PRMIA ORM flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

Impact tolerance

The maximum tolerable level of disruption to an important business service, stated as a quantity and time frame set by the board before a disruption occurs.

Important business service

A service whose disruption would cause material harm to customers, markets, or the firm's safety and soundness, and which is therefore mapped and tested for resilience.

Severe-but-plausible scenario

A stress scenario extreme enough to challenge impact tolerances while remaining credible, used to test whether important business services can continue through disruption.

Recovery point objective

The maximum tolerable amount of data loss, expressed in time, that a service can sustain after disruption; it constrains backup and replication design.

Single point of failure

A provider, system, site, or person whose loss alone disrupts a service; resilience mapping aggregates these across services to reveal concentration.

Exit plan

A documented, tested arrangement for transferring or terminating a critical third-party service without breaching impact tolerances or disrupting customers.

Three lines model

A governance structure where the business owns risk, a risk and compliance function provides oversight and challenge, and internal audit gives independent assurance.

Inherent versus residual risk

Inherent risk is exposure before controls are applied; residual risk is the remaining exposure after assessing control design and operating effectiveness.

Risk appetite versus tolerance

Appetite is the amount and type of risk the firm is willing to accept for its strategy; tolerance is the measurable deviation permitted around that appetite.

Risk capacity

The maximum risk a firm could bear before breaching hard constraints such as regulatory capital, liquidity, or legal obligations; appetite must sit below capacity.

Key risk indicator

A forward-looking metric with defined thresholds that signals changes in a risk driver, enabling action before losses or breaches materialise.

Risk register

A structured record of risks with cause, event, consequence, likelihood, impact, owner, controls, residual rating, and treatment plan, reviewed periodically.

Risk treatment options

The four responses to evaluated risk: avoid the activity, reduce likelihood or impact through controls, transfer via insurance or contracts, or accept with approval.

COSO ERM components

Governance and culture; strategy and objective-setting; performance; review and revision; information, communication and reporting - linking risk management directly to strategy.

Physical climate risk

Risk from acute hazards such as floods and storms and chronic shifts such as temperature change, affecting assets, supply chains, collateral, and productivity.

Transition climate risk

Risk from the shift to a low-carbon economy, including carbon pricing, policy change, technology substitution, litigation, and demand or reputational shifts.

Scope 3 emissions

Indirect emissions across the value chain, including suppliers and use of sold products; hardest to measure and usually estimated with proxies.

Climate scenario analysis

Exploration of plausible climate pathways, such as orderly transition or hot-house world, to assess directional impacts on portfolios over short, medium, and long horizons.

Climate risk transmission channel

The route by which climate drivers become financial risk, for example through credit quality, collateral values, market pricing, insurance, or operational disruption.

TCFD pillars

Four disclosure areas - governance, strategy, risk management, and metrics and targets - used as a common reference for climate-related financial reporting.

Stranded asset

An asset that loses economic value ahead of schedule because of transition policy, technology, or demand shifts, creating credit and market exposure.

Board risk committee

A board-level committee that oversees risk appetite, the risk framework, and material exposures, and receives escalation of significant breaches and emerging risks.

Chief risk officer independence

The CRO should not sit in a revenue-generating function, should have direct board access, and should hold authority over limits and escalations.

Policy hierarchy

The layered structure from board-approved risk appetite statement, through risk policies, to standards and procedures, each stating scope, roles, limits, and review frequency.

Limit breach escalation

A defined process for reporting exceeded limits to the appropriate committee, approving time-bound temporary excesses, and recording remediation ownership.

Risk culture indicators

Observable signals such as escalation behaviour, tolerance of bad news, incentive design, and how breaches are handled, used to assess whether stated values are real.

Delegated authority

Explicit, tiered permission for individuals or committees to approve exposures, exceptions, or transactions, documented so accountability is traceable.

Compliance risk definition

The risk of legal or regulatory sanctions, material financial loss, or reputational damage from failing to comply with laws, rules, and standards of conduct.

Obligation register

A mapping of each regulatory requirement to its owning process, control, and evidence, updated through horizon scanning as rules change.

Compliance monitoring versus testing

Monitoring is ongoing surveillance of activity by the first or second line; testing is independent, sample-based verification that controls operate effectively.

Conduct risk

The risk arising from how the firm and its staff behave toward customers and markets, evidenced by complaints, mis-selling, and conflicts of interest.

Breach management lifecycle

The sequence of logging a compliance breach, classifying severity, root-cause analysis, remediation, and reporting to committees or regulators where required.