GRCP study plan

Define GRC as an integrated discipline and write a one-page explanation distinguishing governance, risk management, and compliance activities and how they interlock.

Map the GRC Capability Model's four components (Learn, Align, Perform, Review) and their sub-components into a single diagram from memory, then correct it against source material.

Explain the difference between principles-based and rules-based approaches and give two workplace examples of each.

List the core roles in a GRC program (board, executive sponsor, risk owners, control owners, internal audit, compliance) and state each role's primary accountability.

Explain the purpose and sequence of the Learn component within the overall GRC cycle and identify its two sub-components.

Describe how an organization defines its business context, objectives, and obligations during the Learn stage, and why scope decisions made here constrain everything downstream.

Distinguish internal context from external context and give three concrete inputs for each in a mid-size enterprise.

Connect Learn-stage outputs (objectives, obligations, risk appetite inputs) to the artifacts the Align stage consumes.

Detail the Learn component's sub-components and state the key activities, inputs, and outputs of each.

Explain how obligations are identified, catalogued, and attributed to accountable owners during Learn.

Describe how the Learn stage establishes the organization's risk universe and the criteria used to categorize it.

Identify three common failure modes of the Learn stage (e.g., incomplete obligation capture, stale context) and the downstream symptoms each produces.

Explain the Align component's purpose: translating objectives, obligations, and risk appetite into an integrated set of prioritized activities.

Describe how risk appetite and tolerance statements are set and how they drive prioritization and resource allocation.

Explain how the Align stage integrates risk, compliance, and internal control activities into a single plan rather than parallel silos.

Describe how policies, control frameworks, and performance metrics are established during Align and linked to specific obligations.

Trace one obligation from the Learn stage through Align into a named control and a named metric.

Complete the Align component by explaining how the resulting plan is communicated, resourced, and approved by governance bodies.

Explain the Perform component's purpose: executing the aligned plan and operating controls as designed.

Describe how control activities are performed, evidenced, and recorded so that performance is auditable after the fact.

Identify the data and reporting that flow from Perform back into risk and compliance registers.

Detail the Perform component's sub-components and state the key activities, inputs, and outputs of each.

Explain how issues, incidents, and control failures are captured, escalated, and tracked to resolution during Perform.

Describe how third-party and outsourced activities are brought into Perform execution and evidence collection.

Explain the role of GRC technology and data integration in supporting Perform, and name two limitations of tooling alone.

Explain the Review component's purpose: independently evaluating whether the GRC program is designed and operating effectively.

Distinguish monitoring activities from independent assurance and state who owns each.

Describe how review findings feed back into Learn and Align, closing the GRC cycle, and give one concrete feedback loop example.

Explain how program maturity is assessed during Review and what evidence supports a maturity rating.

Recite the full GRC Capability Model structure, all components and sub-components, from memory without notes.

Complete a timed 60-question mixed-domain practice set weighted 30/15/20/25/10 and score each domain separately.

Re-teach the three weakest sub-components in writing, at least 150 words each, without consulting source material first.

Build a one-page exam-day reference sheet of the distinctions most easily confused (Learn vs. Align inputs, Perform vs. Review ownership, monitoring vs. assurance).