CORCM study plan
CORCM · Give each week a clear focus.
8 weeks · About 7 hours per week
Governance, Risk, and Compliance Fundamentals & Risk Identification and Assessment
Define the core governance concepts (policy hierarchy, accountability, three lines model) in your own words
Map each element of a risk management framework to a real or hypothetical organization
Distinguish inherent, residual, and target risk and compute each for three sample risks
Build a risk register with at least 10 risks scored on likelihood and impact
Your checkpoint
A 10-row risk register with scored likelihood/impact and inherent vs. residual values, plus a one-page glossary of governance terms
Risk Identification and Assessment & Risk Treatment and Control Design
Select and justify a risk assessment methodology (qualitative, quantitative, or hybrid) for a stated scenario
Perform a risk assessment on the register from week 1 and rank risks by priority
Match each of the four treatment options (avoid, reduce, transfer, accept) to specific risks
Draft control objectives and map them to the risks they mitigate
Your checkpoint
A completed risk assessment report with a prioritized heat map and a treatment plan mapping each top risk to a control objective
Risk Treatment and Control Design
Classify controls as preventive, detective, or corrective and give two examples of each
Design a control set for one business process, including ownership and frequency
Write test procedures that would evidence whether each control operates effectively
Identify control gaps and recommend remediation with owners and dates
Your checkpoint
A control matrix for one process with control type, owner, frequency, test procedure, and gap remediation notes
Compliance Program Design and Operations
Draft the components of a compliance program (governance, policies, training, monitoring, reporting)
Build a compliance calendar with recurring obligations and responsible parties
Design a training and awareness plan tied to identified risks
Define escalation paths and thresholds for compliance issues
Your checkpoint
A compliance program charter and a 12-month compliance calendar covering at least 15 obligations
Compliance Program Design and Operations & Regulatory Change Management and Monitoring
Establish a process for identifying and tracking regulatory changes
Assess the impact of a simulated regulatory change on policies, controls, and training
Write a regulatory change impact assessment with a remediation plan
Set up a horizon-scanning routine with defined sources and cadence
Your checkpoint
A regulatory change impact assessment for one simulated change, including affected policies, controls, owners, and a timeline
Third-Party and Vendor Risk Management
Define vendor risk tiering criteria based on data access, criticality, and exposure
Design due diligence requirements appropriate to each vendor tier
Draft contract clauses covering security, audit rights, breach notification, and termination
Create an ongoing vendor monitoring and reassessment schedule
Your checkpoint
A vendor risk tiering rubric plus a due diligence checklist and monitoring schedule for a sample vendor portfolio
Incident Management and Reporting
Define incident severity levels and the criteria that trigger each
Write an incident response playbook covering detection, containment, notification, and lessons learned
Map internal and external reporting obligations and their timelines to incident types
Run a tabletop exercise and document findings
Your checkpoint
An incident response playbook with severity matrix and notification timelines, plus a tabletop after-action summary
Compliance Reporting, Metrics, and Assurance & Governance, Risk, and Compliance Fundamentals & Regulatory Change Management and Monitoring
Select compliance metrics that are meaningful, measurable, and tied to risk
Design a management reporting dashboard with leading and lagging indicators
Outline an assurance approach combining self-assessment, testing, and independent review
Review all prior deliverables and close knowledge gaps through targeted practice
Your checkpoint
A compliance metrics dashboard design with at least 10 indicators and a full review log of gaps closed across weeks 1-7
Milestones
Week 2: Can explain governance structure and complete a scored risk assessment without notes
Week 4: Can design controls and draft a compliance program outline from memory
Week 6: Can assess a regulatory change and tier a vendor using defined criteria
Week 8: Can build an incident playbook and metrics dashboard and score consistently on practice questions across all eight domains