Become a versatile professional who integrates governance, strategy, performance, risk, compliance, ethics, security, privacy, and audit to achieve Principled Performance. The GRC Professional (GRCP) certification demonstrates that you have the understanding and skills to apply GRC in your organization.
Get certified by the global nonprofit that invented GRC 20 years ago
What is the GRCP?
The GRC Professional (GRCP) certification validates that you understand and can apply GRC in your organization. It ensures that you have the versatile skill set to integrate and advise on governance, strategy, performance, risk, compliance, ethics, internal control, security, privacy, and audit activities.
What does the GRCP Cover?
The GRCP is based on the essential body of knowledge used daily by GRC Professionals. With the help of hundreds of experts, this body of knowledge was identified, analyzed, and documented in the GRC Capability Model.
We recommend using these resources to prepare for the GRCP Exam
GRC Fundamentals is a self-study online course provided to deepen your understanding of the GRC Capability Model
GRC Fundamentals LIVE is offered by our global training partners to provide localized language, more context, and implementation examples.
While the exam does not require course attendance, 94% of people who pass on the first attempt report that a course helped them pass.
Benefits of certification from the creators of GRC
GRCP comes from the organization and community that created GRC over 20 years ago. You are learning from and getting certified by THE authoritative source!
Unique Benefits of GRCP
Rather than just focusing on a single discipline, GRCP integrates multiple disciplines and helps you become a versatile professional.
GRCP allows you to integrate governance, strategy, performance, risk, compliance, ethics, security, internal controls, and audit.
Integration. Integrate your work with business operations.
Versatility. Cut across the critical disciplines to be more effective.
Communication. Communicate with diverse audiences.
Compensation. Obtain new jobs and accelerate your career.
GRCP is perfect for anyone who works in - governance, strategy, performance, risk, compliance, ethics, internal control, security, continuity, audit, assurance, or IT. GRCP helps to integrate what you do with the other departments and disciplines, including mainline business operations.
Our certifications are open and accessible to all professionals. We accept candidates from diverse cultural, educational, and professional backgrounds. We do not require specific experience or educational degrees to apply.
When should I get GRCP?
GRCP is a versatile certification aimed to serve versatile needs for professionals in all stages of their careers. Professionals can use the GRCP in several scenarios:
Starter. Some professionals use the GRCP as a starting point for their careers. By understanding and applying GRC capabilities, you get the full breadth of governance, strategy, risk, compliance, security, and audit, in any organization. You will gain traction ahead of your peers no matter what role you are in today – and it also gives you a well-rounded and versatile foundation to grow into other roles in other disciplines over time!
Enhancer. Some professionals use the GRCP to enhance an existing certification in risk, compliance, security, or audit. For example, a risk manager may have a certification in quantitative risk management – GRCP helps to integrate risk concepts with business operations as well as governance, strategy, compliance, security, and audit. An audit manager may have a certification in internal audit – GRCP helps to integrate audit concepts with business operations as well as governance, strategy, risk, compliance, and security. All of this makes you well-rounded and versatile.
Capstone. Some professionals use the GRCP as a capstone “on top of” a collection of existing certifications. GRCP uniquely integrates the many disciplines of governance, strategy, risk, compliance, security, and audit. Professionals with one or more certifications in those disciplines find value in how GRCP cohesively pulls everything together into a framework and methodology.
For new and experienced professionals
New Professionals
GRCP is the perfect way to start your career. By understanding and applying all critical disciplines, you have a broad foundation to build a career in any GRC role. GRCP helps you understand the inner workings within and between other departments, including how they operate, think, and what they need to succeed.
Experienced Professionals
GRCP is the perfect way to enhance existing certifications and to upgrade skills in areas where you lack experience. You may already have a certification from one of the many associations. However, most of these associations focus on a SINGLE discipline. GRCP helps to make you more VERSATILE and well-rounded.
What are you waiting for?
Purchase an All Access Pass to access the GRCP and all of our other certifications.
The GRCP certification exam covers both awareness (definitions, terms, and lists) and the application of concepts and knowledge of the GRC Capability Model. The exam breaks out as follows:
15% General Knowledge
Understand key terms and definitions related to GRC
Understand key principles and business drivers behind GRC
Understand the benefits of integrating GRC
Understand how GRC relates to other disciplines/professions
85% GRC Capability Model Details
Understand components, elements, and practices
Understand key actions and controls
Understand design and implementation considerations
An extensive job analysis of over 500 GRC Professionals determined GRCP topics and questions. Participants in the job analysis analyzed over 200 skills and determined their significance to a GRC professional, executive, or auditor.
The job analysis and other research yielded a blueprint that serves as a competency model for the GRCP. We update the GRC Capability model and GRC Professional Exam periodically to reflect important and relevant changes in GRC disciplines and practices.
