CRISC Readiness: Risk and Information Systems Control
Signature Course No. 512 — A Signature AI Socratic Coaching Course.
For IT risk, security, and audit professionals — your coach starts where you actually stand.
A New Kind of Learning
Socratic coaching, delivered by an agentic AI coach.
Not a course you watch. An AI coach you work with.
The Lighthouse Coach begins by discovering how you think about the subject, teaches what is missing, and gives you realistic practice before asking you to prove that you can use it. You may test out of concepts you already understand, while capstones turn the learning into a practical plan, decision, conversation, or other real-world result.
The curriculum is deliberately authored; the AI delivers it through coaching. It is not an AI randomly generating lessons.
A coach that teaches by asking — not by lecturing
The Lighthouse Coach is an AI Socratic coach built on Cognosco Learning's CRISC Readiness: Risk and Information Systems Control course, in the Risk, Safety & Compliance category. It does not play videos at you. It holds a conversation: it asks you a question, listens to your answer, names the misconception it hears, affirms what you got right, and asks the next question — the way a great coach works in the room.
A risk you cannot state is not yet a risk you can manage. Most IT risk work fails quietly: registers fill with entries nobody can act on, scores are assigned by whoever spoke loudest, acceptances are granted without a price or a date — the paperwork complete and the risk untouched. This course teaches the discipline that avoids it: risk work that begins from business objectives, proceeds through honest scenarios and defensible numbers, and ends in decisions a named owner has actually made.
It starts with governance. A risk score means nothing until you know whose objective is threatened, how much risk that owner is authorized to carry, and who may decide. So the course begins where CRISC begins — appetite, accountability, and decision rights — then builds the craft itself: the register as an instrument rather than a list, the asset picture underneath every entry, and the scenario as the unit of honest analysis.
It works in two movements. First, Module 1 — See the Risk: Governance, Identification and Assessment — work through Concepts 1–9, finishing with The Assessment Pack: The ERP Upgrade; then, Module 2 — Act on Risk: Response, Control and Reporting — work through Concepts 10–18, finishing with The Response and Reporting Pack: Ransomware at the Plants.
Both capstones produce real artifacts — a complete risk assessment pack for a major system change on the running case: Anya Petrakis and the Zentara Pharmaceuticals register, framed in governance terms, grounded in a consequence-valued asset picture, assessed on anchored scales, and evaluated into priced decisions; and a response and reporting pack for that register's gravest risk — plant ransomware — with its responses priced, its controls designed and tested, its indicators wired, and its board page written in full.
The honesty standard is part of the course. Readiness is not a guarantee. No course can promise you will pass, and this one does not. What it is designed to do is close the gap between knowing risk terms and exercising risk judgment under examination conditions: choosing the best next action among several defensible ones, in the order a practitioner who answers to a business would choose it. Every number in the course is stipulated for teaching and recomputed before printing, and the examination's own administrative facts are fenced in the book's Appendix, to be verified against ISACA's current candidate guidance before you book.
The course is self-paced and always on — roughly 30 minutes per concept, about 9 hours in full, taken in as many sittings as you like. You can type your answers, or talk out loud: the Voice Coach speaks its questions and listens to your spoken replies. Learners who already work an area well can test out concept by concept — the bar does not drop; the route just gets shorter.
CRISC Readiness: Risk and Information Systems Control is part of The Lighthouse Signature Series — the online counterpart to the one-day, in-person learning Cognosco Learning delivers.
Course Facts
One full concept, coached end to end — free: verify your email and we’ll send you a link to start.
Already enrolled? Enter the course →
Diagnose → Learn & Practice → Prove → Capstone
Every learner moves through the same discipline a Cognosco instructor would insist on in the room.
Diagnose
The Coach starts where the course starts: with your own register. Pick the largest IT risk in your area and state, in one sentence, the business objective it threatens; name its owner and say what that person could actually authorize tomorrow — spend, change, stop — without asking anyone else; and say where your organization's appetite is written down, and when it last changed a decision. Every concept opens with three questions that locate where you actually stand, and your answers shape how deeply the Coach works the concept with you. Everyone begins with Module 1 — no skipping the foundations you only think you have.
Learn & Practice
Work each concept in conversation with the Coach — spoken or written — then practice it against realistic situations until it holds up.
Prove
Every concept ends in proof: answer the check cold and demonstrate the skill. Know it already? Test out and take credit immediately.
Capstone
Finish with two capstones — The Assessment Pack: The ERP Upgrade for Module 1 and The Response and Reporting Pack: Ransomware at the Plants for Module 2 — that pull the whole course together, and earn the certificate.
What You'll Learn
See the risk, then act on it — in that order, every time. Every judgment in this course runs the same chain: the objective named, the scenario bounded, the assessment honest, the comparison made against appetite, and the decision placed in front of the authority entitled to make it. That discipline — not a vocabulary of risk terms — is what the examination samples, and it is what this course builds, decision by decision.
