What is the purpose of a Hazard Severity and Probability rating in ORM?

• A. To determine overall risk level and prioritize mitigations.
• B. To assign personnel to tasks.
• C. To determine budget for security.
• D. To classify information sensitivity.

Answer: (A)

In ORM, you assess risk by looking at what could happen (severity) and how likely it is to happen (probability). By rating both, you derive an overall risk level that tells you how serious the hazard is overall. This risk level guides you to prioritize mitigations: the higher the risk, the sooner and more robust the controls you implement, and the more you allocate to reduce or accept residual risk after those controls. For example, a hazard with catastrophic potential but low likelihood might still be a high or medium risk, depending on the specific ratings, so you address it accordingly; a hazard with moderate consequences but very high likelihood can also drive strong mitigations. The other options aren’t about evaluating risk and directing action—the ORM rating isn’t used to assign personnel, set security budgets, or classify information sensitivity.