Principles, outcomes, and key terms. Prove that you can communicate across disciplines using a common and unambiguous vocabulary.
Core components, practices, and activities. Demonstrate understanding of the components and elements of the GRC Capability model.
Relationship of GRC to disciplines. Discuss how GRC incorporates the governance, management, and audit of strategy, performance, risk, and compliance.
All of our certifications use a similar streamlined process. We pride ourselves on simplicity and accessibility. All of our exams are online and available at any time. No need to schedule! We include everything you need as part of your All Access Pass. To be clear, everything is included for no additional fees.
1. Get All Access Pass
Our All Access Pass provides everything you need to prepare for the GRCP and all of our other certification exams. One fee for education, preparation, certification, and maintenance.
We offer GRC Fundamentals via self-study or by attending an in-person course delivered by one of our authorized partners (a great choice if you want localized language and additional examples).
Our self-study programs are delivered in English and subtitled in English, Spanish, Arabic, and Bahasa. Need another language? Let us know.
Essential body of knowledge and self-study are included for no additional fees.
3. Apply for GRCP
Our certifications are open and accessible to all professionals. We accept candidates from diverse cultural, educational, and professional backgrounds.
We do not require specific experience or educational degrees to apply.
Just complete a simple form at the beginning of the exam to update your information and agree to the code of conduct.
Application is included for no additional fees.
4. Earn the GRCP (Pass!)
Access the online exam anywhere and anytime.
The exam is limited to two hours (120 minutes) to answer 100 questions. Correctly answer 70 questions to pass. Exams are "open book," which means that you may use Google and other resources while taking an exam.
You can retake an exam up to six times per year to pass it.
Fulfill all requirements to maintain your GRCP, including an active membership and completing the required continuing professional education every year.
GRCP requires eight (8) continuing professional education (CPE) credits every year.
All certifications are included for no additional fees.
How long is my certificate valid?
A streamlined approach to gain and maintain your certification.
We use continuing education requirements to ensure that you stay current with new developments in GRC. You can review the other requirements to maintain your GRCP certification.
When a certificate is awarded, it is awarded for a full year starting on the day you passed the exam.
Your first full year has no CPE requirement (because you spent at least 8 hours preparing for and taking the exam).
Starting your second year, you must earn at least eight (8) credits of continuing education related to the certification topic annually.
When a certificate renews, it renews for a full year. Automatic renewal on the day of certificate expiration happens if both of these conditions are true: a) Member has an active AAP and b) CPE requirement has been met (if applicable).
If the expiration date passes and you do not meet both conditions, you have a grace period of 90 days to fulfill the requirements (renewing your AAP and/or getting enough credits). After the grace period is over, your certification gets deleted from our records, and certificates are no longer available for display.
Preparation time varies based on your experience. People who pass the exam report anywhere from 2 hours to 40 hours of preparation before the exam.
This wide range is explained by the differences in background. If you are more experienced in governance, strategy, risk, compliance, ethics, security, or audit, then less time may be required to prepare vs. someone who is new to GRC.
What is the best way to prepare for GRCP?
The essential body of knowledge for the GRCP is contained in the open-source GRC Capability Model (“Red Book”). We recommend that you:
We offer GRC Fundamentals via self-study or by attending an in-person course delivered by one of our authorized partners. Training partners are a great choice if you want the training delivered in your native language and want additional context and examples for applying the concepts. Our self-study programs are delivered in English and subtitled in English, Spanish, Arabic, and Bahasa.
What does it cost to get GRCP training?
All of our self-study preparation courses are included for no additional fees. This means that GRC Fundamentals is part of your All Access Pass.
Our global training partners charge separate fees for in-person experiences delivered in the localized language. These experiences also provide additional context and examples so that you understand how to implement solutions.
FAQ about the GRCP Exam
How do I schedule the GRCP Exam?
All of our exams are online and available at any time. No need to schedule!
How do I apply for the GRCP exam?
Applying for GRCP is simple! If you are already an OCEG member, we have most of the information necessary. Just complete a simple form at the beginning of the exam to update your information and agree to the code of conduct.
As a reminder, our certifications are open and accessible to all professionals. We accept candidates from diverse cultural, educational, and professional backgrounds. We do not require specific experience or educational degrees to apply.
How difficult is the GRCP Exam?
Most people who pass the exam report that they carefully studied the GRC Capability Model and completed the GRC Fundamentals course.
Those who fail tend to pass on a subsequent attempt if they study and complete GRC Fundamentals or attend a training course with an OCEG training partner.
In other words ... STUDY and WATCH the videos or attend a class if you want to pass the exam.
What is on the GRCP Exam?
