Certification CGPC study plan

Define governance, risk, and compliance as distinct but interlocking functions, and explain in writing how a control failure in one area propagates into the others.

Map the three lines model onto a named organization type (for example, a mid-size bank or a hospital) and label who owns risk, who oversees it, and who assures it.

Distinguish risk appetite from risk tolerance and risk capacity, and draft one-sentence statements of each for the same fictional entity.

List the core components of a governance framework (board oversight, policy hierarchy, delegation of authority, reporting lines) and identify the artifact that evidences each.

Build a risk register for the fictional organization from week 1 with at least 12 risks spanning strategic, operational, financial, and compliance categories.

Score each risk on likelihood and impact using a defined 5x5 scale, and justify the scoring rationale in one line per risk.

Select treatment options (accept, mitigate, transfer, avoid) for each risk and state the residual rating after treatment.

Identify which register entries would trigger escalation to the board versus management, and state the threshold used.

Perform a qualitative risk assessment walkthrough for two high-rated risks, documenting the scenario, root causes, and potential cascading effects.

Apply at least two risk assessment techniques (for example, a risk matrix and a bow-tie or fault-tree style causal diagram) to the same risk and compare what each reveals.

Draft key risk indicators for three risks, each with a threshold, data source, and review frequency.

Explain how inherent risk, control risk, and residual risk relate, and recalculate residual ratings for five register entries using that logic.

Classify controls from the week 2 register as preventive, detective, or corrective, and as manual or automated, and flag any risk left without a detective layer.

Write test procedures for five controls specifying the population, sample selection method, evidence to be inspected, and pass/fail criteria.

Distinguish a test of design from a test of operating effectiveness and describe what evidence each requires.

Document three common control deficiencies (design gap, operating failure, documentation gap) and the remediation response each would demand.

Draft a compliance program outline covering governance, risk assessment, policies, training, monitoring, and reporting, mapped to the program elements you have studied.

Design a monitoring plan with at least four monitoring activities, each with an owner, frequency, data source, and escalation path.

Explain the difference between monitoring, testing, and audit, and assign each of your four activities to the correct category.

Identify how a compliance program should be updated after a regulatory change, and draft a change-trigger checklist.

Summarize the main categories of legal obligation a compliance function tracks (for example, prudential, conduct, data protection, anti-bribery, and reporting duties) and give one concrete obligation under each.

Explain how a regulator's expectations differ from a statute's requirements, and describe how supervisory guidance influences program design.

Map three regulatory obligations from week 6 onto specific controls in your week 4 workpaper and note any gaps.

Describe the elements of an effective training and communication program and draft a training plan for two audience tiers.

Draft a code of conduct section addressing conflicts of interest, gifts and entertainment, confidentiality, and speaking up, with a concrete example for each.

Explain the difference between a compliance breach, a conduct issue, and a control failure, and give an example of each.

Build an incident response runbook covering detection, triage, containment, escalation, regulatory notification, and root-cause analysis.

Draft a remediation plan template with owners, deadlines, verification steps, and closure criteria, and apply it to one fictional incident.

Consolidate all prior deliverables into a single indexed study portfolio and identify the three weakest domains by self-assessment.

Write 40 practice questions across the seven domains and answer them without notes, then review every miss against the source material.

Re-explain the three weakest concepts aloud or in writing from memory, then correct against your notes.

Build a one-page exam-day reference sheet of definitions, formulas, and framework elements you must recall cold.