GRC Professional Certification (GRCP)

Become a versatile professional who integrates governance, strategy, performance, risk, compliance, ethics, security, privacy, and audit to achieve Principled Performance. The GRC Professional (GRCP) certification demonstrates that you have the understanding and skills to apply GRC in your organization.

Globally Recognized GRC Certification

Get certified by the global nonprofit that invented GRC 20 years ago

What is the GRCP?

The GRC Professional (GRCP) certification validates that you understand and can apply GRC in your organization. It ensures that you have the versatile skill set to integrate and advise on governance, strategy, performance, risk, compliance, ethics, internal control, security, privacy, and audit activities.

What does the GRCP Cover?

The GRCP is based on the essential body of knowledge used daily by GRC Professionals. With the help of hundreds of experts, this body of knowledge was identified, analyzed, and documented in the GRC Capability Model.

We recommend using these resources to prepare for the GRCP Exam

While the exam does not require course attendance, 94% of people who pass on the first attempt report that a course helped them pass.

Is GRCP right for me?

GRCP is perfect for anyone who works in - governance, strategy, performance, risk, compliance, ethics, internal control, security, continuity, audit, assurance, or IT. GRCP helps to integrate what you do with the other departments and disciplines, including mainline business operations.

Our certifications are open and accessible to all professionals. We accept candidates from diverse cultural, educational, and professional backgrounds. We do not require specific experience or educational degrees to apply.

When should I get GRCP?

GRCP is a versatile certification aimed to serve versatile needs for professionals in all stages of their careers. Professionals can use the GRCP in several scenarios:

For new and experienced professionals

  1. New Professionals

    GRCP is the perfect way to start your career. By understanding and applying all critical disciplines, you have a broad foundation to build a career in any GRC role. GRCP helps you understand the inner workings within and between other departments, including how they operate, think, and what they need to succeed.

  2. Experienced Professionals

    GRCP is the perfect way to enhance existing certifications and to upgrade skills in areas where you lack experience. You may already have a certification from one of the many associations. However, most of these associations focus on a SINGLE discipline. GRCP helps to make you more VERSATILE and well-rounded.

How do I get the GRCP Certification?

All of our certifications use a similar streamlined process. We pride ourselves on simplicity and accessibility. All of our exams are online and available at any time. No need to schedule! We include everything you need as part of your All Access Pass. To be clear, everything is included for no additional fees.

  1. 1. Get All Access Pass

    Our All Access Pass provides everything you need to prepare for the GRCP and all of our other certification exams. One fee for education, preparation, certification, and maintenance.

    Everything is included for no additional fees.

  2. 2. Prepare for GRCP

    Study the essential body of knowledge contained in the GRC Capability Model (“Red Book”) and attend GRC Fundamentals to learn how to apply it.

    We offer GRC Fundamentals via self-study or by attending an in-person course delivered by one of our authorized partners (a great choice if you want localized language and additional examples).

    Our self-study programs are delivered in English and subtitled in English, Spanish, Arabic, and Bahasa. Need another language? Let us know.

    Essential body of knowledge and self-study are included for no additional fees.

  3. 3. Apply for GRCP

    Our certifications are open and accessible to all professionals. We accept candidates from diverse cultural, educational, and professional backgrounds.

    We do not require specific experience or educational degrees to apply.

    Just complete a simple form at the beginning of the exam to update your information and agree to the code of conduct.

    Application is included for no additional fees.

  4. 4. Earn the GRCP (Pass!)

    Access the online exam anywhere and anytime.

    The exam is limited to two hours (120 minutes) to answer 100 questions. Correctly answer 70 questions to pass. Exams are "open book," which means that you may use Google and other resources while taking an exam.

    You can retake an exam up to six times per year to pass it.

    The GRCP Exam is offered at the end of the GRC Fundamentals course, but you may directly access it at any time without watching the GRC Fundamentals videos.

    All retakes are included for no additional fees.

  5. 5. Maintain the GRCP

    Fulfill all requirements to maintain your GRCP, including an active membership and completing the required continuing professional education every year.

    GRCP requires eight (8) continuing professional education (CPE) credits every year.

    All CPEs are included for no additional fees.

  6. 6. BONUS! Add More Certifications

    Apply to gain additional certifications. We add new certifications regularly.

    All certifications are included for no additional fees.

FAQ about Preparing for GRCP

How long does it take to prepare for GRCP?

Preparation time varies based on your experience. People who pass the exam report anywhere from 2 hours to 40 hours of preparation before the exam.

This wide range is explained by the differences in background. If you are more experienced in governance, strategy, risk, compliance, ethics, security, or audit, then less time may be required to prepare vs. someone who is new to GRC.

What is the best way to prepare for GRCP?

The essential body of knowledge for the GRCP is contained in the open-source GRC Capability Model (“Red Book”). We recommend that you:

  • Carefully study the GRC Capability Model
  • Attend online self-study GRC Fundamentals course
  • (optionally) Attend in-person GRC Fundamentals LIVE! course
  • Practice exam questions
How do I get GRCP Training?

We offer GRC Fundamentals via self-study or by attending an in-person course delivered by one of our authorized partners. Training partners are a great choice if you want the training delivered in your native language and want additional context and examples for applying the concepts. Our self-study programs are delivered in English and subtitled in English, Spanish, Arabic, and Bahasa.

What does it cost to get GRCP training?

All of our self-study preparation courses are included for no additional fees. This means that GRC Fundamentals is part of your All Access Pass.

Our global training partners charge separate fees for in-person experiences delivered in the localized language. These experiences also provide additional context and examples so that you understand how to implement solutions.

FAQ about the GRCP Exam

How do I schedule the GRCP Exam?

All of our exams are online and available at any time. No need to schedule!

