Governance · Risk · Compliance — London
Certified to do the work, not just describe it.
GRCP credentials test whether you can apply ISO/IEC 27001, ISO 31000, DORA and the frameworks your organisation is actually audited against. Scenario-based exams, set and marked independently of training.
Find your pathway
Which best describes the work you do?
Recommended
GRCP e-GRC · Enterprise GRC
You run risk registers, compliance programmes or internal control across the business. e-GRC examines enterprise risk, regulatory management and assurance.
View requirements01 — Credentials
One foundation.
Professional credentials for the work you do.
Every pathway starts with Foundation. Professional credentials require experience, a scenario-based exam and continuing professional education to maintain.
GRCP Foundation
The shared vocabulary of governance, risk, compliance and assurance, and how the main standards fit together.
- Requires
- None
- Exam
- 60 MCQ · 60 min
- Validity
- No expiry
e-GRC · Enterprise GRC
Governance, enterprise risk, compliance management and internal control across the whole organisation.
- Requires
- F + 2 yrs
- Exam
- 80 scenario · 150 min
- Validity
- 3 years
i-GRC · IT GRC
Information security governance, IT risk and technology regulation, from ISMS design to operational resilience.
- Requires
- F + 2 yrs
- Exam
- 80 scenario · 150 min
- Validity
- 3 years
GRCP-S · GRC Strategy
Strategy set and executed with governance built in: objectives tied to risk appetite, controls and obligations.
- Requires
- To be announced
- Exam
- To be announced
- Validity
- 3 years
GRCP-BA · Business Architecture
Capability maps, value streams and operating models designed to meet regulatory and control requirements.
- Requires
- To be announced
- Exam
- To be announced
- Validity
- 3 years
02 — Body of knowledge
Mapped to the frameworks you are audited against.
Every exam objective traces to a published standard or regulation, not a proprietary model. This is what each credential examines.
| Standard or regulation | GRCP-F | e-GRC | i-GRC |
|---|---|---|---|
| Governance and risk | |||
| Governance of organisationsISO 37000 | Introduced | Examined in depth | Introduced |
| Risk managementISO 31000 | Introduced | Examined in depth | Examined in depth |
| Internal controlCOSO Internal Control | Introduced | Examined in depth | Introduced |
| Compliance management systemsISO 37301 | Introduced | Examined in depth | Not covered |
| Auditing management systemsISO 19011 | Not covered | Examined in depth | Introduced |
| Information, technology and resilience | |||
| Information security managementISO/IEC 27001 · 27002 | Introduced | Introduced | Examined in depth |
| Business continuityISO 22301 | Introduced | Introduced | Examined in depth |
| AI management systemsISO/IEC 42001 | Not covered | Introduced | Examined in depth |
| Regulation | |||
| Data protectionUK GDPR · EU GDPR | Introduced | Examined in depth | Examined in depth |
| Digital operational resilienceDORA | Not covered | Introduced | Examined in depth |
| Network and information securityNIS2 | Not covered | Introduced | Examined in depth |
| Artificial intelligenceEU AI Act | Not covered | Introduced | Examined in depth |
03 — Certification
From first course to a credential anyone can verify.
Training is optional and delivered by accredited partners. The exam, the decision and the certificate are always GRCP's.
Step 1
Prepare
Self-study the body of knowledge or train with an accredited partner using official courseware.
16–32 hours · classroom, live online, in-houseStep 2
Book
Create a candidate account, confirm eligibility and book a slot, or redeem a voucher.
Experience checked for Level 2Step 3
Sit the exam
Scenario-based questions, delivered online with a remote proctor or at a test centre.
Result released in your accountStep 4
Get certified
Digital certificate and Open Badge, listed in the public registry under a unique number.
Verifiable by number or QRStep 5
Maintain
Log continuing professional education and uphold the Code of Ethics to keep the credential active.
60 CPE hours per 3-year cycle
04 — For enterprises
Evidence of competence, for the whole GRC function.
- Private cohorts. Training and exams scheduled around your team, in-house or online.
- Bulk vouchers. Buy once, assign to staff, track who has booked.
- Team dashboard. Credentials, expiry dates and CPE status in one view, ready for auditors and regulators.
| Team member | Credential | CPE | Status |
|---|---|---|---|
| SKS. Khan | i-GRC | 48/60 | Active |
| JMJ. Morgan | e-GRC | 21/60 | CPE due |
| LOL. Okafor | GRCP-F | — | Exam booked |
05 — Governance
Independent by design.
The people who train you never write, see or mark your exam. Our scheme is structured to the requirements of ISO/IEC 17024 for bodies certifying persons.
Training
Accredited training partners
Licensed to teach. Never involved in assessment.
Certification
GRCP certification body
Owns the scheme, the exam and every certification decision.
06 — Insights
From the GRCP editorial desk.
Mapping ISO/IEC 42001 to EU AI Act obligations
Where an AI management system covers the Act's requirements, where it falls short, and what the Digital Omnibus and the first harmonised standard change.
DORA in practice: what the register of information actually demands
What Article 28(3) and the implementing templates require, where firms struggle, and what a register that stands up to supervisory scrutiny looks like.
Why GRC exams should test judgement, not recall
How scenario-based questions are written, reviewed and set at a pass mark that means the same thing from one exam to the next.
07 — Founding cohort
Be among the first to hold a GRCP credential.
Exam registration opens with the founding cohort. Register interest to hear first about exam dates, accredited courses and founding cohort pricing.
- Priority booking for the first exam window
- Founding holder recognition in the public registry
- No commitment until you book