ORM Designation study plan
ORM Designation · Give each week a clear focus.
8 weeks · About 6 hours per week
Operational Risk Management (CORM syllabus content)
Map the full CORM syllabus structure and define the boundaries of each operational risk sub-area before reading any detail
Build a personal glossary of at least 40 core ORM terms with one-sentence working definitions
Explain the distinction between operational, credit, market, and strategic risk using two original examples each
Draft a one-page risk taxonomy that classifies operational risk events by cause, event type, and impact
Your checkpoint
A one-page risk taxonomy plus a 40-term glossary file, both self-authored and reviewed for gaps
Operational Risk Management (CORM syllabus content)
Explain the four classic risk response strategies (avoid, reduce, transfer, accept) and apply each to a worked scenario
Describe how risk appetite and tolerance statements are set and cascaded through an organization
Distinguish inherent from residual risk and calculate residual exposure for three sample scenarios
Summarize the purpose and limitations of risk registers and risk and control self-assessments (RCSAs)
Your checkpoint
Three fully worked scenario write-ups (200 words each) showing risk identification, response choice, and residual risk calculation
Operational Risk Management (CORM syllabus content)
Identify and describe the main categories of operational risk loss events, including process, people, systems, and external events
Explain the role of internal control frameworks in mitigating operational risk and name the components of a control environment
Distinguish preventive, detective, and corrective controls and classify ten sample controls
Describe how control weaknesses and control failures are identified, escalated, and remediated
Your checkpoint
A control classification table of ten controls tagged by type, risk addressed, and failure mode
Operational Risk Management (CORM syllabus content)
Explain the purpose and mechanics of key risk indicators (KRIs) and distinguish leading from lagging indicators
Design five KRIs with thresholds, owners, and escalation triggers for a hypothetical firm
Describe how incident and near-miss data are collected, categorized, and fed back into risk assessment
Outline how risk reporting flows to senior management and the board, including frequency and content
Your checkpoint
A KRI dashboard specification for five indicators, each with thresholds, owner, and escalation action
Operational Risk Management (CORM syllabus content)
Explain the three Basel approaches to operational risk capital: Basic Indicator, Standardised, and Advanced Measurement
Compare the strengths and weaknesses of each approach and identify which firms typically use each
Describe how scenario analysis and external loss data supplement internal loss data in capital modeling
Compute a simplified capital charge under the Basic Indicator and Standardised approaches for a sample firm
Your checkpoint
A worked capital calculation sheet showing both approaches side by side with a short comparison note
Operational Risk Management (CORM syllabus content)
Explain business continuity management and distinguish it from disaster recovery and crisis management
Describe the purpose of a business impact analysis and identify recovery time and recovery point objectives
Outline how outsourcing, third-party, and supply-chain risks are assessed and monitored
Describe how model risk and data quality risk arise and how they are governed
Your checkpoint
A business impact analysis outline for one business function, including RTO, RPO, and dependency mapping
Operational Risk Management (CORM syllabus content)
Explain the three lines of defense model and the responsibilities of each line
Describe the role of internal audit in providing independent assurance over operational risk management
Outline regulatory expectations and supervisory review practices relevant to operational risk
Apply lessons from major public operational risk failures to identify control gaps in a hypothetical firm
Your checkpoint
A governance map showing the three lines of defense with named responsibilities and escalation paths
Operational Risk Management (CORM syllabus content)
Consolidate all eight weeks of notes into a single condensed review sheet of no more than ten pages
Complete at least 120 original practice questions across all sub-areas and log every error by topic
Re-explain the five weakest topics aloud or in writing without consulting notes
Simulate a timed exam session and analyze pacing and accuracy by sub-area
Your checkpoint
A ten-page condensed review sheet plus an error log with accuracy percentage per sub-area and a remediation list
Milestones
Week 2: Can define all 40 glossary terms from memory and correctly apply the four risk response strategies to a new unseen scenario without notes
Week 4: Can classify any given control by type and explain how the associated KRI would detect its failure, scoring at least 80 percent on a self-made classification quiz
Week 6: Can compute both Basic Indicator and Standardised capital charges correctly and explain when each approach applies, with no reference material
Week 8: Scores at least 75 percent on the timed simulation and has a written remediation list for every sub-area below 70 percent