# CGRC vs CRISC vs ISO 27001 Lead Auditor > Source: https://lscs.io/cgrc-vs-crisc-vs-iso-27001-lead-auditor/ > Choose CRISC for IT risk roles, CGRC for control and compliance programmes, ISO 27001 Lead Auditor for audit work. Fees, exams and experience compared. Pick ISACA's CRISC if your job is identifying, assessing and responding to IT risk; pick ISC2's CGRC if you run security and privacy control programmes and compliance across systems; pick an ISO/IEC 27001 Lead Auditor qualification if you audit, or prepare organisations for audits against ISO/IEC 27001. CRISC and CGRC both expect verified work experience, while a Lead Auditor qualification is a course plus exam whose rules depend on the scheme you choose. They are not rungs on one ladder. Each one tests a different slice of governance, risk and compliance (GRC) work, so the right choice depends on the job you do now and the one you want next. Below are the verified facts for each, a side-by-side table, and plain guidance on choosing. ### ISC2 CGRC: controls, authorisation and compliance CGRC stands for Certified in Governance, Risk and Compliance. It is the former Certified Authorization Professional (CAP), which ISC2 renamed CGRC in February 2023. ISC2 says the CGRC is “ideal for IT, information security and information assurance practitioners” who work in GRC roles, and lists titles such as GRC Analyst, GRC Manager, Cybersecurity Auditor, Cybersecurity Compliance Officer and Cybersecurity Third Party Risk Manager. The exam outline (effective 15 June 2024) has seven domains that follow a system through its life: - Security and Privacy Governance, Risk Management, and Compliance Program (16%) - Scope of the System (10%) - Selection and Approval of Framework, Security, and Privacy Controls (14%) - Implementation of Security and Privacy Controls (17%) - Assessment/Audit of Security and Privacy Controls (16%) - System Compliance (14%) - Compliance Maintenance (13%) - **Exam:** 125 items in 3 hours, multiple choice plus advanced item types, passing score 700 out of 1000, in English at Pearson test centres. - **Experience:** at least two years of cumulative, full-time experience in one or more of the seven domains. Part-time work and internships can count. - **No experience yet?** You can pass the exam and become an Associate of ISC2, then you have three years to earn the two years of experience. - **Exam fee:** ISC2 lists a UK standard registration price of GBP 485.19 (U.S. $599 in the Americas). ISC2 notes that pricing and taxes are based on the location of the exam. The pricing page shows no separate member price. - **Maintenance:** 60 CPE credits over a three-year cycle (20 a year: 15 Group A plus 5 Group A or B) and an annual maintenance fee (AMF) of U.S. $135. Associates of ISC2 pay U.S. $50, and members pay one AMF however many ISC2 certifications they hold. ### ISACA CRISC: IT risk management CRISC is Certified in Risk and Information Systems Control. ISACA says it “demonstrates your IT risk management expertise” and describes it as being “for IT and business professionals”, including risk and compliance professionals, business analysts and project managers who identify and manage risk through information systems controls. ISACA released an updated CRISC exam on 3 November 2025. The four domains stayed the same, with these weights: - Governance (26%) - Risk Assessment (22%) - Risk Response and Reporting (32%) - Technology and Security (20%) - **Exam:** 150 multiple-choice questions in 4 hours (240 minutes). - **Experience:** three or more years of CRISC work experience, gained within the 10 years before you apply (or within five years after passing), with no waivers or substitutions. ISACA’s guidance on which domains must be covered has changed with the new exam: its support article (updated September 2026) says people who passed after November 2025 need that experience in both Domain 2 (Risk Assessment) and Domain 3 (Risk Response and Reporting), while its main certification page still says at least two of the four domains. Check the rule that applies to your exam date with ISACA before you apply. You must apply for certification within five years of passing the exam. - **Fees:** US$575 for ISACA members and US$760 for non-members, based on your membership status when you register, plus a one-time US$50 application processing fee when you apply for certification. ISACA prices in US dollars, so the sterling cost moves with the exchange rate. - **Maintenance:** at least 20 CPE hours a year and 120 over a three-year period, plus an annual maintenance fee of US$45 for members or US$85 for non-members. ### ISO/IEC 27001 Lead Auditor: a course-plus-exam qualification ISO/IEC 27001:2022 is the international standard that specifies requirements for an information security management system (ISMS). The UK edition, BS ISO/IEC 27001:2022, is published by BSI. There is no single Lead Auditor exam. The qualification is a training course followed by an exam, offered by several certification and training bodies under their own schemes. That means course length, exam format, prerequisites, price, and