Why GRC exams should test judgement, not recall

Ask an experienced risk manager what makes someone good at the job and few will mention the ability to recite a clause number. They will talk about judgement: knowing which risk matters, which control is worth its cost, when a finding is serious and when it is noise. Yet many professional exams in governance, risk and compliance still reward the opposite skill. They ask candidates to recall a definition, a list or the wording of a requirement.

That gap matters. An employer who hires a certified professional is buying a prediction: that this person will make sound decisions in situations the exam never described. A recall-based exam predicts very little about that.

What recall questions measure

A recall question has a single correct answer that exists, word for word, in the source material. "Which clause of ISO/IEC 27001 covers internal audit?" "What are the three lines of defence?" These questions are cheap to write and easy to mark, and they do test something real: familiarity with the vocabulary of the field.

Their weakness is that they can be passed by preparation that has nothing to do with practice. A candidate who has memorised a question bank can score well without ever having assessed a risk. And the questions say nothing about the hardest part of GRC work, which is applying several frameworks at once to an untidy, specific situation.

What a scenario question looks like

A scenario question gives the candidate a short, realistic situation and asks what they would do. For example:

A payments firm discovers that a cloud provider supporting its customer onboarding has quietly moved processing to a new subcontractor. Contracts are in place, the service is running normally and no incident has occurred. What should the risk function do first?

Every option might describe something a reasonable person could do: escalate to the board, terminate the contract, update the register of ICT arrangements, request the provider's subcontracting details and reassess the risk. Only one is the best first step given the facts, and choosing it requires the candidate to weigh materiality, regulatory obligations and proportionality together. That is the work.

How good scenario questions are built

Scenario questions are harder to write well than recall questions. At GRCP each question goes through the same path:

1. Blueprint first. Every question is written against a specific objective in a published exam domain, and each objective traces back to a standard or regulation. If a question cannot be mapped, it is not used.
2. Written by practitioners. Question writers are working professionals who do not deliver GRCP training. They draft scenarios from the kinds of decisions they actually face.
3. Independent review. A second subject expert checks that there is one defensible best answer, that the wrong options are plausible but clearly worse, and that the question does not depend on trivia or on reading speed.
4. Pilot before it counts. New questions appear unscored in live exams first. Only questions that perform well, meaning stronger candidates tend to get them right, become scored items.
5. Continuous review. After each exam window, question statistics are reviewed and weak or overexposed questions are retired.

Setting a defensible pass mark

A pass mark of "70%" means nothing on its own; it depends entirely on how hard the questions are. GRCP sets pass marks with a structured expert-judgement method based on the Angoff approach. A panel of practitioners considers each question and estimates how a minimally competent professional would perform on it. Those judgements, checked against data from pilot questions, set the standard. The aim is that a pass means the same thing from one exam form to the next.

What this means for candidates

Scenario-based exams are not harder to pass for people who do the job well. They are harder to pass for people who have only prepared for the exam. The best preparation is the one that also makes you better at the work: understand why a standard asks for what it asks for, practise applying frameworks to real cases, and get comfortable explaining the trade-offs behind a decision.

That is also the point of the credential. A GRCP holder should be someone an employer can hand an unfamiliar problem to, with confidence that the response will be proportionate, well reasoned and grounded in the frameworks the organisation is held to.