GRCP

It is multiple choice, delivered online and available at any time - no scheduling needed. You get 120 minutes for 100 scored questions, plus up to 15 unscored questions mixed in that are not labeled, so answer every item as if it counts. Your score is calculated only on the 100 scored questions.

You must correctly answer 70 of the 100 scored questions. The result appears immediately after you finish, and if you pass, your certificate is immediately available to print and share. Unscored pretest items do not affect your score, but you cannot tell which ones they are.

Yes. OCEG permits Google searches, other websites, your own notes, and OCEG materials. AI is strictly prohibited - including ChatGPT, Claude, Gemini, Copilot, Perplexity, and Google AI overviews or AI Mode. If OCEG systems detect AI use, it reserves the right to revoke your certificate and ban your account. Do not use AI overviews; open pages yourself.

OCEG reports that people who pass studied the GRC Capability Model carefully and completed GRC Fundamentals, and that preparation time ranges from 2 to 40 hours depending on your background. Those with experience in governance, risk, compliance, security, or audit typically need less. Open book does not make it easy - the exam is described as challenging even with resources.

Start with the open-source GRC Capability Model ("Red Book"), which contains the essential body of knowledge. Then work through the GRC Fundamentals self-study course to see how the model is applied, and finish with practice questions. OCEG notes 94% of first-attempt passers report that a course helped them pass.

You may retake the exam up to six times per year, and all retakes are included at no additional fee under the All Access Pass. OCEG notes its question database is extensive, so you are unlikely to see the same questions on a later attempt. Prepare fully before each sitting rather than treating attempts as practice.

OCEG observes that those who fail tend to pass on a later attempt once they actually study the GRC Capability Model and complete the GRC Fundamentals self-study. The common failure mode is attempting the exam cold, assuming open book compensates for not knowing the model's components, elements, and practices. Study and watch the videos first.

No. OCEG has ended its Authorized Training Partner program, and no company is currently authorized to present OCEG certification training as an ATP or equivalent. Localized third-party courses claiming OCEG ATP or official partner status are unauthorized. Use OCEG's own GRC Fundamentals self-study, included with the All Access Pass, or arrange cohort training directly with OCEG.

You only need to pass the exam once every five years; you do not recertify annually. Starting your second year you must earn at least eight continuing education credits related to the certification topic annually, tracked automatically through OCEG's unified CPE program, and hold an active All Access Pass. One CPE activity can count toward multiple certifications.

Renewal is automatic on the expiration date if you have an active All Access Pass and have met the CPE requirement. If the expiration date passes without both conditions, you get a 90-day grace period to fulfill them - renew the pass and/or earn the credits. After the grace period, the certification is deleted from OCEG records and certificates are no longer available.