whether the credential needs renewing all differ by scheme. Compare the scheme details directly rather than assuming they are equivalent. Experience can still matter. Some schemes award the full Lead Auditor title only once you have work and audit experience. For example, PECB’s scheme grants a Provisional Auditor credential after the exam with no experience required, while its Lead Auditor credential requires five years of professional experience, two of them in information security management, and a total of 300 hours of audit activities. What the course teaches is how to plan, lead and report an audit of an ISMS against ISO/IEC 27001. The underlying guidance comes from published standards: - **ISO 19011**, guidelines for auditing management systems (the current edition is ISO 19011:2026, published in the UK as BS EN ISO 19011:2026). - **ISO/IEC 27007**, which gives ISMS-specific guidance on managing an audit programme, conducting audits and the competence of ISMS auditors, in addition to ISO 19011. - **ISO/IEC 27006-1:2024**, which sets requirements for bodies that provide audit and certification of an ISMS. A course certificate shows you have been trained to audit against the standard. Whether a certification body puts you on its audit teams is that body’s decision, and some auditor registration schemes add their own audit-experience requirements. In practice the qualification is most useful for people who run internal ISMS audits, support an organisation through certification, or want to move into audit work. ### CGRC vs CRISC vs ISO 27001 Lead Auditor at a glance | | ISC2 CGRC | ISACA CRISC | ISO/IEC 27001 Lead Auditor | | --- | --- | --- | --- | | Focus | Running security and privacy control and compliance programmes across a system’s life | IT risk governance, assessment, response and reporting | Auditing an ISMS against ISO/IEC 27001 | | Awarded by | ISC2 | ISACA | Varies: several certification and training bodies, each with its own scheme | | Domains | 7 | 4 | Set by each scheme | | Exam | 125 items, 3 hours | 150 questions, 4 hours | Varies by scheme | | Experience to certify | 2 years (or Associate of ISC2 route) | 3 or more years, in the domains ISACA specifies for your exam date | Varies by scheme; some require work and audit experience for the full Lead Auditor grade | | Exam fee | GBP 485.19 (UK standard registration) | US$575 member, US$760 non-member, plus US$50 application fee | Varies by provider; usually bundled with the course | | Annual fee | U.S. $135 AMF | US$45 member, US$85 non-member | Varies by scheme | | CPE | 60 over 3 years (20 a year) | 120 over 3 years (minimum 20 a year) | Varies by scheme | Fees and rules were checked on the official sites in November 2026 and change from time to time, so confirm them before you book. ### Choose CGRC if… - Your day job is selecting, implementing, assessing and maintaining controls for specific systems, and evidencing compliance. - You work with control frameworks and system authorisation, or want to. - You have less than two years of GRC experience but want to sit an exam now: the Associate of ISC2 route lets you pass first and earn the experience afterwards. - You already hold, or plan to hold, other ISC2 certifications, because one AMF covers them all. ### Choose CRISC if… - Your role centres on IT risk: running risk assessments, maintaining a risk register, agreeing risk responses and reporting to management. - You sit between the business and IT, for example as a risk analyst, risk manager or control owner. - You already have three or more years of relevant experience, or will have it within five years of passing. - You are an ISACA member, or plan to become one, since member exam and maintenance prices are lower. ### Choose ISO 27001 Lead Auditor if… - You work for, or want to work for, an organisation that holds or is pursuing ISO/IEC 27001 certification. - You run internal audits, or you want to move into audit work. - You want a structured course in audit method that you can take before you have years of experience, accepting that some schemes award the full Lead Auditor grade only once you have audit hours. - You want something tied to a single, widely used standard rather than a broad body of knowledge. These options are not mutually exclusive. A common-sense order is to take the one that matches your current job first, because the experience requirements for CGRC and CRISC are easier to meet, and to evidence, when the work is already what you do every day. ### If you are new to GRC None of these is a natural first step if you have never worked in GRC. Before spending several hundred pounds on an exam, make sure you understand the basics: what governance, risk and compliance each mean, how a [risk assessment](https://lscs.io/learn/grc/how-to-conduct-a-cyber-risk-assessment/) works, and what [audit support](https://lscs.io/learn/grc/supporting-audit-and-compliance-requirements/) involves. Our free [Learning GRC in 12 Weeks](https://lscs.io/learn/grc/) course covers these with a video and written summary for each session. If you want structured support, the