Certified Risk and Compliance Management Professional (CRCMP), distance learning and online certification program

(Note: This is the Certified Risk and Compliance Management Professional (CRCMP) program. It is different from the Certified Regulatory and Compliance Professional (CRCP) program, provided by FINRA, which can be found at https://www.finra.org).


The CRCMP has become one of the most recognized certificates in risk management and compliance. There are CRCMPs in 32 countries. Companies and organizations like Accenture, American Express, USAA etc. consider the CRCMP a preferred certificate.

You can find more about the demand for CRCMPs at: www.risk-compliance-association.com/CRCMP_Jobs_Careers.pdf


The CRCMP program has been designed to provide with the knowledge and skills needed to understand and support regulatory compliance and enterprise wide risk management. The course provides with the skills needed to pass the Certified Risk and Compliance Management Professional (CRCMP) exam.

Target Audience

The CRCMP certification program is beneficial to:
- Managers and employees involved in the design and implementation of risk and compliance related strategies, policies, procedures, risk assessments, control activities, testing, documentation, monitoring and reporting.
- Vendors, suppliers and service providers.

This course is intended for employers demanding qualified professionals that meet the fit and proper requirements.

Course Synopsis

Part A: Introduction to governance, risk, compliance, risk management.

Governance and corporate governance.
Basel Committee, Corporate governance principles for banks.
The OECD (Organization for Economic Cooperation and Development) principles of corporate governance.
OECD Corporate Governance Factbook, 2019 edition.
FSB, Thematic Review on Risk Governance.
FSB, Thematic Review on Corporate Governance.
FSB, Strengthening Governance Frameworks to Mitigate Misconduct Risk.
Case studies.

What is risk?
Risk and uncertainty.
Risk in the corporate and the military environment.
Risk response.
Risk acceptance.
Risk avoidance.
Risk transfer, risk sharing.
Risk mitigation.
Is risk a good or a bad thing?
Risk and opportunity, US National Intelligence Strategy.
Cyber risks.
Policies, Procedures, Baselines, Guidelines, Ethics.
Threats and Vulnerabilities.
Case studies.

Understanding risk management.
Risk Management Problems.
Risk perception, optimism bias, availability bias, control bias, narrative bias.
Over-optimism, misrepresentation, alarmism, prejudice.
Risk management in the corporate and the military environment.
NIST Special Publication 800-30.
Risk Mitigation Methodology Flowchart.
Case studies.

The Chief Compliance Officer (CCO).
Regulatory reporting.
Enterprise wide risk and compliance program.
Compliance and the compliance function in banks, Basel Committee.
Case studies.

Outsourcing and Risk Management.
Key Risks of Outsourcing.

Part B: Sarbanes-Oxley, an international standard.

The need.
Companies affected.
American Depository Receipt (ADR) program.
Employees affected.
Foreign Private Issuers (FPIs) and Sarbanes-Oxley compliance.
EDGAR - Electronic Data Gathering, Analysis, and Retrieval system.
Case Studies.

The Sarbanes-Oxley Act.
Key sections, what we need to know.
Board's new responsibilities.
Management’s testing and documentation.
Management’s responsibilities.
Committees and teams.
Sections 302, 404, 906: The three certifications.
Sections 302, 404, 906: Examples and case studies.

The Securities and Exchange Commission (SEC) and the Sarbanes-Oxley Act.
The PCAOB and the new Auditing Standards: What we need to know.
Control Deficiency.
Deficiency in Design.
Deficiency in Operation.
Significant Deficiency.
Material Weakness.

The Scope of the Sarbanes-Oxley Act.
Software and Spreadsheets after the Sarbanes-Oxley Act.
Service providers.

E-SOX, the European Sarbanes-Oxley.
The 8th Company Law Directive of the European Union.
Ahold, Parmalat and the new rules.
Article 45 - Registration and oversight of third-country auditors and audit entities.
The “equivalence” of a third country.
Article 46 - Derogation in the case of equivalence.

