Domain 1
- Governance Practice Questions
- Enterprise Risk Management Questions
- Risk Appetite and Risk Tolerance Questions
- Lines of Defense Questions
- Risk Profile Questions
- Roles and Responsibilities Questions
- Policy and Standards Questions
- Scenario-Based Governance Questions
Domain 2 – Risk Assessment
22% of the CRISC Examination
Domain 2 berfokus pada kemampuan mengidentifikasi risk events, threats, vulnerabilities, mengembangkan risk scenarios, melakukan risk analysis, memahami BIA, risk register, risk analysis methodologies, serta membedakan inherent dan residual risk.
A. Risk Identification
- Risk Events
- Threat Identification
- Threat Modeling
- Threat Landscape
- Vulnerability Management
- Vulnerability Identification
- Risk Scenario Development
- Risk Scenario Evaluation
- Business Impact
- Information System Risk
- People, Process and Technology Risks
- Emerging Risks
B. Risk Analysis
- Risk Assessment Concepts
- Risk Assessment Standards
- Business Impact Analysis
- Risk Register
- Risk Analysis Methodologies
- Qualitative Risk Analysis
- Quantitative Risk Analysis
- Risk Scoring
- Risk Rating
- Risk Criteria
- Inherent Risk
- Residual Risk
- Current State versus Desired State
- Risk Assessment Documentation
Practice Session – Domain 2
- Risk Identification Questions
- Threat Modeling Questions
- Vulnerability Management Questions
- Risk Scenario Questions
- BIA Questions
- Risk Register Questions
- Risk Analysis Questions
- Inherent and Residual Risk Questions
- Scenario-Based Risk Assessment Questions
Domain 3 – Risk Response and Reporting
32% of the CRISC Examination
Domain 3 merupakan domain dengan bobot terbesar dalam CRISC. Domain ini berfokus pada risk response, risk and control ownership, vendor and supply chain risk, control design and implementation, control testing, risk action plans, risk metrics, monitoring, aggregation, analysis, validation, serta risk reporting.
A. Risk Response
- Risk Response Options
- Risk Avoidance
- Risk Mitigation
- Risk Transfer
- Risk Acceptance
- Risk and Control Ownership
- Risk Treatment
- Risk Action Plans
- Vendor Risk Management
- Supply Chain Risk Management
- Third-Party Risk
- Issues Management
- Findings Management
- Exceptions Management
- Exemptions Management
- Risk Response Validation
B. Control Design and Implementation
- Control Frameworks
- Control Types
- Control Standards
- Preventive Controls
- Detective Controls
- Corrective Controls
- Compensating Controls
- Control Design
- Control Selection
- Control Implementation
- Control Analysis
- Control Objectives
- Control Effectiveness
- Control Testing Methodologies
- Control Assessment
- Control Gaps
- Control Maturity
C. Risk Monitoring and Reporting
- Risk Action Plans
- Risk Monitoring
- Risk Data Collection
- Risk Data Aggregation
- Risk Data Analysis
- Risk Data Validation
- Key Risk Indicators
- Key Control Indicators
- Key Performance Indicators
- Risk and Control Metrics
- Risk Dashboards
- Risk Heatmaps
- Risk Scorecards
- Risk Reporting
- Emerging Risk Monitoring
- Risk Communication to Stakeholders
Practice Session – Domain 3
- Risk Response Questions
- Risk Treatment Questions
- Risk Ownership Questions
- Vendor and Supply Chain Risk Questions
- Control Design Questions
- Control Testing Questions
- Risk Metrics Questions
- KRI, KCI and KPI Questions
- Risk Monitoring Questions
- Risk Reporting Questions
- Scenario-Based Risk Response Questions
Day 2
Domain 4 – Technology and Security
20% of the CRISC Examination
Domain 4 berfokus pada pemahaman prinsip teknologi dan keamanan yang diperlukan untuk menilai risiko terhadap IT-enabled capabilities, systems, data, projects, operations, resilience, emerging technologies, dan information security.
