Certification CGPC case studies
Certification CGPC · Put your knowledge to work in context.
CGPC (Certified Governance, Privacy and Compliance) is a professional credential for practitioners who build and run governance, risk and compliance (GRC) programmes. It suits compliance officers, risk managers, privacy and data-protection staff, internal auditors, and consultants moving into a compliance-focused role, plus operations and legal professionals who increasingly own control and reporting duties. The exam tests breadth rather than narrow specialism: governance, risk and compliance foundations; the regulatory and legal environment; risk identification, assessment and treatment; internal controls and control testing; compliance programme design and monitoring; ethics, conduct and professional standards; and incident management, reporting and remediation. Expect scenario-based multiple-choice items that ask you to apply a framework to a messy situation, not just recall a definition. The Certification CGPC case studies are 5 cases and about 3,864 words.
1Risk Appetite Without Limits at a Digital Lender
A 900-person digital lender has a board risk appetite statement that says it has “low tolerance for regulatory breach” but sets no metrics, thresholds, or escalation triggers. The product team wants to launch a buy-now-pay-later product in six weeks.
736 words, about 4 min2Cross-Border Outsourcing Rule Before Licence Renewal
A payments group is licensed in 14 countries and processes for 3,000 merchants. One market’s regulator will apply a new outsourcing rule in 60 days.
785 words, about 4 min3Unusable Supplier Risk Register at a Medical Device Manufacturer
A medical-device manufacturer has 2,400 suppliers. Its risk register uses a 5×5 matrix, but business units multiply likelihood and impact and then add a “management judgment” score.
784 words, about 4 min4Access Review Control Fails Testing at a Shared Service Center
A financial-services shared service center runs quarterly access reviews for 1,200 users across three core systems. The control owner emails spreadsheets to line managers, who have five business days to confirm access.
776 words, about 4 min5Ransomware Notification Clock at a Healthcare SaaS Provider
A healthcare SaaS provider discovers ransomware on a billing application at 02:10 on a Saturday. The incident affects 42,000 patients across three states, including 1,100 whose billing records contain diagnosis codes.
783 words, about 4 min