CGIC
Certified in Governance, Risk and Compliance (CGIC)
More study resources
Cheat sheet
Keep the key ideas within reach.
ExploreKey terms
Get comfortable with the vocabulary.
ExploreStudy plan
Give each week a clear focus.
ExploreCommon mistakes
Understand the traps and how to avoid them.
ExploreCase studies
Put your knowledge to work in context.
ExploreExam-day guide
Prepare for the day ahead.
ExploreAbout this exam
The Certified in Governance, Risk and Compliance (CGIC) is a professional credential aimed at practitioners who build and run the control environment of an organisation: the policies and oversight structures that direct it, the risk processes that anticipate what could go wrong, the compliance programmes that keep it inside its legal and regulatory obligations, and the assurance work that tests whether any of it actually functions. It suits compliance officers, risk analysts, internal auditors, governance and company-secretarial staff, and consultants moving into an integrated GRC role, particularly those who currently specialise in one pillar and need fluency across all four. The exam is multiple choice and is structured around five domains weighted roughly as follows: Governance 25%, Risk Management 25%, Compliance 25%, Audit and Assurance 15%, and Ethics and Professional Conduct 10%. Questions tend to be scenario-based rather than definitional, so preparation should combine structured study of each domain with practice in reading a short fact pattern and choosing the control, framework or escalation step that fits. Candidates should confirm current administrative details, including the number of questions, appointment length, fee and passing standard, directly with the certifying body, which publishes the authoritative figures on its website. This page is independent study material and is not affiliated with or endorsed by the certifying organisation.
What you'll study
About CGIC preparation
What is the exam format?
It is a multiple-choice examination delivered in a single sitting. Expect four-option items, some straightforward recall and many short scenarios asking you to pick the best course of action. The certifying body publishes the current item count and appointment length on its website; confirm these before you book.
How difficult is CGIC?
The difficulty comes from breadth rather than trickery. Candidates who know one domain deeply often underestimate the other three. If you can explain how a risk appetite statement, a compliance monitoring plan and an audit finding connect to each other, you are on the right track. Pure memorisation of framework names is not enough.
What happens if I fail - can I retake it?
Retake arrangements, waiting periods and any additional fees are set by the certifying body and change from time to time. Check the retake policy on its official site before sitting, and budget for the possibility of a second attempt in both time and money.
How much time should I plan for preparation?
Most working candidates need a few months of part-time study. A practical split is to spend the most time on Governance, Risk and Compliance, since together they carry three-quarters of the marks, then cover Audit and Assurance and Ethics. Build in at least two full-length practice sessions under timed conditions.
In what order should I study the domains?
Start with Governance, because appetite, tone at the top and accountability structures are the reference point for everything else. Move to Risk Management, then Compliance, which depends on both. Do Audit and Assurance next, since it tests whether the first three work in practice, and finish with Ethics, which is short and easy to revise late.
Why do candidates fail?
Three recurring causes: treating the exam as a vocabulary test and freezing on scenario items; ignoring Ethics because it is only 10%, when those are among the easiest marks to secure; and not practising under time pressure, so they run short on the final section. Reading each stem for the role you are playing also helps.
Are there prerequisites or experience requirements?
Eligibility rules, including any education or work-experience requirements and whether membership of the certifying body is needed, are set by that body. Review the eligibility criteria on its official website before registering so you are not caught out at the application stage.
How is the exam scored, and what is the pass mark?
Scoring methodology and the passing standard are determined by the certifying body and are not fixed figures we can quote. The current passing score is published on its official site. Treat any number you see elsewhere, including on study forums, as unverified.
How long is the certification valid?
Validity periods and continuing professional education requirements vary and are set by the certifying organisation. Check its website for the current recertification cycle and CPE hours so you can plan ongoing maintenance rather than being surprised when renewal comes around.
Can I use this page as my only study source?
No. Use it to orient yourself and to plan, then study each domain properly using the body of knowledge the certifying body publishes, plus primary sources such as standards and regulatory guidance. Practice questions are useful for pacing and for exposing gaps, not as a substitute for understanding.