PRMIA ORM cheat sheet

Operational resilience is the ability to prevent, adapt to, respond to, recover from, and learn from operational disruptions; it extends business continuity by demanding continued delivery of important business services under severe-but-plausible stress.

Impact tolerance is the maximum tolerable level of disruption to an important business service, expressed as a quantity (e.g., hours of outage, number of failed transactions) plus a time frame; it is set by the board, not by IT.

Mapping steps: identify important business services, set impact tolerances, map people/process/technology/data dependencies (including third parties), test against severe-but-plausible scenarios, then remediate gaps.

A severe-but-plausible scenario is extreme enough to test tolerance limits yet credible; firms typically test loss of a primary site, loss of a key third party, insider/cyber compromise, and simultaneous loss of redundant controls.

Concentration risk arises when many important business services depend on one provider, system, site, or geography; resilience analysis must aggregate these single points of failure across the service map.

Recovery time objective (RTO) is the target time to restore a service; recovery point objective (RPO) is the maximum tolerable data loss measured in time; impact tolerance is broader because it measures harm to end customers and markets, not just restoration.

Third-party resilience requires contractual rights to audit, exit plans, subcontractor visibility, and testing of substitutability; critical providers should be tested in the firm's own scenario exercises.

Incident escalation thresholds should be pre-agreed by severity, with defined triggers for board or regulator notification; post-incident reviews must feed corrective actions into the risk register with owners and dates.

The risk management process cycle: establish context, identify risks, analyse, evaluate against appetite, treat (avoid, reduce, transfer, accept), monitor and report, then review and improve.

COSO ERM components: governance and culture; strategy and objective-setting; performance; review and revision; information, communication and reporting - ERM links risk to strategy rather than treating it as a control add-on.

The three lines model: first line owns and manages risk; second line provides independent oversight, frameworks and challenge; third line (internal audit) gives independent assurance to the governing body.

Inherent risk is exposure before controls; residual risk is exposure after controls; control effectiveness is assessed on design and operating effectiveness separately, and residual risk should never be assumed zero.

Risk appetite is the amount and type of risk the firm is willing to accept in pursuit of strategy; risk tolerance is the measurable deviation allowed around appetite; risk capacity is the maximum risk the firm could bear before breaching constraints such as capital.

Risk registers record cause, event, consequence, likelihood, impact, owner, controls, residual rating and treatment plan; heat maps plot likelihood against impact but lose granularity and can hide correlated exposures.

Key risk indicators (KRIs) are forward-looking metrics with defined thresholds (green/amber/red) tied to appetite; they differ from key performance indicators, which measure outcomes rather than risk drivers.

Stress testing and scenario analysis test the framework under tail conditions; results must be used in capital, liquidity and strategic planning, otherwise the exercise is compliance theatre.

Physical risk arises from acute hazards (floods, storms, wildfires) and chronic shifts (sea-level rise, temperature change); it hits assets, supply chains, property collateral and workforce productivity.

Transition risk arises from the move to a low-carbon economy: policy and carbon pricing, technology substitution, litigation, and reputational or market shifts in demand.

Climate risk is a risk driver, not a standalone category: it transmits through credit, market, liquidity, operational and insurance risk, so it must be integrated into existing risk taxonomy rather than managed in a silo.

Time horizons matter: short (0-3 years), medium (3-10 years) and long (10+ years); traditional risk cycles rarely extend far enough, so scenario analysis supplements rather than replaces standard stress testing.

Scenario analysis uses qualitative and quantitative narratives (e.g., orderly transition, disorderly transition, hot-house world) to explore plausible pathways; outputs are directional, not forecasts.

Data gaps are structural: emissions data for counterparties is often estimated (Scope 1 direct, Scope 2 purchased energy, Scope 3 value-chain), so proxies and disclosure quality should be flagged as limitations.

Concentration exposure includes geographic concentration in hazard-prone regions, sector concentration in carbon-intensive industries, and collateral concentration in exposed real estate.

Disclosure frameworks (TCFD-aligned governance, strategy, risk management, metrics and targets) are the common reference point; regulators increasingly require climate risk to be embedded in governance, appetite and reporting.

The board sets risk appetite, approves the risk framework, and oversees the control environment; it delegates execution to management committees but retains accountability for risk culture.

A typical structure: board risk committee, executive risk committee (CRO-chaired), asset-liability or product committees, and business-unit risk committees; escalation routes and quorum rules must be documented.

The chief risk officer should have independence from revenue-generating functions, direct access to the board or its risk committee, and sufficient authority over risk limits and escalations.

Three lines of defence in governance terms: business owns risk, risk and compliance functions set frameworks and challenge, internal audit provides independent assurance; each line reports through distinct channels.

Risk culture is evidenced by escalation behaviour, tolerance of bad news, incentive design, and how limit breaches are treated; tone at the top is necessary but not sufficient without consistent middle-management behaviour.

Policy hierarchy: board-approved risk appetite statement, then risk policies, then standards and procedures; a policy must state scope, roles, limits, escalation, exceptions and review frequency.

Limits and delegations: authorities should be explicit and tiered, with temporary excesses approved at defined levels and time-bound, and breaches logged and reported to the relevant committee.

Governance reporting should be decision-useful: aggregate risk profile against appetite, material breaches, emerging risks, and forward-looking indicators, with clear ownership of actions.

Compliance risk is the risk of legal or regulatory sanctions, material financial loss, or reputational damage from failure to comply with laws, regulations, rules, and standards of conduct.

Core compliance programme elements: governance and tone at the top, policies and procedures, training and communication, monitoring and testing, escalation and remediation, and independent audit.

A regulatory obligation register maps each requirement to the owning process, control, and evidence; horizon scanning captures new and changing rules and assigns impact assessments before deadlines.

Risk assessment should be risk-based: rate obligations by likelihood and impact, then allocate monitoring resources to higher-risk areas rather than applying uniform testing.

Monitoring is distinct from testing: monitoring is continuous or periodic surveillance by the first or second line; testing is independent, sample-based verification of control effectiveness.

Conduct risk focuses on how the firm and its staff behave toward customers and markets; indicators include complaints, mis-selling, conflicts of interest, and incentive-driven behaviour.

Breach management: log, classify severity, root-cause, remediate, and report to committees and regulators where required; repeat breaches signal control design failure rather than isolated error.

Financial crime compliance covers customer due diligence, beneficial ownership, sanctions and politically exposed person screening, transaction monitoring, and suspicious activity reporting, with record-keeping obligations.