Certification CGPC study guide
Certification CGPC · Work through your exam, one topic at a time.
CGPC (Certified Governance, Privacy and Compliance) is a professional credential for practitioners who build and run governance, risk and compliance (GRC) programmes. It suits compliance officers, risk managers, privacy and data-protection staff, internal auditors, and consultants moving into a compliance-focused role, plus operations and legal professionals who increasingly own control and reporting duties. The Certification CGPC study guide has 7 sections and about 2,995 words.
01Governance, Risk, and Compliance Foundations
This domain tests whether you can explain how governance, risk, and compliance operate as one connected system rather than three silos, and how a board's stated appetite becomes an operational decision someone can be held to. Governance is the system of direction and oversight: the board and its committees, delegation of authority, tone at the top, and accountability for risk-taking.
484 words, about 2 min02Regulatory Environment and Legal Obligations
This domain tests your ability to identify which obligations actually bind an organization, where they come from, and how to keep that picture current - and to separate a legal requirement from a good-practice framework. Statute and case law; regulations and rules issued by regulators; supervisory guidance, which is often an expectation rather than a rule; licences and permits.
457 words, about 2 min03Risk Identification, Assessment, and Treatment
This domain tests the mechanics - not the vocabulary - of risk management: turning uncertainty into scored, owned, treated, and monitored entries, and defending how a residual score was derived. Scope and context, then identification, analysis, evaluation, and treatment, with monitoring and review plus recording and reporting running throughout.
379 words, about 2 min04Internal Controls and Control Testing
This domain tests whether you can select the right control, test it properly, and defend a conclusion on design and operating effectiveness - including when a finding is severe enough to be a material weakness. COSO Internal Control - Integrated Framework (2013): five components - control environment, risk assessment, control activities, information and communication, and monitoring activities - supported by 17 principles.
431 words, about 2 min05Compliance Program Design and Monitoring
This domain tests whether you can design a compliance program that is proportionate to the organization's risk and prove it works - the difference between a program that exists on paper and one a regulator or prosecutor would credit. US Sentencing Guidelines §8B2.1 : standards and procedures, knowledgeable high-level oversight, no one with known misconduct in a position of authority, effective training, monitoring and auditing, incentives and discipline, and a response that prevents recurrence after detection.
423 words, about 2 min06Ethics, Conduct, and Professional Standards
This domain tests ethical judgement under pressure plus your knowledge of the professional codes a certification holder is bound by. A code of conduct states expected behaviours and prohibited acts; ethics is the reasoning behind them.
404 words, about 2 min07Incident Management, Reporting, and Remediation
This domain tests incident handling from detection to closure, especially the clock-based obligations where a missed deadline creates a separate violation. An event is an observable occurrence; an incident is an event that threatens operations, data, or obligations; a personal data breach is a security incident leading to accidental or unlawful destruction, loss, alteration, or unauthorized disclosure of personal data.
417 words, about 2 min