OSMR study plan

Build a one-page map of the OSMR domain by listing every subtopic named in the exam blueprint and marking each as known, shaky, or unknown

Define in your own words the core operational-risk concepts the blueprint lists, writing one sentence per concept without copying source wording

Collect the governing regulations, standards, and supervisory guidance the blueprint references and record the exact citation and issuing body for each

Write 20 recall questions from your topic map and score yourself cold, before any study, to establish a baseline

Explain how operational risk is defined and scoped relative to credit, market, and liquidity risk, and where the boundaries blur

Trace the event-type taxonomy end to end and classify 15 short real-world incident descriptions into the correct category

Distinguish near-miss, internal loss, external loss, and gain events, and justify each classification in writing

Draft a one-page glossary of 25 domain terms with your own definitions and one example each

Walk through each phase of the risk management cycle and state the inputs, outputs, and owner of every phase

Compare the three-lines-of-defense model with the roles the blueprint assigns to board, senior management, and control functions

Identify which governance failures most often appear in supervisory findings and write two paragraphs on why each recurs

Build a table mapping each governance role to its specific accountability and reporting line

Apply the standard risk-assessment approach to three hypothetical processes and score each on likelihood and impact

Distinguish inherent from residual risk and calculate residual exposure for two scenarios after applying named controls

Explain how key risk indicators are selected, thresholded, and escalated, and critique two weak indicator designs

Compare qualitative, quantitative, and hybrid assessment methods and state when each is defensible

Explain the purpose and structure of a risk register and populate one with 12 entries drawn from earlier weeks

Describe how scenario analysis and stress testing are used for operational risk and where their limits lie

Outline how risk appetite is set, cascaded into tolerances, and monitored, including the escalation path when a tolerance is breached

Diagnose five short case vignettes and name the control weakness and the corrective action for each

Sequence the steps of a business impact analysis and identify critical processes, dependencies, and recovery targets

Write recovery time and recovery point objectives for three processes and defend the numbers against a stated disruption scenario

Compare incident response, business continuity, and crisis management and state the trigger that moves an event from one to the next

Design a post-incident review process that captures root cause and feeds lessons back into the risk register

Summarize the reporting and disclosure expectations the blueprint places on firms, including what must be reported, to whom, and how often

Explain how operational risk capital is determined and contrast the approaches the framework permits

Describe the supervisory examination and review process and what evidence a firm must be able to produce on request

Identify the outsourcing, third-party, and technology-related obligations in the framework and map them to controls

Retake the week 1 diagnostic and record the score change against your baseline

Complete two timed practice sets under exam conditions and review every miss to its root cause

Rewrite your weakest three subtopics from memory as one-page summaries without notes

Build a final one-page recall sheet of formulas, definitions, and framework structures to review in the last 48 hours