CRISC CPE Requirements 2026: 20 Hours a Year, 120 Over 3
CRISC holders must report at least 20 CPE hours a year and 120 over each three-year cycle, and ISACA will change its CPE policy from 1 January 2027.
ISACA says the CRISC (Certified in Risk and Information Systems Control) credential is maintained by reporting at least 20 CPE hours each year and 120 hours over every three-year cycle, paying an annual maintenance fee and passing a random audit if you are selected. The credential is aimed at professionals who identify and manage IT and enterprise risk, and its maintenance rules match ISACA's other certifications. ISACA has also announced a new CPE policy that starts on 1 January 2027, so the rules below are the ones that apply to the 2026 cycle. The same pattern applies to the credential we cover in our CISA CPE requirements guide and our CISM CPE requirements guide.
At a glance
| Requirement | What the rules say |
|---|---|
| Annual minimum | 20 CPE hours reported each year |
| Three-year total | 120 CPE hours related to the certification |
| Annual maintenance fee | US$45 for ISACA members and US$85 for non-members; US$25 and US$50 for a third or later certification |
| Length of a CPE hour | One hour for each 50 minutes of active participation |
| Record keeping | Keep proof for 12 months after each three-year cycle ends |
| Audit | Random sample each year; non-compliance leads to revocation |
| Deadline | The policy document says payment and reporting are due by 31 December; the web page says payment is due by 1 January |
| New policy | A new ISACA CPE policy takes effect on 1 January 2027 |
20 a year and 120 over three
ISACA's CRISC maintenance page sets an annual minimum of 20 CPE hours reported each year and a three-year total of 120 hours related to the certification. The policy document for CRISC (version 6, January 2025) uses the same figures. If you fall short of the annual or the three-year minimum, you are subject to revocation.
Fees
ISACA lists an annual maintenance fee of US$45 for members and US$85 for non-members. A third or later ISACA certification costs US$25 for members and US$50 for non-members. The fee is invoiced from September and covers the upcoming calendar year. The policy document does not state a dollar amount, so the web page is the source for the figures.
How hours are counted
The policy document counts one CPE hour for each 50 minutes of active participation, excluding lunches and breaks, and hours are reported in quarter-hour increments. Education from ISACA and from other providers, self-study, teaching and presenting, publications, exam item development and passing related exams are not capped. Teaching earns five times the presentation time for the first delivery.
Capped categories
Some activities have annual caps: 10 hours for vendor sales or marketing presentations, 20 hours for serving on ISACA boards or committees for each certification, 20 hours for contributions to the profession in total and 10 hours for mentoring. ISACA also limits some of its own offerings, for example up to 32 hours from conferences and up to 36 hours of free online training a year.
Sharing hours across certifications
ISACA allows the same activity to count toward more than one of its certifications when the activity applies to the job-related knowledge of each. You report the hours separately for each certification, and board hours count separately for each one. If you hold more than one, plan your learning once and map it twice.
The audit
ISACA selects a random sample of holders each year and asks for written evidence of the activities reported. For the 2025 hours, notices went out in June 2026 and the last day to submit was 7 August 2026. Hours with non-compliant documentation are removed. Holders who do not comply with the audit have their certification revoked. Acceptable proof includes a certificate, a letter, an attendance roster or a Verification of Attendance form showing your name, the sponsor, the title, the date and the hours. ISACA says registration receipts, calendar invitations, screenshots, slide decks and emails without the duration or hours are not accepted.
Revocation and reinstatement
A revoked holder can no longer present as CRISC. The policy document says reinstatement requires passing the exam again and reapplying, and a US$50 fee applies if the revocation has been outstanding for more than 60 days, plus back or current fees.
Retired and non-practicing status
Holders who are over 55 and permanently retired, or permanently disabled, can ask for retired status, which carries no CPE and no annual fee but is permanent unless you retake the exam. Non-practicing status suits people who are no longer working in the field: no CPE is required but the annual fee is still due. Returning to active within two calendar years takes 20 CPE hours from the past year. After two or more years it takes 120 CPE hours from the past three years plus a year of verified work.
Where ISACA's pages disagree
ISACA's web pages say the maintenance fee is due annually by 1 January, while the policy document says payment and reporting are both due by 31 December. We found no official statement that reconciles the two. The safe approach is to report your hours and pay by 31 December.
The 1 January 2027 policy
ISACA says the new policy applies from 1 January 2027, with no system changes in the 2026 cycle. The total stays at 120 hours over three years. At least 90 must be aligned to the certification, and up to 30 can be general professional development. Vendor sales and marketing demonstrations stop earning CPE, though vendor case studies still count. All ISACA conference CPE counts as aligned to the certification. ISACA says the audit process stays the same. We did not find a separate page for the new policy that is specific to CRISC, so check ISACA's own 2027 page before you plan around the split.
Frequently asked questions
How many CPE hours does CRISC need?
At least 20 hours reported each year and 120 hours over each three-year cycle, related to the certification.
How much does CRISC maintenance cost?
US$45 a year for ISACA members and US$85 for non-members, on ISACA's web page. A third or later certification costs less.
Can one course count for two ISACA certifications?
Yes, when the activity applies to the job-related knowledge of each certification. You report the hours separately for each one.
What happens if I am audited and cannot show proof?
The unsupported hours are removed, and holders who do not comply with the audit have their certification revoked.
What changes in 2027?
A new ISACA CPE policy starts on 1 January 2027, keeping 120 hours over three years but requiring at least 90 aligned to the certification and allowing up to 30 general hours.
Finding courses that count
Learnsignal publishes accounting, tax, audit, ethics and finance courses in its CPD and CPE library. Before you pay for any course, check the awarding body's own rules on what it accepts, and keep the certificate and the course details. If you work in audit more widely, see our internal audit CPD training guide.
Source: ISACA's CRISC maintenance page, the CRISC CPE policy document (version 6, January 2025), the ISACA how-to-earn-CPE page, the annual CPE audit page, the certification status options page and the ISACA 2027 CPE policy page, checked October 2026.
This page was last updated:
Learnsignal Education Team
Expert Tutor at Learnsignal
Qualified professional with years of experience helping students advance their professional careers.
View all posts by Learnsignal Education Team