A. Technology Principles
- Technology Roadmaps
- Enterprise Architecture
- IT Operations Management
- Change Management
- IT Asset Management
- Problem Management
- Incident Management
- DevOps
- System Development Life Cycle
- Data Lifecycle Management
- Portfolio Management
- Project Management
- Agile Methodologies
- Technology Resilience
- Disaster Response
- Disaster Recovery
- Emerging Technologies
- Technology Risk
- Cloud Computing
- Artificial Intelligence
- Digital Transformation
B. Information Security Principles
- Information Security Concepts
- Security Frameworks
- Security Standards
- Security Risk
- Security Awareness
- Security Training
- Data Privacy Principles
- Data Protection Principles
- Information Security Governance
- Information Security Controls
- Confidentiality
- Integrity
- Availability
- Information Security Risk Management
Practice Session – Domain 4
- Technology Risk Questions
- Enterprise Architecture Questions
- IT Operations Questions
- SDLC Questions
- Data Lifecycle Questions
- Project and Portfolio Risk Questions
- Technology Resilience Questions
- Emerging Technology Questions
- Information Security Questions
- Data Privacy Questions
- Scenario-Based Technology Risk Questions
Comprehensive CRISC Exam Preparation
Setelah seluruh empat domain selesai dibahas, peserta akan mengikuti sesi integrasi seluruh materi dan strategi menghadapi examination.
Comprehensive Review
- Review of CRISC Domain 1–4
- Governance and Risk Governance
- Enterprise Risk Management
- Risk Appetite and Risk Tolerance
- Risk Identification
- Risk Assessment
- Risk Scenario Development
- Risk Analysis
- Risk Register
- Inherent and Residual Risk
- Risk Response
- Risk Treatment
- Control Design and Implementation
- Control Testing
- Risk Monitoring
- Risk Metrics
- Risk Reporting
- Technology and Security Risk
CRISC Question Analysis Techniques
Peserta akan dilatih untuk memahami pola pertanyaan CRISC dan menentukan jawaban yang paling tepat berdasarkan perspektif risk management dan business objectives.
Fokus analisis antara lain:
- What is the PRIMARY objective?
- What should be done FIRST?
- What is the BEST risk response?
- What is the MOST appropriate action?
- What should the risk practitioner recommend?
- Who should own the risk?
- Who should own the control?
- What should be assessed FIRST?
- What should be done NEXT?
- Which option BEST aligns with the organization's risk appetite?
- Which control is MOST appropriate?
- What information should be reported to management?
Peserta tidak hanya diarahkan untuk menghafalkan konsep risk management, tetapi memahami hubungan antara:
Business Objective → Risk → Risk Scenario → Risk Assessment → Risk Response → Control → Monitoring → Reporting
Training Methodology
- Instructor-Led Interactive Training
- CRISC Concept Review
- Enterprise Risk Management Discussion
- Real-World IT Risk Case Studies
- Scenario-Based Learning
- Risk Assessment Exercises
- Risk Scenario Development
- Risk Treatment Analysis
- Control Design Discussion
- Practice Questions
- Detailed Answer Explanation
- Risk Management Case Analysis
- Group Discussion
- Exam Strategy Workshop
- Mock Exam Discussion
- Final Q&A
Target Participants
Program CRISC Exam Preparation Bootcamp cocok untuk:
- IT Risk Managers
- Enterprise Risk Management Professionals
- IT Risk Professionals
- Risk Management Professionals
- IT Governance Professionals
- IT Auditors
- Internal Auditors
- Information Security Professionals
- Cybersecurity Professionals
- Compliance Officers
- Business Analysts
- IT Managers
- Project Managers
- IT Control Professionals
- Technology Consultants
- Vendor Risk Professionals
- Third-Party Risk Professionals
- Professionals preparing for the CRISC Certification Examination
ISACA sendiri menjelaskan CRISC sebagai credential untuk IT dan business professionals yang mengidentifikasi dan mengelola risiko melalui pengembangan, implementasi, serta pemeliharaan information systems controls.
