PRMIA ORM key terms

The ability of a firm to prevent, adapt to, recover from and learn from operational disruptions, so that critical services to customers and markets continue at acceptable levels.

A service whose failure would cause material harm to customers, markets, or the firm's safety and soundness; it is the unit of analysis for resilience testing and impact tolerance setting.

The maximum tolerable level of disruption to an important business service, expressed as a metric and time limit, that the firm is willing to accept before harm becomes unacceptable.

A disruption scenario judged extreme yet realistic enough to test resilience, used to stress services, dependencies and recovery capability rather than to predict likelihood.

The target duration within which a process, system, or service must be restored after disruption to avoid breaching agreed service or impact tolerance levels.

Documented procedures that specify how a firm will maintain or restore critical operations during and after a disruption, including roles, resources, and communication arrangements.

A person, system, supplier, or facility whose failure alone would disrupt a critical service because no effective substitute or redundancy exists.

The risk arising from excessive reliance on a small number of suppliers, systems, locations, or counterparties, so that one failure propagates widely across services.

Risk created by a vendor's own subcontractors and supply chain, which can affect the firm's services even though no direct contractual relationship exists.

The risk that relying on an external provider for a process or service reduces the firm's control, continuity, or regulatory compliance, including on exit or provider failure.

A documented strategy for transferring or discontinuing an outsourced or critical service without unacceptable disruption, including timelines, costs, and alternative arrangements.

A pre-designated group with authority to coordinate the firm's response to a severe disruption, making decisions on escalation, communication, and resource allocation.

The structured process for detecting, logging, escalating, resolving, and learning from operational incidents, including root-cause analysis and remediation tracking.

The integrated set of governance, policies, processes, limits, and reporting arrangements through which a firm identifies, measures, monitors, and controls risk.

A governance structure separating operational management (first line), independent risk and compliance oversight (second line), and independent assurance or audit (third line).

The amount and type of risk a firm is willing to accept in pursuit of its strategy, expressed qualitatively and quantitatively and approved by the board.

A formal board-approved document articulating the firm's risk appetite, supporting metrics, thresholds, and escalation triggers across risk types.

The acceptable variation around a risk appetite limit, defining the boundary at which escalation, remediation, or business restrictions must be triggered.

A forward-looking metric that signals rising exposure or deteriorating control effectiveness, used to monitor risk against appetite and trigger timely action.

A structured inventory of identified risks recording owners, causes, potential impacts, existing controls, residual ratings, and agreed remediation actions.

A process in which business or risk owners evaluate the design and operating effectiveness of their controls, often using workshops and standardized questionnaires.

An independent function that provides objective assurance on the effectiveness of governance, risk management, and internal controls, reporting to the board or audit committee.

Internally and externally collected records of operational risk incidents, including frequency, severity, and causal detail, used to calibrate models and prioritize controls.

A structured method for estimating the potential impact and likelihood of plausible extreme events, often combining expert judgment with internal and external data.

A diagram linking multiple causes to a top event through preventive controls, and the event to multiple consequences through mitigating controls, clarifying where risk is controlled.

The potential harm from climate-related hazards such as floods, heatwaves, wildfires, or sea-level rise, whether acute events or chronic shifts in climate patterns.

The risk of financial or operational loss from the shift to a lower-carbon economy, including policy changes, technology shifts, litigation, and reputational or market effects.

Exploration of how different climate pathways and policy responses could affect exposures, revenues, and strategy over short, medium, and long horizons.

An asset that loses value or becomes uneconomic before the end of its expected life, often because of climate policy, technology change, or market shifts.

Greenhouse gas emissions associated with loans and investments, attributed to the firm through its financing relationships and reported under carbon accounting frameworks.

Public reporting of climate-related governance, strategy, risk management, and metrics, typically aligned with international sustainability reporting standards and regulatory requirements.

A reporting principle requiring disclosure both of how sustainability matters affect the firm's financial performance and of how the firm affects society and the environment.

The allocation of authority and accountability for risk decisions among the board, committees, executives, and business units, supported by policies and escalation routes.

A board-level committee that oversees the firm's risk appetite, framework, and major exposures, and challenges management on risk decisions and remediation progress.

The senior executive responsible for the independent risk function, advising the board and management on risk appetite, exposures, and the adequacy of controls.

The risk of legal or regulatory sanctions, financial loss, or reputational damage from failure to comply with applicable laws, regulations, rules, and internal standards.

The risk that business behavior or decisions produce unfair customer outcomes or damage market integrity, even where no explicit rule is breached.

The process for identifying, interpreting, and implementing new or amended regulatory requirements, with clear ownership, timelines, and verification of completion.

A structured inventory linking each applicable obligation to the policies, controls, and accountable owners that demonstrate compliance, enabling gap analysis and reporting.

Due diligence requirements to identify clients, verify identity, understand their business and risk profile, and monitor activity to prevent financial crime.

A confidential filing to the financial intelligence unit reporting transactions or behavior that may indicate money laundering, fraud, or other financial crime.