J-SOX, the Japanese Sarbanes-Oxley.
From Enron to Livedoor, Kokudo, Kanebo.
The Financial Instruments and Exchange Law.
J-SOX requirements similar to the U.S. Sarbanes-Oxley Act.
“Corporate Responsibility for Financial Reports”
“Management Assessment of Internal Controls”
From the Financial Services Agency (FSA), to the Certified Public Accountants and Auditing Oversight Board (CPAAOB), to the Securities and Exchange Surveillance Commission (SESC).

Part C: Basel II, Basel III – the new international standards in governance, risk and compliance

The Bretton Woods Agreement.
Bankhaus Herstatt.
The Bank for International Settlements (BIS).
The Basel Committee on Banking Supervision (BCBS).
The purposes of the Basel framework.

Basel I, Basel II, Basel III.
Basel I - The First Basel Capital Accord.
Basel II - The major amendment.
Pillar 1: Minimum capital requirements.
Pillar 2: Supervisory review process.
Pillar 3: Market discipline.
Branch office vs. subsidiary.
Credit risk, market risk, operation risk.
Operating, Operations, Operational risks.
Seven Event Types (Loss Categories).
The 8 business lines.

Delphi method - exploring the future.
5 categories of control breakdowns.

The Basel III amendment.
The objective of the reform.
Basel III, sound corporate governance principles.
A. Board practices.
B. Senior management.
C. Risk management and internal controls.
D. Compensation.
E. Complex or opaque corporate structures.
F. Disclosure and transparency.
The role of the supervisors.

Part D: The Frameworks

The Committee of Sponsoring Organizations (COSO).
1992, COSO Internal Control — Integrated Framework.
The COSO cube.

Control Environment.
Risk Assessment.
Control Activities.
Information and Communication.

Effectiveness and Efficiency of Operations.
Reliability of Financial Reporting.
Compliance with applicable laws and regulations.

2013, COSO Internal Control — Integrated Framework.
The updated COSO cube.
Example: Cyber risk and COSO.

2004 - The COSO Enterprise Risk Management (ERM) Framework.
The differences between COSO and COSO ERM.
Components of Enterprise Risk Management.
The COSO ERM cube.

Is COSO ERM needed for compliance?
Internal Environment.
Objective Setting.
Event Identification.
Risk Assessment.
Risk Response.
Control Activities.
Information and Communication.

Objectives: Strategic, Operations, Reporting, Compliance.
ERM – Application Techniques.
2017 - The updated COSO ERM.
Enterprise Risk Management and Strategy Selection.

Part E: Designing and implementing a risk and compliance program

Which is the best program?
Principles of Effective Compliance Programs, from the US Bureau of Industry and Security.
Comprehensive compliance programs.
U.S. Department of Justice, Evaluation of Corporate Compliance Programs.
The three fundamental questions.
1. Is the Corporation’s Compliance Program Well Designed?
2. Is the Corporation’s Compliance Program Being Implemented Effectively?
3. Does the Corporation’s Compliance Program Work in Practice?

Closing remarks.

Become a Certified Risk and Compliance Management Professional (CRCMP)

For secure payment we work with PayPal, the faster and safer way to make online payments. With PayPal we minimize the cost of administration and compliance with national and international laws, so we can keep the cost of our programs and services so low.

Only PayPal receives your credit card number and your financial information. We receive your full name, your email, and your mail address. According to the PayPal rules, you have the option to ask for a full refund up to 60 days after the payment. If you do not want one of our programs or services for any reason, all you must do is to send us an email and we will refund the payment, no questions asked.

When you click "Buy Now" below, you will be redirected to the PayPal web site. Your payment will be received by our strategic partner and service provider, Cyber Risk GmbH (Rebackerstrasse 7, 8810 Horgen, Switzerland, Handelsregister des Kantons Zürich, Firmennummer: CHE-244.099.341). Cyber Risk GmbH may also send certificates to all members.