Prerequisites
Peserta direkomendasikan memiliki pemahaman mengenai:
- IT Risk Management
- Enterprise Risk Management
- IT Governance
- Information Security
- Internal Controls
- Business Processes
- IT Operations
- Project Management
- Information Systems
Pengalaman profesional dalam IT Risk Management, IT Governance, IT Audit, Information Security, Compliance, Internal Control, Project Management, atau Technology Management akan sangat membantu dalam mengikuti program.
Untuk memperoleh sertifikasi CRISC, peserta harus memenuhi persyaratan pengalaman profesional yang ditetapkan oleh ISACA. ISACA saat ini mensyaratkan minimum tiga tahun pengalaman profesional dalam IT risk management dan IS controls, tanpa experience waiver atau substitution.
Learning Outcomes
Upon completion of this bootcamp, participants will be able to:
- Understand the CRISC certification and examination structure.
- Understand all four CRISC examination domains.
- Understand enterprise and IT risk management principles.
- Establish and evaluate risk governance practices.
- Identify threats, vulnerabilities and risk events.
- Develop and evaluate information system risk scenarios.
- Conduct risk assessment and risk analysis.
- Understand business impact analysis and risk registers.
- Differentiate inherent risk and residual risk.
- Select appropriate risk response options.
- Establish risk and control ownership.
- Evaluate vendor and supply chain risks.
- Design and implement appropriate controls.
- Evaluate control effectiveness and testing methodologies.
- Establish risk monitoring and reporting mechanisms.
- Use KRIs, KCIs and KPIs to support risk-based decision making.
- Evaluate technology and information security risks.
- Apply the ISACA risk management perspective when answering scenario-based questions.
- Improve confidence and readiness for the official CRISC examination.
CRISC® Exam Domains
| Domain | CRISC Job Practice Area | Weight |
|---|---|---|
| Domain 1 | Governance | 26% |
| Domain 2 | Risk Assessment | 22% |
| Domain 3 | Risk Response and Reporting | 32% |
| Domain 4 | Technology and Security | 20% |
| Total | 100% |
The domain structure and weighting above are based on the CRISC Examination Content Outline Effective 2025 published by ISACA.
Duration
2 Days Intensive CRISC® Exam Preparation Bootcamp
Total: 16 Training Hours
Program dapat disesuaikan menjadi program yang lebih panjang bagi organisasi maupun peserta yang membutuhkan pembahasan risk management dan latihan soal secara lebih mendalam.
Delivery Methods
- Online Live Training
- Offline Classroom Training
- In-House Corporate Training
Metode pelaksanaan dapat disesuaikan dengan kebutuhan peserta maupun organisasi.
Language
Presentation Material: English
Instructor Delivery: English or Bahasa Indonesia
Practice Questions: English
Training Focus
Intensive Exam Preparation for the ISACA Certified in Risk and Information Systems Control (CRISC®) Certification Examination.
Program difokuskan pada pemahaman:
IT Risk Governance → Risk Assessment → Risk Response → Control Management → Risk Monitoring → Risk Reporting → Technology & Security Risk
Peserta tidak hanya diarahkan untuk menghafalkan terminology, tetapi juga memahami cara berpikir risk professional dalam menghubungkan business objectives, risk appetite, risk scenarios, controls, risk treatment, monitoring, dan management decision-making.
About the Trainer
Hery Purnama – Certified Trainer
Hery Purnama merupakan trainer dan praktisi profesional dengan pengalaman lebih dari 15 tahun dalam bidang:
- IT Governance
- IT Risk Management
- Information Systems Audit
- Information Security
- Project Management
- IT Service Management
- Compliance
- Technology and Business Consulting
Program training dirancang dengan pendekatan practical and exam-oriented, menggabungkan pemahaman konsep, pengalaman praktik, studi kasus enterprise, serta latihan soal berbasis skenario.
Prepare Your CRISC® Certification Journey
Identify the Risk.
Assess the Risk.
Respond with the Right Controls.
Monitor and Report.
Prepare with Confidence for the CRISC Examination.
0 Komentar