GRCP study guide
GRCP · Work through your exam, one topic at a time.
The GRC Professional (GRCP™) certification is issued by OCEG, the nonprofit that originated the GRC discipline, and it validates that a holder can apply governance, risk, and compliance thinking across an organization rather than inside a single silo. It is aimed at practitioners in governance, strategy, performance, risk, compliance, ethics, internal control, security, continuity, audit, assurance, or IT - and OCEG states that no specific experience or educational degree is required to apply, so newcomers and seasoned specialists both sit it. The GRCP study guide has 5 sections and about 2,185 words.
01GRC Key Concepts
This domain tests whether you can define governance, risk management and compliance as one integrated capability and use OCEG's vocabulary precisely. Questions are definitional and conceptual: they ask you to separate terms that sound alike and explain why integration matters.
497 words, about 2 min02GRC Capability Model Details - Learn Component
This domain tests what the Learn component produces and how external and internal context feed GRC objectives, scope and strategy. Expect scenarios in which something changes in the environment and you must decide what should happen next.
439 words, about 2 min03GRC Capability Model Details - Align Component
The Align component converts understanding into commitment. This domain tests how governance structures, accountability, appetite, policy, culture and resources are arranged so the GRC program and the business point in the same direction.
415 words, about 2 min04GRC Capability Model Details - Perform Component
Perform is where the design meets reality. This domain tests how controls are designed, implemented and operated, how risk is treated, how obligations are met, and how issues, incidents and reporting are handled.
410 words, about 2 min05GRC Capability Model Details - Review Component
Review closes the loop. This domain tests monitoring, measurement, independent assurance, issue remediation and how findings feed back into Learn, Align and Perform so the capability improves rather than repeating the same failure.
424 words, about 2 min