Certification CGPC common mistakes
Certification CGPC · Understand the traps and how to avoid them.
Treating governance structures (board, committees, three lines) as an org chart to memorise, then answering scenario questions by naming the body that 'owns' a decision instead of describing the flow of accountability and escalation.
Candidates study governance as static labels because the domain feels descriptive; exam scenarios instead test whether you can trace who is accountable, who is informed, and where a decision escalates when lines blur.
What to do instead
For each governance body, write one sentence covering its mandate, its decision rights, and its reporting line to the board. Practise scenarios by drawing the escalation path from first line to board and marking the accountable owner at each step before choosing an answer.
Answering risk-appetite questions with a generic 'low risk is best' stance rather than aligning the response to the stated appetite, tolerance, and risk capacity in the scenario.
Candidates conflate risk minimisation with good governance; the exam tests whether you can distinguish appetite (willingness), tolerance (acceptable variance), and capacity (ability to bear loss), and act within them.
What to do instead
Learn the three terms as a set with contrasting examples, then for every scenario question identify the stated appetite first and eliminate any option that reduces risk below appetite or exceeds tolerance, even if it sounds prudent.
Citing a regulation from memory by name or number without tying the obligation to the specific activity, entity type, or jurisdiction described in the question.
Candidates memorise regulation titles as trivia and then pattern-match keywords, missing that applicability often turns on entity classification, cross-border reach, or the nature of the activity.
What to do instead
Build a one-page applicability matrix: obligation, who it binds, trigger activity, and supervisory authority. On each question, name the entity type and activity before selecting an obligation, and discard options that apply to a different entity class.
Confusing regulatory expectations, contractual obligations, and internal policy as interchangeable sources of requirement, and choosing an answer that satisfies one while breaching another.
Candidates treat all 'musts' as equivalent; the exam tests whether you can rank sources of obligation and recognise when a policy is stricter than law or a contract imposes duties beyond regulation.
What to do instead
For each scenario, list the applicable sources in a hierarchy (law and regulation, then contract, then internal policy) and check the proposed action against the strictest binding source. Where they conflict, the answer should satisfy the strictest obligation without breaching the others.
Selecting a control type by its label (preventive, detective, corrective) rather than by whether it actually addresses the specific risk, root cause, and timing described in the scenario.
Candidates learn control taxonomies as definitions and then classify by keyword; exam items reward matching the control's mechanism and timing to the failure mode, not reciting categories.
What to do instead
For each risk, state the failure event, its root cause, and the point at which detection must occur. Then choose the control whose mechanism intervenes at that point, and justify why the alternatives are mistimed or address a symptom rather than the cause.
Treating a high residual risk rating as automatically acceptable because a control exists, without testing design adequacy and operating effectiveness separately.
Candidates collapse 'a control is documented' into 'the risk is managed'; the exam distinguishes design (would this control work if operated) from operating effectiveness (did it work in practice) and tests both.
What to do instead
Practise a two-step habit: first assess design against the risk it is meant to mitigate, then assess evidence of operation over a defined period and sample. Only after both pass should residual risk be reduced, and state the evidence relied on.
Designing a compliance programme around training and a policy library alone, and omitting risk assessment, monitoring, escalation, and governance oversight from the answer.
Candidates default to visible artefacts because they are easy to name; the exam tests whether the programme is risk-based and has feedback loops that detect and correct failures.
What to do instead
Structure every programme answer against a fixed skeleton: risk assessment, policies and procedures, training, monitoring and testing, escalation and reporting, governance oversight, and remediation. Explicitly state how monitoring results feed back into the risk assessment.
Choosing monitoring frequency and sample size by habit or by what is convenient, rather than deriving them from risk rating, control criticality, and known failure history.
Candidates treat monitoring as a fixed calendar activity; the exam expects a risk-based rationale that links frequency and depth to the consequence of control failure.
What to do instead
For each monitoring plan, justify frequency and coverage with three inputs: inherent risk, control criticality, and prior exceptions. Where any input is high, increase frequency or depth and say so explicitly in the answer.
Resolving an ethics scenario by picking the option that protects the firm or the client relationship, rather than the option that satisfies the duty of care, conflicts management, and disclosure obligations.
Candidates import commercial instinct into conduct questions and rank outcomes by business impact; the exam tests whether professional duties and client interest take precedence over reputational or revenue considerations.
What to do instead
Apply a fixed sequence to every conduct scenario: identify the duty owed and to whom, surface any conflict, determine what must be disclosed or escalated, then choose the action. Reject any option that manages the appearance of impropriety without addressing the substance.
Handling an incident question by focusing on containment and customer communication while skipping root-cause analysis, regulatory notification deadlines, and evidence preservation.
Candidates picture incident response as firefighting and prioritise the visible response; the exam tests the full lifecycle including notification triggers, timelines, documentation, and remediation tracking to closure.
What to do instead
Memorise an incident checklist in order: detect and classify, contain, preserve evidence, assess notification obligations and deadlines, communicate, root-cause, remediate, and verify closure. On each question, identify which stage is being tested before answering.