PRMIA ORM common mistakes
PRMIA ORM · Understand the traps and how to avoid them.
When asked how to treat a risk that sits inside the institution's stated risk appetite, the candidate still recommends escalation to the board or a full risk-mitigation project instead of accepting and monitoring the exposure.
Candidates carry over a reflex from exam prep that every risk must be 'managed', and they miss that appetite statements exist precisely to define which exposures are tolerable without further action. The question stem usually signals this with wording such as 'within tolerance' or 'consistent with the approved appetite'.
What to do instead
Before answering, locate the appetite/tolerance language in the stem. If the exposure is inside it, the correct action is usually accept-and-monitor with defined triggers for re-review. Reserve escalation and mitigation for breaches or for exposures with no approved limit.
Treating the three lines model as a hierarchy in which the second line supervises and approves the first line's day-to-day risk decisions, and assigning ownership of a specific risk to internal audit.
The functions are described in the study material as separate roles with different objectives, but candidates collapse them into a chain of command. They also confuse 'independent assurance' with 'ownership', which leads them to place accountability in the wrong function.
What to do instead
Memorise the division by objective: first line owns and manages the risk, second line sets frameworks, limits, and independent challenge, third line provides independent assurance to the governing body. Ownership always stays in the business; audit never owns a risk and never designs the controls it later reviews.
Answering a business continuity or resilience question by naming the recovery objective (RTO or RPO) as the deliverable, rather than describing the impact-tolerance analysis and the capability to stay within it during a disruption.
RTO and RPO are the most familiar terms in the continuity vocabulary, so candidates reach for them as a shortcut. Operational resilience questions, however, are framed around important business services and impact tolerance, and an answer that stops at a recovery time misses the point being tested.
What to do instead
For any resilience question, structure the answer as: identify important business services, set impact tolerance for each, map the dependencies and interconnections that deliver them, test against severe-but-plausible scenarios, and treat the output as a board-level decision. Cite RTO only as an internal recovery input, not as the tolerance itself.
Assuming a severe-but-plausible scenario should be built from the largest loss observed in the institution's own history, and rejecting scenarios that have never occurred as unrealistic.
Candidates default to historical data because it feels defensible, and they underweight the exam's emphasis on forward-looking scenario design. They also confuse plausibility with probability, so an event with low likelihood but catastrophic impact is dismissed.
What to do instead
Build severe-but-plausible scenarios from a defined impact threshold (for example, disruption to an important business service or breach of a regulatory obligation) and work backwards to causes, drawing on sector events and expert judgement rather than only the firm's own loss record. Justify plausibility by mechanism, not by past frequency.
Describing physical climate risk and transition risk as if they were the same, or listing 'climate change' as a single risk without separating the channels through which it transmits into credit, market, liquidity, and operational risk.
The taxonomy is simple on paper but candidates answer at the level of the headline hazard. They also miss that transition risk arises from the move to a lower-carbon economy, including policy, technology, and reputational shifts, and therefore can materialise without any physical event.
What to do instead
For each climate question, name the risk type (physical acute, physical chronic, transition) and then state the transmission channel into a conventional risk category with a concrete example, such as coastal property collateral affecting credit risk or a carbon price affecting a corporate borrower's cash flow.
Treating climate scenario analysis as a forecasting exercise and criticising a scenario for producing an implausible central estimate, instead of evaluating whether it explores a plausible range and informs strategic decisions.
Candidates apply the standards of statistical forecasting to a tool designed for exploring uncertainty over long horizons. They then reject the scenario on the wrong grounds and miss the answer that focuses on decision-usefulness and range.
What to do instead
Judge climate scenarios on purpose: do they cover a plausible range of pathways, use a consistent set of assumptions over a long horizon, and produce outputs that inform strategy, capital, and disclosure? Note explicitly that the output is not a point forecast and that scenario choice is a judgement to be documented.
Answering a compliance-risk question by focusing on the legal or regulatory penalty alone, and omitting the wider consequences such as customer harm, remediation cost, loss of licence to operate, and reputational damage.
Compliance risk is often mentally filed as 'fines', so candidates stop at the monetary penalty. The exam frames compliance risk broadly as the risk of regulatory sanctions, financial loss, and reputational damage from failure to comply, and questions often test the non-financial consequences.
What to do instead
When defining or assessing compliance risk, list all consequence categories: regulatory sanction, financial loss, customer detriment and redress, reputational harm, and restrictions on business activity. Where a question asks for the primary concern, look for the answer that reflects the institution's obligations to customers and markets, not just the fine.
Confusing the governing body's role with that of senior management, for example saying the board should design the risk framework or approve individual transactions, or saying management sets the risk appetite.
Both groups appear in governance questions and the verbs sound interchangeable. Candidates miss the distinction between oversight and approval on one side and execution and design on the other, which is the exact point being tested.
What to do instead
Anchor on two verbs: the governing body approves and oversees (appetite, framework, senior appointments, challenge), while senior management designs, implements, and operates within that framework. If an answer has the board doing operational design or management setting appetite without board approval, it is almost certainly wrong.
Presenting risk culture as a set of written policies and training completion rates, rather than describing observable behaviours, incentives, and the tone set from the top that shape how people actually act.
Culture is intangible, so candidates grasp for measurable artefacts. The exam treats culture as behaviour and incentives, and answers built only on documents and completion metrics are marked as surface-level.
What to do instead
Describe culture through what can be observed: how escalation is rewarded or penalised, whether bad news travels upward, how performance and remuneration align with risk-taking, and how leaders respond to breaches. Use policy and training only as supporting evidence, not as the definition.
Treating risk appetite, risk tolerance, and risk limits as synonyms and using them interchangeably in an answer about framework design.
The terms are closely related and often used loosely in practice, so candidates do not fix the distinctions. Questions that ask how appetite is cascaded through the organisation then expose the gap.
What to do instead
Fix the hierarchy: appetite is the high-level statement of the risk the institution is willing to accept in pursuit of its strategy; tolerance is the acceptable variation around that appetite for a given risk; limits are the quantitative thresholds applied to business lines and portfolios. Show the cascade from statement to limit and the escalation trigger when a limit is breached.