GRC Professional Certification (GRCP™)

The essential body of knowledge for the GRCP is contained in the open-source GRC Capability Model (“Red Book”). We recommend that you:

• Carefully study the GRC Capability Model
• Attend online self-study GRC Fundamentals course
• (optionally) Attend in-person GRC Fundamentals LIVE! course
• Practice exam questions

We offer GRC Fundamentals via self-study or by attending an in-person course delivered by one of our authorized partners. Training partners are a great choice if you want the training delivered in your native language and want additional context and examples for applying the concepts. Our self-study programs are delivered in English and subtitled in English, Spanish, Arabic, and Bahasa.

All of our self-study preparation courses are included for no additional fees. This means that GRC Fundamentals is part of your All Access Pass.

Our global training partners charge separate fees for in-person experiences delivered in the localized language. These experiences also provide additional context and examples so that you understand how to implement solutions.

Applying for GRCP is simple! If you are already an OCEG member, we have most of the information necessary. Just complete a simple form at the beginning of the exam to update your information and agree to the code of conduct.

As a reminder, our certifications are open and accessible to all professionals. We accept candidates from diverse cultural, educational, and professional backgrounds. We do not require specific experience or educational degrees to apply.

Most people who pass the exam report that they carefully studied the GRC Capability Model and completed the GRC Fundamentals course.

Those who fail tend to pass on a subsequent attempt if they study and complete GRC Fundamentals or attend a training course with an OCEG training partner.

In other words ... STUDY and WATCH the videos or attend a class if you want to pass the exam.

The GRCP certification exam covers both awareness (definitions, terms, and lists) and the application of concepts and knowledge of the GRC Capability Model. The exam breaks out as follows:

15% General Knowledge

• Understand key terms and definitions related to GRC
• Understand key principles and business drivers behind GRC
• Understand the benefits of integrating GRC
• Understand how GRC relates to other disciplines/professions

85% GRC Capability Model Details

• Understand components, elements, and practices
• Understand key actions and controls
• Understand design and implementation considerations
• Learn – 20%, Align – 30%, Perform – 30%, Review – 5%

GRCP topics and questions were determined by conducting an extensive job analysis of over 500 GRC Professionals. Participants in the job analysis were asked to analyze over 200 skills and determine their significance to a GRC professional, executive, or auditor. The job analysis and other research yielded a blueprint that serves as a competency model for the GRCP.

We update the GRC Capability model and GRC Professional Exam periodically to reflect important and relevant changes in GRC disciplines and practices.

There are 100 scored questions and up to 15 unscored questions on the exam. We calculate your final score on the 100 scored questions. Scored questions have gone through a rigorous validation process.

The unscored questions are used to introduce and validate new questions without affecting your score. However, the unscored items are not labeled – so make sure you answer each question as if it counts!

All questions are multiple choice.

You have 2 hours to complete the exam. You must correctly answer 70 of the 100 scored items.

Yes! The GRCP Exam is open-book, which means that you may use Google and other resources while taking the exam.

We believe that the exam process should reflect modern reality and user experiences. In your job, you use Google and online resources daily. You should be able to use these resources when you learn and when you take the exam.

However, don't be fooled! The exam is challenging even with the help of these resources.

You get your result immediately after taking the exam. If you pass, your certificate is immediately available for sharing and printing.

You may retake the exam up to six (6) times per year. Almost everyone is able to accomplish this goal. We believe that certification should be part of the learning process and help reinforce understanding and not just be a point-in-time proof of memorized knowledge.

Consider being fully prepared each time that you attempt the exam. Our database of questions is extensive, so it is unlikely that you will see the same questions each time that you attempt the exam.

NO! You only need to pass the exam once every five (5) years. We use continuing education requirements to ensure that you stay current with new developments.

All continuing education for OCEG certifications is automatically tracked and administered under a unified program on our website. Whenever you watch a video or attend an event on our website, it is automatically tracked and counted toward your GRCP (or other OCEG certifications as appropriate). You can see all of your current CPE credits on your Certification Dashboard.

The unified program allows you to track one CPE credit to multiple certifications. So, for example, a course on “Risk Assessments” would count toward not only GRCP but also several other certifications that rely on Risk Assessment skills.

Maintaining ALL of your certifications is simple and straightforward. We use a unified CPE program for all of our certifications and automatically track progress on your Certification Dashboard.

For GRCP, there are two main requirements:

1. Maintain an All Access Pass, and
2. Complete 8 hours of continuing professional education (CPE) every year

You don’t have to!

All continuing education for OCEG certifications is automatically tracked and administered under a unified program on our website.

Whenever you watch a video or attend an event, such as a webinar on our website, it is automatically tracked and counted toward your GRCP (or other OCEG certifications as appropriate).

You may also manually submit CPEs from other pre-approved continuing education experiences.

You can check your CPE progress at any time on your CPE Dashboard.

Yes! Many of our continuing education experiences count toward multiple OCEG certifications. The unified program also allows you to track one CPE credit to multiple certifications. This means that a single webinar or course can count toward one or more of your certifications.

One experience. Multiple credits.

So, for example, a course on “Risk Assessments” would count toward not only GRCP but also several other certifications that rely on Risk Assessment skills.

Because GRCP is one of our core certifications, almost every CPE experience on our website counts toward your GRCP.