We will send the program up to 24 hours after the payment. Please remember to check the spam folder of your email client too, as emails with attachments or heavier than 100KB are often landed in the spam folder.

The all-inclusive cost is $297. There is no additional cost, now or in the future, for this program.


What is included in this price:

A. The official presentations (1,660 slides)

The presentations are effective and appropriate to study online or offline. Busy professionals have full control over their own learning and are able to study at their own speed. They are able to move faster through areas of the course they feel comfortable with, but slower through those that they need a little more time on.

B. Up to 3 online exam attempts per year

Candidates must pass only one exam to become CRCMPs. If they fail, they must study the official presentations and retake the exam. Candidates are entitled to 3 exam attempts every year.

If candidates do not achieve a passing score on the exam the first time, they can retake the exam a second time.

If they do not achieve a passing score the second time, they can retake the exam a third time.

If candidates do not achieve a passing score the third time, they must wait at least one year before retaking the exam. There is no additional cost for any additional exam attempts.

To learn more, you may visit:


C. The certificate

Processing and posting via registered mail with tracking number. Certificates are usually dispatched every 10 weeks.

Frequently Asked Questions

1. I want to learn more about the International Association of Risk and Compliance Professionals (IARCP).

The IARCP is wholly owned by Compliance LLC, a company incorporated in Wilmington NC and offices in Washington DC, a provider of risk and compliance training in 36 countries.

Several business units of Compliance LLC are very successful associations that offer standard, premium, and lifetime membership, weekly or monthly updates, training, certification, Authorized Certified Trainer (ACT) programs, advocacy, and other services to their members.

2. Does the association offer training?

The IARCP offers distance learning and online certification programs in all countries, and in-house instructor-led training in companies and organizations in many countries.

A. Distance learning and online certification programs.

A1. Certified Risk and Compliance Management Professional (CRCMP). To learn more, you may visit: www.risk-compliance-association.com/Distance_Learning_and_Certification.htm

A2. Certified Information Systems Risk and Compliance Professional (CISRCP). To learn more, you may visit: www.risk-compliance-association.com/CISRCP_Distance_Learning_and_Certification.htm

A3. Certified Risk and Compliance Management Professional in Insurance and Reinsurance CRCMP(Re)I. To learn more, you may visit: www.risk-compliance-association.com/CRCMP_Re_I.htm

A4. Certified Cyber (Governance Risk and Compliance) Professional CC(GRC)P. To learn more, you may visit: www.risk-compliance-association.com/CC_GRC_P_Distance_Learning_and_Certification.htm

B. Instructor-led training.

The association develops and maintains four certification programs, and tailors presentations and training programs for directors, executive managers, risk and compliance managers, internal and external auditors, data owners, process owners, consultants, suppliers, and service providers.

For instructor-led training, you may contact Lyn Spooner.

3. Is there any discount available for the distance learning programs?

Unfortunately, we do not offer any discount for the first program. We want to keep the cost of the programs so low for all members.

You have a $100 discount only after you purchase one of our programs. The discount applies to each additional program of the association.

For example, you can purchase the CRCMP program for $297, and then purchase the CISRCP program for $197 (instead of $297), and/or the CC(GRC)P program for $197 (instead of $297), and/or the CRCMP(Re)I program for $197 (instead of $297).

4. Why do you accept payments via PayPal only, for the distance learning programs?

There are important threats to data security in today's IT landscape. On top of that, new data protection regulations around the world put tough requirements on organisations that store “personally identifiable data”, including credit card information. These two factors could increase the cost of our programs dramatically.

We accept payments via PayPal for the distance learning programs, to minimize the cost of compliance and administration. PayPal keeps and protects your financial information, not us, so we can keep the cost of the program so low.

With PayPal you have some additional benefits. You can keep the program for 59 days to evaluate it, and if you do not like it, you can simply send us an email and ask for a full refund, no questions asked. We will refund your payment in less than 24 hours. PayPal offers this escrow service (an escrow generally refers to money held by a third-party, PayPal, on behalf of the transacting parties). In this way, there is absolutely no risk for you.

