PRMIA ORM study plan

Define operational resilience and map its core components (critical operations, impact tolerances, severe-but-plausible scenarios) in your own written summary

Distinguish operational resilience from traditional operational risk and business continuity, citing at least four points of divergence

Explain how impact tolerances are set and why they differ from risk appetite statements

Identify the regulatory drivers (e.g., outsourcing and third-party dependency expectations) that shape resilience planning

Walk through the steps of identifying critical or important business services and their supporting assets

Construct a severe-but-plausible scenario and trace its propagation across people, process, technology, and third parties

Design a set of resilience metrics and tolerance thresholds that could be monitored in a dashboard

Evaluate remediation and investment prioritisation logic when tolerances are breached

Compare at least three risk management frameworks (e.g., COSO ERM, ISO 31000, Basel-style three-lines thinking) on scope, structure, and intended audience

Articulate the three-lines model and describe how assurance, oversight, and ownership responsibilities divide across it

Explain how risk appetite, tolerance, and limit structures cascade from board level to business units

Apply a risk taxonomy and a heat-map or scoring approach to a small illustrative risk register

Draft a governance structure showing board, committee, CRO, and business-line accountabilities for risk decisions

Distinguish the roles of the board, risk committee, audit committee, and executive risk committee in escalation paths

Explain how risk culture, incentives, and tone at the top are assessed and evidenced

Identify conflict-of-interest and independence issues that weaken risk governance

Evaluate how board risk reporting should be structured (frequency, content, forward-looking indicators)

Analyse a governance failure pattern and trace which control, reporting, or accountability layer broke down

Explain the role of internal audit and external assurance in challenging risk governance

Assess how remuneration and performance metrics can either reinforce or undermine risk-taking discipline

Classify physical, transition, and liability risk and give a concrete example of each for a financial institution

Explain how climate scenario analysis differs from traditional stress testing in horizon, uncertainty, and data quality

Describe how climate risk is transmitted into credit, market, liquidity, and operational risk categories

Identify the main disclosure and reporting expectations (e.g., governance, strategy, risk management, metrics and targets) and what each requires

Define compliance risk and distinguish it from legal risk, conduct risk, and regulatory risk

Explain how a compliance risk assessment is scoped and how inherent risk, control effectiveness, and residual risk are rated

Describe the compliance monitoring and testing cycle, including how findings are tracked to closure

Outline how regulatory change is captured, assessed, and implemented across the business

Synthesise all five domains into a single integrated risk narrative linking resilience, frameworks, climate, governance, and compliance

Practise applying concepts to short scenario questions under timed conditions and diagnose recurring error patterns

Close remaining knowledge gaps by rewriting weak notes into concise, exam-ready summaries

Rehearse explaining a governance or resilience decision to a non-specialist board audience