LSCS [GRC Mentorship Programme](https://lscs.io/grc-mentorship-course-details/) runs over six months at £150 a month, combining self-paced material with live mentor-led sessions on frameworks including ISO 27001, NIST CSF and ISO 31000, plus career coaching. Its focus is practical work such as policy development, risk assessments and audit support. Contact us for dates. ### Frequently asked questions #### Is CGRC or CRISC better? Neither is better overall. CRISC focuses on IT risk assessment, response and reporting; CGRC focuses on selecting, implementing and maintaining security and privacy controls and compliance across a system’s life. Choose the one that matches your role. #### Can I take CGRC or CRISC without experience? You can sit both exams, but certification needs experience. ISC2 lets you become an Associate of ISC2 and earn the two years within three years; ISACA gives you five years after passing to apply with three or more years of experience. #### How much does the CRISC exam cost? ISACA lists US$575 for members and US$760 for non-members, plus a one-time US$50 application processing fee when you apply for certification. #### Is there one official ISO 27001 Lead Auditor certification? No single version exists. Several certification and training bodies run their own course-and-exam schemes, so content, price, experience rules and renewal vary. #### Which GRC certification is best for beginners in the UK? None of the three is designed as a first step. Build the fundamentals first, then choose the certification that matches the GRC work you are doing or moving into. ### References - ISC2 (2026). _CGRC Governance, Risk and Compliance Certification_ . https://www.isc2.org/certifications/cgrc - ISC2 (2024). _CGRC Certification Exam Outline_ (effective 15 June 2024). https://www.isc2.org/certifications/cgrc/cgrc-certification-exam-outline - ISC2 (2026). _CGRC Experience Requirements_ . https://www.isc2.org/certifications/cgrc/cgrc-experience-requirements - ISC2 (2026). _ISC2 Exam Pricing_ . https://www.isc2.org/register-for-exam/isc2-exam-pricing - ISC2 (2026). _Annual Maintenance Fees (AMF)_ . https://www.isc2.org/policies-procedures/amfs-overview - ISC2 (2026). _Member Policies_ (CPE requirements). https://www.isc2.org/policies-procedures/member-policies - ISC2 (2023). _CAP Now Certified in Governance, Risk and Compliance (CGRC)_ . https://www.isc2.org/Insights/2023/02/CAP-is-Now-Certified-in-Governance-Risk-and-Compliance - ISACA (2026). _CRISC Certification_ . https://www.isaca.org/credentialing/crisc - ISACA (2026). _CRISC Exam Content Outline_ . https://www.isaca.org/credentialing/crisc/crisc-exam-content-outline - ISACA (2026). _Earn a CRISC Certification_ . https://www.isaca.org/credentialing/crisc/get-crisc-certified - ISACA (2026). _Maintain CRISC Certification_ . https://www.isaca.org/credentialing/crisc/maintain-crisc-certification - ISACA (2026). _Certification Exam Candidate Guide_ . https://www.isaca.org/-/media/files/isacadp/project/isaca/certification/exam-candidate-guides/2026/exam-candidate-guide.pdf - ISACA (2025). _ISACA Updates CDPSE and CRISC Exams to Reflect Latest Risk and Privacy Priorities_ . https://www.isaca.org/about-us/newsroom/press-releases/2025/isaca-updates-cdpse-and-crisc-exams-to-reflect-latest-risk-and-privacy-priorities - BSI (2022). _BS ISO/IEC 27001:2022 Information security management systems. Requirements_ . https://knowledge.bsigroup.com/products/information-security-cybersecurity-and-privacy-protection-information-security-management-systems-requirements - BSI (2026). _BS EN ISO 19011:2026 Guidelines for auditing management systems_ . https://knowledge.bsigroup.com/products/guidelines-for-auditing-management-systems-3 - BSI (2025). _BS EN ISO/IEC 27007:2022 Guidelines for information security management systems auditing_ . https://knowledge.bsigroup.com/products/information-security-cybersecurity-and-privacy-protection-guidelines-for-information-security-management-systems-auditing-2 - BSI (2024). _ISO/IEC 27006-1:2024 Requirements for bodies providing audit and certification of information security management systems. General_ . https://knowledge.bsigroup.com/products/requirements-for-bodies-providing-audit-and-certification-of-information-security-management-systems-general - ISACA Support (2026). _Certification Application: What are the requirements to become CRISC certified?_ https://support.isaca.org/s/article/What-are-the-requirements-to-become-CRISC-certified - ISO (2026). _ISO 19011:2026 Guidelines for auditing management systems_ . https://www.iso.org/standard/88984.html - ISO (2024). _ISO/IEC 27006-1:2024_ . https://www.iso.org/standard/82908.html - BSI (2026). _ISO/IEC 27001:2022 Lead Auditor Practitioner_ (training course). https://www.bsigroup.com/en-GB/training-courses/isoiec-27001-lead-auditor-practitioner-qualification/ - PECB (2026). _ISO/IEC 27001 Lead Auditor_ . https://pecb.com/en/education-and-certification-for-individuals/iso-iec-27001/iso-iec-27001-lead-auditor ### Start Learning With LSCS [OUR COURSES](https://lscs.io/our-courses/) [ALL POSTS](https://lscs.io/blogs/)