If you do not have a PayPal account and you do not want to create one, somebody else with a PayPal account can also pay for you. After the payment, just let us know, and we will update the record.

5. Are your training and certification programs vendor neutral?

Yes. We do not promote any products or services, and we are 100% independent.

6. I want to learn more about the exam.

You can take the exam online in the comfort of your home or office, in all countries. You will be given 90 minutes to complete a 35-question multiple-choice exam. You must score 70% or higher.

We do not send sample questions. If you study the presentations, you can score 100%.

When you are ready to take the CRCMP exam, you must follow the steps: https://www.risk-compliance-association.com/CRCMP_Certification_Steps_1.pdf

When you are ready to take the CISRCP exam, you must follow the steps: https://www.risk-compliance-association.com/CISRCP_Certification_Steps_1.pdf

When you are ready to take the CRCMP(Re)I exam, you must follow the steps: https://www.risk-compliance-association.com/CRCMP_Re_I_Certification_Steps.pdf

When you are ready to take the CC(GRC)P exam, you must follow the steps: https://www.risk-compliance-association.com/CC_GRC_P_Certification_Steps_1.pdf

7. How comprehensive are the presentations? Are they just bullet points?

The presentations are not bullet points. They are effective and appropriate to study online or offline.

8. Do I need to buy books to pass the exam?

No. If you study the presentations, you can pass the exam. All the exam questions are clearly answered in the presentations. If you fail the first time, you must study more. Print the presentations and use Post-it to attach notes, to know where to find the answer of a question.

9. Is it an open book exam? Why?

Yes, it is an open book exam. Risk and compliance management is something you must understand and learn, not memorize. You must acquire knowledge and skills, not commit something to memory.

10. Do I have to sit for the exam soon after receiving the presentations?

No. You can sit for the exam from your office or home, any time in the future. Your account never expires and there is no restriction of any kind.

11. Do I have to spend more money in the future to remain certified?

No. Your certificates never expire. They will be valid, without the need to spend money or to sit for another exam in the future.

12. Ok, the certificates never expire, but things change.

Recertification would be a great recurring revenue stream for the association, but it would also be a recurring expense for our members. We resisted the temptation to "introduce multiple recurring revenue streams to keep business flowing", as we were consulted. No recertification is needed for our programs.

Things change, and this is the reason you need to become (at no cost) a member of the association. Every Monday you can visit the "Reading Room" of the association and read our newsletter with updates, alerts and opportunities, to stay current.

13. How many hours do I need to study to pass the exam?

You must study the presentations at least twice, to ensure you have learned the details. The average time needed is 32 hours for the CRCMP program, 26 hours for the CISRCP program, 35 hours for the CC(GRC)P program, and 34 hours for the CRCMP(Re)I program, but there are important differences.

14. Why should I get certified?

Firms and organizations hire and promote "fit and proper" professionals who can provide evidence that they are qualified. Employers need assurance that employees have the knowledge and skills needed to mitigate risks and accept responsibility. Supervisors and auditors ask for independent evidence that the process owners are qualified, and that the controls can operate as designed, because the persons responsible for these controls have the necessary knowledge and experience.

The marketplace is clearly demanding qualified professionals in risk and compliance management. Certified professionals enjoy industry recognition and have more and better job opportunities. It is important to get certified and to belong to professional associations. You prove that you are somebody who cares, learns, and belongs to a global community of professionals.

15. Why should I choose your certification programs?

We strongly believe that we offer very good value for money.

a. The all-inclusive cost of our programs is very low. There is no additional cost for each program, now or in the future, for any reason.

b. If you purchase a second program from the association, you have a $100 discount. The all-inclusive cost for your second (and each additional) program is $197.

c. There are 3 exam attempts per year that are included in the cost of each program, so you do not have to spend money again if you fail.

d. No recertification is required. Your certificates never expire.

e. You become a member of the association, you get certified, and you receive weekly updates, news and alerts.