CORCM study guide
CORCM · Work through your exam, one topic at a time.
CORCM is a governance, risk, and compliance credential aimed at practitioners who build and run compliance programs rather than merely audit them. It suits compliance officers, risk managers, control owners, internal auditors moving into GRC, and operations or technology staff who increasingly carry regulatory responsibilities. The CORCM study guide has 8 sections and about 2,376 words.
01Governance, Risk, and Compliance Fundamentals
Governance sets direction and accountability; risk management identifies and prioritizes uncertainty; compliance confirms obligations are met. Candidates must know the three-lines model: the first line (business operations) owns and manages risk, the second line (risk and compliance functions) sets frameworks, advises, and monitors, and the third line (internal audit) provides independent assurance.
336 words, about 2 min02Risk Identification and Assessment
Risk identification draws on process mapping, workshops, interviews, loss-event data, regulatory changes, and external threat intelligence. Candidates should recognize that identification is continuous, not a once-a-year exercise.
302 words, about 2 min03Risk Treatment and Control Design
Four canonical responses exist: avoid (exit the activity), reduce/mitigate (add controls), transfer/share (insurance, outsourcing, contracts), and accept (retain, with documented rationale and authority). A fifth, exploit, applies to upside risk.
296 words, about 1 min04Compliance Program Design and Operations
An effective compliance program rests on documented policies and procedures, a defined governance structure, risk assessment, training, monitoring and testing, a reporting channel (including whistleblowing), investigation and remediation processes, and enforcement/discipline. Candidates should recognize the seven elements commonly cited (standards and procedures, oversight, training, monitoring and auditing, reporting, discipline, and response/remediation) and how they interlock.
288 words, about 1 min05Regulatory Change Management and Monitoring
Regulatory change management begins with horizon scanning: tracking regulators, consultations, enforcement actions, and industry guidance to anticipate change before it is final. Candidates must distinguish a consultation or draft (not yet binding) from a final rule with an effective date and from guidance (interpretive, sometimes non-binding).
301 words, about 2 min06Third-Party and Vendor Risk Management
The third-party lifecycle runs from planning and due diligence through contracting, onboarding, ongoing monitoring, and termination/exit. Risk-based tiering determines the depth of diligence and monitoring: critical or high-risk vendors (data access, operational dependency, regulated activity) receive more scrutiny than low-risk suppliers.
271 words, about 1 min07Incident Management and Reporting
Incident management moves through detection, triage and classification, containment, eradication, recovery, and post-incident review. Classification uses severity criteria tied to impact (data, customers, operations, financial, regulatory).
290 words, about 1 min08Compliance Reporting, Metrics, and Assurance
Effective reporting uses a balanced set of metrics: lagging indicators (losses, findings, breaches) and leading indicators (training completion, control test pass rates, open issue aging, KRI trends). Candidates should recognize the difference between a metric (a measure) and a KRI (a measure with thresholds that signal rising risk).
292 words, about 1 min