What are the five steps of Operational Risk Management (ORM)?

• A. Identify hazards, assess risk, develop controls, implement controls, supervise and review.
• B. Plan, Train, Execute, Assess, Improve.
• C. Identify threats, Mitigate, Detect, Respond, Review.
• D. Define scope, Collect data, Analyze, Decide, Report.

Answer: (A)

Operational Risk Management follows a hazard-to-control flow: first spot potential hazards in the operation, then judge how much risk those hazards pose, choose appropriate controls to reduce or eliminate the risk, put those controls into place, and finally monitor and review to ensure they’re working and adjust as needed. Identifying hazards means looking for things that could cause harm in the activity. Assessing risk weighs how likely the hazard is and how severe the damage could be. Developing controls and making decisions involves selecting practical measures to eliminate or lessen the risk and deciding on the best course of action. Implementing controls puts those measures into practice. Supervising and reviewing keeps the process active, checking that controls reduce risk as intended and updating them if the situation changes.

The other sequences don’t fit ORM’s focus. Plan–Train–Execute–Assess–Improve resembles a general operations or training cycle rather than risk-based decision making. Identify threats–Mitigate–Detect–Respond–Review sounds more like security or incident-response steps, not the hazard-and-risk framework ORM uses. Define scope–Collect data–Analyze–Decide–Report aligns with a data-analysis or decision-report cycle, not the hazard, risk, and control progression that ORM emphasizes.