How do I apply for the GRCP exam?

Applying for GRCP is simple! If you are already an OCEG member, we have most of the information necessary. Just complete a simple form at the beginning of the exam to update your information and agree to the code of conduct.

As a reminder, our certifications are open and accessible to all professionals. We accept candidates from diverse cultural, educational, and professional backgrounds. We do not require specific experience or educational degrees to apply.

How difficult is the GRCP Exam?

Most people who pass the exam report that they carefully studied the GRC Capability Model and completed the GRC Fundamentals course.

Those who fail tend to pass on a subsequent attempt if they study and complete GRC Fundamentals or attend a training course with an OCEG training partner.

In other words ... STUDY and WATCH the videos or attend a class if you want to pass the exam.

What is on the GRCP Exam?

The GRCP certification exam covers both awareness (definitions, terms, and lists) and the application of concepts and knowledge of the GRC Capability Model. The exam breaks out as follows:

15% General Knowledge

  • Understand key terms and definitions related to GRC
  • Understand key principles and business drivers behind GRC
  • Understand the benefits of integrating GRC
  • Understand how GRC relates to other disciplines/professions

85% GRC Capability Model Details

  • Understand components, elements, and practices
  • Understand key actions and controls
  • Understand design and implementation considerations
  • Learn – 20%, Align – 30%, Perform – 30%, Review – 5%
How was the GRCP Exam developed?

GRCP topics and questions were determined by conducting an extensive job analysis of over 500 GRC Professionals. Participants in the job analysis were asked to analyze over 200 skills and determine their significance to a GRC professional, executive, or auditor. The job analysis and other research yielded a blueprint that serves as a competency model for the GRCP.

We update the GRC Capability model and GRC Professional Exam periodically to reflect important and relevant changes in GRC disciplines and practices.

How many questions are on the GRCP Exam?

There are 100 scored questions and up to 15 unscored questions on the exam. We calculate your final score on the 100 scored questions. Scored questions have gone through a rigorous validation process.

The unscored questions are used to introduce and validate new questions without affecting your score. However, the unscored items are not labeled – so make sure you answer each question as if it counts!

All questions are multiple choice.

How do I pass the GRCP Exam?

You have 2 hours to complete the exam. You must correctly answer 70 of the 100 scored items.

Is the GRCP Exam "open book" like the real world?

Yes! The GRCP Exam is open-book, which means that you may use Google and other resources while taking the exam.

We believe that the exam process should reflect modern reality and user experiences. In your job, you use Google and online resources daily. You should be able to use these resources when you learn and when you take the exam.

However, don't be fooled! The exam is challenging even with the help of these resources.

When do I find out if I passed the GRCP?

You get your result immediately after taking the exam. If you pass, your certificate is immediately available for sharing and printing.

What happens if I fail the GRCP?

You may retake the exam up to six (6) times per year. Almost everyone is able to accomplish this goal. We believe that certification should be part of the learning process and help reinforce understanding and not just be a point-in-time proof of memorized knowledge.

Consider being fully prepared each time that you attempt the exam. Our database of questions is extensive, so it is unlikely that you will see the same questions each time that you attempt the exam.

FAQ about Maintaining GRCP

How long is my certificate valid?
  1. When a certificate is awarded, it is awarded for a full year starting on the day you passed the exam.
  2. Your first full year has no CPE requirement (because you spent at least 8 hours preparing for and taking the exam).
  3. Starting your second year, you must earn at least eight (8) credits of continuing education related to the certification topic annually.
  4. When a certificate renews, it renews for a full year. Automatic renewal on the day of certificate expiration happens if both of these conditions are true: a) Member has an active AAP and b) CPE requirement has been met (if applicable).
  5. If the expiration date passes and you do not meet both conditions, you have a grace period of 90 days to fulfill the requirements (renewing your AAP and/or getting enough credits). After the grace period is over, your certification gets deleted from our records, and certificates are no longer available for display.
Do I need to recertify every year?

NO! You only need to pass the exam once every five (5) years. We use continuing education requirements to ensure that you stay current with new developments.

How do I maintain the GRCP?

All continuing education for OCEG certifications is automatically tracked and administered under a unified program on our website. Whenever you watch a video or attend an event on our website, it is automatically tracked and counted toward your GRCP (or other OCEG certifications as appropriate). You can see all of your current CPE credits on your Certification Dashboard.

The unified program allows you to track one CPE credit to multiple certifications. So, for example, a course on “Risk Assessments” would count toward not only GRCP but also several other certifications that rely on Risk Assessment skills.

Maintaining ALL of your certifications is simple and straightforward. We use a unified CPE program for all of our certifications and automatically track progress on your Certification Dashboard.

For GRCP, there are two main requirements:

  1. Maintain an All Access Pass, and
  2. Complete 8 hours of continuing professional education (CPE) every year
How do I submit CPEs for the GRCP?

You don’t have to!

All continuing education for OCEG certifications is automatically tracked and administered under a unified program on our website.

Whenever you watch a video or attend an event, such as a webinar on our website, it is automatically tracked and counted toward your GRCP (or other OCEG certifications as appropriate).

You may also manually submit CPEs from other pre-approved continuing education experiences.

You can check your CPE progress at any time on your CPE Dashboard.

Do I get "double credit" for CPEs?

Yes! Many of our continuing education experiences count toward multiple OCEG certifications. The unified program also allows you to track one CPE credit to multiple certifications. This means that a single webinar or course can count toward one or more of your certifications.

One experience. Multiple credits.

So, for example, a course on “Risk Assessments” would count toward not only GRCP but also several other certifications that rely on Risk Assessment skills.

Because GRCP is one of our core certifications, almost every CPE experience on our website counts toward your GRCP.