GRCP case studies
GRCP · Put your knowledge to work in context.
The GRC Professional (GRCP™) certification is issued by OCEG, the nonprofit that originated the GRC discipline, and it validates that a holder can apply governance, risk, and compliance thinking across an organization rather than inside a single silo. It is aimed at practitioners in governance, strategy, performance, risk, compliance, ethics, internal control, security, continuity, audit, assurance, or IT - and OCEG states that no specific experience or educational degree is required to apply, so newcomers and seasoned specialists both sit it. The GRCP case studies are 5 cases and about 2,711 words.
1One Heat Map, Three Risk Languages
A regional health insurer with 2,300 employees has just acquired a 400-person dental insurer. Six weeks after close, the board risk committee asks for a single enterprise heat map and one consolidated risk appetite statement by the end of the quarter.
563 words, about 3 min2Training Completion Without Learning
A construction and engineering firm with 4,800 employees and 60 active project sites reports 97% completion of annual code-of-conduct training and a phishing click rate that fell from 18% to 9% after a new simulation campaign. Yet near-miss reporting dropped 35% over twelve months, hotline calls are down by half, and two site supervisors admit they discourage workers from filing reports because 'it creates paperwork.' A site manager was dismissed for falsifying a safety checklist; workers on that site say no one ever explained their stop-work authority.
544 words, about 3 min3Launch Commitments Before Risk Appetite
A payments fintech with 700 employees plans to launch a card-issuing product in Brazil in 90 days. The board approved a risk appetite statement two years ago that says the company has 'low tolerance for regulatory and reputational risk,' but it contains no quantified thresholds, no country risk criteria, and no product-specific limits.
546 words, about 3 min4An Acknowledgement Is Not a Control
A global logistics company onboards 1,100 vendors a year through a shared service center. Policy requires risk-based due diligence before any vendor receives system access or handles customer data.
538 words, about 3 min5A Dashboard That Cannot See Itself
A municipal water utility with 1,200 employees is regulated by a state environmental agency and a public utility commission. Its compliance dashboard reports 96% of controls 'in place' and zero overdue corrective actions.
520 words, about 3 min