Module 1 teaches you to see risk clearly. Risk Starts with Objectives; The Register Is the Craft; Know What You Are Protecting; Write a Scenario That Can Happen; Inherent Risk and Residual Risk; Likelihood and Impact; Judge Qualitatively; Count Carefully; and Evaluate and Prioritise.
Module 2 teaches you to act on what you saw. Choose the Response; Design Controls That Control Something; Test the Control, Trust the Evidence; Indicators That Warn in Time; Monitor and Report So Someone Decides; Risk Beyond Your Walls; Technology Changes, Risk Moves; When Risk Happens; and The Practitioner's Judgment.
And it holds its boundary throughout. This course assumes no prior certification. It does assume honest familiarity with how IT runs in a real organization: accounts and access, change, vendors, incidents, backups. Where a security foundation matters to a risk decision, the book teaches the foundation at the depth a risk practitioner needs — enough to judge, never pretending to make you the engineer. If your target is the audit credential itself, that is a neighboring course; this one starts where audit stops.
What you will learn
- Frame any IT risk question in governance terms: the objective at stake, the appetite and tolerance that bound it, and the named owner with the authority to decide
- Write register entries and risk scenarios that are specific, testable, and owned — and reject the vague, the duplicated, and the unpriceable
- Assess risk defensibly: inherent and residual kept separate, likelihood and impact scored on scales that mean the same thing twice, control effectiveness evidenced rather than asserted
- Choose the right analytical tool for the decision at hand — structured qualitative judgment where it is honest, quantitative analysis where a number is owed — and refuse false precision in both directions
- Select and justify a response — avoid, mitigate, share, accept — costed against the risk it addresses, with residual risk and review dates stated
- Design controls with owners, frequencies, and tests built in; build indicators, monitoring, and reporting that warn in time and cause decisions — and govern third-party and emerging-technology risk to the same standard
Everything in the course
- All 18 concepts of CRISC Readiness: Risk and Information Systems Control, in 2 modules
- A starting-point check first — the Coach finds where you actually stand before teaching
- Learn, Practice, Prove for every concept — no passive video watching
- A test-out on every concept: prove you know it and move on
- The Voice Coach: talk with the Coach out loud — it speaks, listens, and replies
- A personal Learner Record of your work across the course
- Two capstone exercises: The Assessment Pack: The ERP Upgrade and The Response and Reporting Pack: Ransomware at the Plants
- A printable session summary whenever you pause
- The Lighthouse Coach completion certificate (Signature Series)
- Your progress is saved as you go — stop anytime, resume where you left off
Built for practitioners who carry IT risk
IT risk analysts and practitioners — who maintain a register, run assessments, or track responses, and want the credential that certifies the craft, and the craft itself, tightened; and security and IT professionals moving into risk roles who know controls and incidents deeply and need the governance, assessment, and reporting frame the examination weights most heavily.
Auditors and assurance staff crossing to the risk side of the table — who must unlearn the opinion mindset and learn the decision mindset without losing their evidence discipline.
Managers accountable for IT risk decisions — risk owners and heads of function who will not sit the examination soon but need to judge the work done in their name, and who will find the examination's judgment standard a useful bar. This course assumes honest familiarity with how IT runs in a real organization throughout; it teaches how to decide, at what price, and before which authority.
Prefer to learn live and in person? The same material anchors Cognosco's one-day programs — browse the in-person catalog.
Start with Risk Starts with Objectives
$195 — introductory price. One payment. No subscription, no password to manage.
Here is exactly what happens when you enroll:
- Pay securely with Stripe — you are taken straight into the course
- Create your learner profile and begin the Module 1 starting-point check
- Save the access key you are given — it restores your enrollment on any device
- Learn at your pace; your progress is stored in your browser on your device
For the full voice experience, use Chrome and allow the microphone when asked. Typing your answers works everywhere, all the time. Questions before you enroll? Email hello@cognoscolearning.com.
Before you enroll
What is a Socratic coaching session?
A conversation, not a video. Your coach asks a question; you answer — out loud by voice, or by typing — and the coach responds to what you said: naming the misconception it hears, affirming what you got right, and asking the next question. You advance only when you have mastered each concept, so a finished course means the learning held.
How long does it take — and how long do I have?
About 30 minutes per concept. Learn in sittings of any length; your progress is saved as you go. You have a full year from purchase to finish, and you can revisit and retake within that year.
What does the certificate verify?
That you completed every concept and both capstones of this course. Anyone can confirm a Cognosco certificate online — enter its certificate ID on our verification page.
What if it isn't for me — what are the refunds?
If you have not started, cancel for a full refund within seven days of purchase. Once you have started, there is no cash refund — stop before finishing and we credit the full amount you paid toward any other course in the library (credit valid one year from your original purchase). Once you complete the course, no refund or credit applies.
More Signature Courses are coming
CRISC Readiness: Risk and Information Systems Control is Signature Course No. 512. Leave your email and we'll send you news of future Signature Courses and Lighthouse updates as they are announced — nothing else.