The GRCP certification exam covers both awareness (definitions, terms, and lists) and the application of concepts and knowledge of the GRC Capability Model. The exam breaks out as follows:
15% General Knowledge
Understand key terms and definitions related to GRC
Understand key principles and business drivers behind GRC
Understand the benefits of integrating GRC
Understand how GRC relates to other disciplines/professions
85% GRC Capability Model Details
Understand components, elements, and practices
Understand key actions and controls
Understand design and implementation considerations
GRCP topics and questions were determined by conducting an extensive job analysis of over 500 GRC Professionals. Participants in the job analysis were asked to analyze over 200 skills and determine their significance to a GRC professional, executive, or auditor. The job analysis and other research yielded a blueprint that serves as a competency model for the GRCP.
We update the GRC Capability model and GRC Professional Exam periodically to reflect important and relevant changes in GRC disciplines and practices.
How many questions are on the GRCP Exam?
There are 100 scored questions and up to 15 unscored questions on the exam. We calculate your final score on the 100 scored questions. Scored questions have gone through a rigorous validation process.
The unscored questions are used to introduce and validate new questions without affecting your score. However, the unscored items are not labeled – so make sure you answer each question as if it counts!
All questions are multiple choice.
How do I pass the GRCP Exam?
You have 2 hours to complete the exam. You must correctly answer 70 of the 100 scored items.
Is the GRCP Exam "open book" like the real world?
Yes! The GRCP Exam is open-book, which means that you may use Google and other resources while taking the exam.
We believe that the exam process should reflect modern reality and user experiences. In your job, you use Google and online resources daily. You should be able to use these resources when you learn and when you take the exam.
However, don't be fooled! The exam is challenging even with the help of these resources.
When do I find out if I passed the GRCP?
You get your result immediately after taking the exam. If you pass, your certificate is immediately available for sharing and printing.
What happens if I fail the GRCP?
You may retake the exam up to six (6) times per year. Almost everyone is able to accomplish this goal. We believe that certification should be part of the learning process and help reinforce understanding and not just be a point-in-time proof of memorized knowledge.
Consider being fully prepared each time that you attempt the exam. Our database of questions is extensive, so it is unlikely that you will see the same questions each time that you attempt the exam.
FAQ about Maintaining GRCP
How long is my certificate valid?
When a certificate is awarded, it is awarded for a full year starting on the day you passed the exam.
Your first full year has no CPE requirement (because you spent at least 8 hours preparing for and taking the exam).
Starting your second year, you must earn at least eight (8) credits of continuing education related to the certification topic annually.
When a certificate renews, it renews for a full year. Automatic renewal on the day of certificate expiration happens if both of these conditions are true: a) Member has an active AAP and b) CPE requirement has been met (if applicable).
If the expiration date passes and you do not meet both conditions, you have a grace period of 90 days to fulfill the requirements (renewing your AAP and/or getting enough credits). After the grace period is over, your certification gets deleted from our records, and certificates are no longer available for display.
Do I need to recertify every year?
NO! You only need to pass the exam once every five (5) years. We use continuing education requirements to ensure that you stay current with new developments.
How do I maintain the GRCP?
All continuing education for OCEG certifications is automatically tracked and administered under a unified program on our website. Whenever you watch a video or attend an event on our website, it is automatically tracked and counted toward your GRCP (or other OCEG certifications as appropriate). You can see all of your current CPE credits on your Certification Dashboard.
The unified program allows you to track one CPE credit to multiple certifications. So, for example, a course on “Risk Assessments” would count toward not only GRCP but also several other certifications that rely on Risk Assessment skills.
Maintaining ALL of your certifications is simple and straightforward. We use a unified CPE program for all of our certifications and automatically track progress on your Certification Dashboard.
For GRCP, there are two main requirements:
Maintain an All Access Pass, and
Complete 8 hours of continuing professional education (CPE) every year
How do I submit CPEs for the GRCP?
You don’t have to!
All continuing education for OCEG certifications is automatically tracked and administered under a unified program on our website.
Whenever you watch a video or attend an event, such as a webinar on our website, it is automatically tracked and counted toward your GRCP (or other OCEG certifications as appropriate).
You may also manually submit CPEs from other pre-approved continuing education experiences.
You can check your CPE progress at any time on your CPE Dashboard.
Do I get "double credit" for CPEs?
Yes! Many of our continuing education experiences count toward multiple OCEG certifications. The unified program also allows you to track one CPE credit to multiple certifications. This means that a single webinar or course can count toward one or more of your certifications.
One experience. Multiple credits.
So, for example, a course on “Risk Assessments” would count toward not only GRCP but also several other certifications that rely on Risk Assessment skills.
Because GRCP is one of our core certifications, almost every CPE experience on our website counts toward your GRCP.
What are you waiting for?
Purchase an All Access Pass to get access to the GRCP and all of our other certifications.
Start your free membership and receive lifetime access to hundreds of free resources. Or level up and access our full resource library with an all access pass for you or your team (required for GRC Certification).
