ORM Designation
CORM (Certificate in Operational Risk Management) - IOR Certification
More study resources
Cheat sheet
Keep the key ideas within reach.
ExploreKey terms
Get comfortable with the vocabulary.
ExploreStudy plan
Give each week a clear focus.
ExploreCommon mistakes
Understand the traps and how to avoid them.
ExploreCase studies
Put your knowledge to work in context.
ExploreExam-day guide
Prepare for the day ahead.
ExploreAbout this exam
The CORM (Certificate in Operational Risk Management) is a professional certification administered by the Institute of Operational Risk (IOR), a membership body that describes itself as promoting and developing the discipline of operational risk management, with chapters internationally. The certificate is aimed at practitioners who work in risk-related roles, or who want a structured grounding in operational risk as a discipline, and who want a recognised credential rather than only on-the-job experience. Content follows the IOR's own CORM syllabus, which candidates should download from the IOR site and use as the definitive scope document; the syllabus page is the only reliable statement of what is examinable, so build your study plan around its sections rather than around generic operational-risk textbooks. Preparation typically combines close reading of the syllabus topics with applied practice: mapping each topic to your own organisation's risk framework, incident data, and control environment, then testing yourself against the IOR's published sample questions. Note the critical timing issue: the IOR states that the CORM course is being fully phased out after 31 August 2025, that new enrolments are no longer accepted, and that re-sit applications, payments and exams must all be completed before that date. This page is independent study material and is not affiliated with, endorsed by, or produced by the IOR; always confirm current rules on the official IOR site before paying for anything.
What you'll study
About ORM Designation preparation
Can I still enrol on the CORM?
According to the IOR's own notice, no. The course is being fully phased out after 31 August 2025 and the Institute states it is no longer accepting new enrolments. If you were hoping to register fresh, check the IOR site directly, since this page does not speak for the Institute.
What is the deadline for a re-sit?
The IOR notice is explicit: students who need to apply or pay for a re-sit must do so before 31 August 2025 and must complete the exam by that date. After that date no further applications, payments or exams are accepted for the course. Plan backwards from that date.
What does the exam cover?
Scope is set by the IOR's published CORM syllabus, which is the authoritative list of examinable content. Treat that document as your specification: work through it section by section rather than relying on general operational-risk reading, because anything outside the syllabus is wasted study time.
How should I order my study?
Start with the syllabus structure and note which sections carry the most learning outcomes. Then study in the syllabus's own sequence, since later topics usually assume earlier vocabulary. Finish with timed self-testing using the IOR's sample questions, and revisit weak sections rather than re-reading everything.
What is the exam format and how long is it?
The source material available here does not state the question count, duration, format or pass mark, so we have not invented figures. Check the CORM syllabus and CORM FAQs pages on the IOR site for the definitive format before you sit the paper.
How hard is the CORM?
Difficulty is not published, so judge it by fit: candidates who already work in operational risk and can map syllabus topics to real incidents, controls and risk registers generally find the material familiar. Those coming from other disciplines should budget extra time for risk taxonomy and governance language.
Why do candidates fail operational risk exams?
The usual causes are studying generic material instead of the published syllabus, memorising definitions without being able to apply a framework to a scenario, and ignoring governance and reporting topics because they seem administrative. Practise explaining how a control would actually work in a given situation.
Is this page official IOR material?
No. This is independent study content written for candidates searching for the credential. It is not affiliated with, endorsed by, or produced by the Institute of Operational Risk. For enrolment, fees, syllabus versions and exam rules, use the IOR website, which is the only authoritative source.
Who do I contact with questions about closure?
The IOR's notice directs questions to its contact address published on the site. Use the official contact route rather than third-party forums, because closure dates and re-sit handling are administrative decisions only the Institute can confirm in writing.