CRISC deep review — September 29, 2026

The guide maps 44 live domain-list entries and 24 supporting tasks, answers 40 original prompts and adds three worked scenarios, eight proposed activities and 52 executed offline checks. The work corrects the QAE count and teaches why a valid risk record or numerical model still needs evidence and authority.

Scope and lifecycle

The canonical outline retains 26/22/32/20 percent weights. An April 2025 central announcement establishes November 3, 2025 as this version's effective date, with preparation materials from September 3, 2025. No later CRISC replacement appeared in the sources examined. CISM's November 2026 change is a separate program event.

The live HTML lists 11/9/13/11 domain entries. The genuine candidate PDF appendix has 11/9/13/10 numbered subtopics because Technology Principles is its domain 4A heading, while the HTML includes it as a list entry under a different heading. Both have 24 supporting tasks and the same weights. Every canonical HTML entry is mapped and the concept is taught without silently rewriting the monitored snapshot or inventing a scope change. Objective and status hashes remain unchanged.

Candidate policy and the CRISC appendix distinguish sitting from certification, scaled scoring from a raw percentage, and CRISC's no-waiver rule from other ISACA credentials. Personal eligibility was not assessed. The complete nine-page CPE policy was read in the same-day CISA review and reused with a matching fresh hash. Its January 2027 framework is separate from exam scope; personal cycle and recordkeeping-transition interpretation remain unverified.

Technical reading and executed examples

Selected NIST IR 8286A Rev. 1 pages support careful estimation, bias review, conditional event trees and simulation. An original four-leaf tree conserves total probability and produces a 2.4% modeled annual loss probability from explicitly conditional inputs, with US$24,000 expected loss for a US$1 million consequence. This is fictional arithmetic, not evidence of actual control-failure rates.

A separate triangular loss model specifies minimum US$20,000, mode US$40,000 and maximum US$100,000. Analytic mean is about US$53,333; probability of exceeding US$60,000 is one-third. An actual 100,000-draw seeded simulation gives about US$53,287 and 33.159%. Comparing simulation with analytic results checks implementation of the chosen model; it does not validate the assumptions or quantify real enterprise risk.

The three-point discussion on PDF page 64 (printed page 53) was also visually inspected. Its sigma formula applied to its stated inputs produces US$7,500, while its prose interval uses US$13,500 around the weighted mean; it also conflates an individual-loss range with confidence for a mean. Those numerical/statistical assertions are not adopted. The complete NIST statistics handbook page supports a separate explanation of repeated-sampling confidence for the population mean. Source authority does not remove the need to check arithmetic and assumptions.

The full NIST risk-register schema was captured with an explicit JSON Accept header after an HTML-only follow-up failed. It requires 11 fields and checks response types/uniqueness but does not bound likelihood, enforce nonempty ownership, compute exposure or define local statuses. Actual validation with the existing jsonschema 4.26.0 library demonstrates both accepted and rejected original fixtures. Separate chosen rules flag decision-data gaps without pretending to implement an entire risk policy. The exact schema text/hash and workbook output are preserved in the operation record.

Selected NIST IR 8286B Update 1 material supports criteria-based prioritization, comparable costs, ownership and explicit handling of deferred treatment. The workbook enumerates all 16 subsets of four fictional actions under a US$65,000 annual budget, rejecting missing dependencies, duplicate IDs and excess cost. Inventory plus identity has the largest projected additive benefit, US$120,000 for US$60,000 cost. A mandatory recovery constraint changes the model's feasible choice to inventory plus recovery, US$115,000 benefit for US$65,000 cost. This models a planning decision; neither selection proves delivery nor authorizes risk acceptance.

Resources and boundaries

The complete official certification landing now advertises 833 QAE items and six-month access, correcting the old 600 figure. Individual course/manual/QAE routes returned 200 application shells directly and in fresh unsigned Chrome after redirects. Exact editions, current course duration and paid interiors remain unreviewed. No cart, purchase, account or playback occurred; the free quiz was fetched but its items were not reviewed or submitted.

The complete Pluralsight public path lists six courses totaling 319 minutes beneath a five-hour headline; its domain courses are from November 2025–January 2026, exam preparation from April 2026 and lab introduction from 2021. Labs and practice exams were advertised, not executed. LinkedIn/Cybrary lists beginner level, December 11, 2025 and 6 hours 3 minutes. O'Reilly/Udemy returned 403, so prior durations and contents are explicitly unverified.

Twenty-three direct health receipts contain 21 HTTP successes and two blocks. Success does not imply full content reading: store shells and the schema's initial content-negotiation failure are recorded separately. Five genuine PDFs were captured or reused: 43-page candidate guide, nine-page CPE policy, 78-page NIST 8286r1, 79-page NIST 8286Ar1 and 50-page NIST 8286B. Exact selected reading bounds, the visual inspection, source hashes, schema text, 52-check output and repository gates are in ADLC_Docs/operations/2026-09-29-crisc-deep-review.json. Only the CPE policy was read in full. Personal eligibility, organizational control assurance, paid interiors and human review remain pending. The five reserved GitHub guides and disabled notification pilot remain untouched.