The essential body of knowledge for the GRCA is contained in the open-source GRC Capability Model (“Red Book”) and the GRC Assessment Tools and audit concepts in the public domain. We recommend that you:

• Carefully study the GRC Capability Model
• Carefully study the GRC Assessment Tools
• Attend online self-study GRC Audit Fundamentals course
• (optionally) Attend in-person GRC Audit Fundamentals LIVE! course

We offer GRC Audit Fundamentals via self-study or by attending an in-person course delivered by one of our authorized partners. Training partners are a great choice if you want the training delivered in your native language and want additional context and examples for applying the concepts. Our self-study programs are delivered in English and subtitled in English, Spanish, Arabic, and Bahasa.

All of our self-study preparation courses are included for no additional fees. This means that GRC Audit Fundamentals is part of your All Access Pass.

Our global training partners charge separate fees for in-person experiences delivered in the localized language. These experiences also provide additional context and examples so that you understand how to implement solutions.

Applying is simple! If you are already an OCEG member, we have most of the information necessary. Just complete a simple form at the beginning of the exam to update your information and agree to the code of conduct.

As a reminder, our certifications are open and accessible to all professionals. We accept candidates from diverse cultural, educational, and professional backgrounds. We do not require specific experience or educational degrees to apply.

Most people who pass the exam report that they carefully studied the GRC Capability Model, studied GRC Assessment tools, and completed the GRC Audit Fundamentals course.

Those who fail tend to pass on a subsequent attempt if they study and complete GRC Audit Fundamentals or attend a training course with an OCEG training partner.

In other words ... STUDY and WATCH the videos or attend a class if you want to pass the exam.

The GRCA certification exam covers both awareness (definitions, terms, and lists) and applying concepts and knowledge of the GRC Capability Model and GRC Assessment Tools. The exam breaks out as follows:

22% General Knowledge

• Understand key terms and definitions related to GRC
• Understand key principles and business drivers behind GRC
• Understand the benefits of integrating GRC
• Understand how GRC relates to other disciplines/professions

67% Assurance and Assessment

• Understand assurance and assessment models
• Understand key steps in planning and performing assessments
• Understand report design and follow-up

11% GRC Assessment Tools

• Understand the content of the GRC Assessment Tools
• Understand how to apply based on the scope of the assessment

An extensive job analysis of GRC Professionals who also held various audit certifications (CPA, CA, CIA, CISA) determined GRCA topics and questions. Participants in the job analysis analyzed hundreds of skills and determined their significance to a GRC auditor.

The job analysis and other research yielded a blueprint that serves as a competency model for the GRCA. We update the GRC Audit Exam periodically to reflect important and relevant changes.

An extensive job analysis of GRC Professionals who also held various audit certifications (CPA, CA, CIA, CISA) determined GRCA topics and questions. Participants in the job analysis analyzed hundreds of skills and determined their significance to a GRC auditor.

The job analysis and other research yielded a blueprint that serves as a competency model for the GRCA. We update the GRC Audit Exam periodically to reflect important and relevant changes.

There are 45 scored questions and up to 15 unscored questions on the exam. We calculate your final score on the 45 scored questions. Scored questions have gone through a rigorous validation process.

The unscored questions are used to introduce and validate new questions without affecting your score. However, the unscored items are not labeled – so make sure you answer each question as if it counts!

All questions are multiple-choice.

You have one (1) hour to complete the exam. You must correctly answer 32 of the 45 scored questions.

Yes! The exam is open-book, meaning you may use Google and other resources while taking the exam.

We believe that the exam process should reflect modern reality and user experiences. In your job, you use Google and online resources daily. You should be able to use these resources when you learn and when you take the exam.

However, don't be fooled! The exam is challenging even with the help of these resources.

You get your result immediately after taking the exam. If you pass, your certificate is immediately available for sharing and printing from your Certification Dashboard.

You may retake the exam up to six (6) times per year. Almost everyone is able to accomplish this goal. We believe that certification should be part of the learning process and help reinforce understanding and not just be a point-in-time proof of memorized knowledge.

Consider being fully prepared each time that you attempt the exam. Our database of questions is extensive, so it is unlikely that you will see the same questions each time that you attempt the exam.

NO! You only need to pass the exam once every five (5) years. We use continuing education requirements to ensure that you stay current with new developments.

All continuing education for OCEG certifications is automatically tracked and administered under a unified program on our website. Whenever you watch a video or attend an event on our website, it is automatically tracked and counted toward your GRCA (or other OCEG certifications as appropriate).

You can see all of your current CPE credits on your Certification Dashboard.

The unified program allows you to track one CPE credit to multiple certifications. So, for example, a course on “Risk Assessments” would count toward not only GRCA but also several other certifications that rely on Risk Assessment skills.

Maintaining ALL of your certifications is simple and straightforward. We use a unified CPE program for all of our certifications and automatically track progress on your Certification Dashboard.

For GRCA, there are two main requirements:

1. Maintain an All Access Pass, and
2. Complete 8 hours of continuing professional education (CPE) every year

You don’t have to!

All continuing education for OCEG certifications is automatically tracked and administered under a unified program on our website.

Whenever you watch a video or attend an event, such as a webinar on our website, it is automatically tracked and counted toward your GRCA (or other OCEG certifications as appropriate).

You may also manually submit CPEs from other pre-approved continuing education experiences.

You can check your CPE progress at any time on your CPE Dashboard.

Yes! Many of our continuing education experiences count toward multiple OCEG certifications. The unified program also allows you to track one CPE credit to multiple certifications. This means that a single webinar or course can count toward one or more of your certifications.

One experience. Multiple credits.

So, for example, a course on “Risk Assessments” would count toward not only GRCA but also several other certifications that rely on Risk Assessment skills.

Because GRCA is one of our core certifications, almost every CPE experience on our website counts toward your GRCA.