Which is the fourth step in the ORM process?

• A. Develop controls and make risk decisions.
• B. Identify hazards.
• C. Assess hazards.
• D. Implement controls and monitor.

Answer: (D)

In Operational Risk Management, you move through a five-step cycle: identify hazards, assess hazards, develop controls and make risk decisions, implement controls and monitor, and finally supervise. The fourth step focuses on putting the chosen mitigations into action and tracking how they perform. Implementing controls means applying the decided safeguards in the field, coordinating with teams so the mitigations are actually in place, and ensuring they’re functioning correctly. Monitoring involves continually watching the situation to verify that the risk is being reduced as intended, spotting any new hazards or failures in the controls, and making adjustments as needed. This step is about execution and verification—without it, even well-planned controls might not reduce risk effectively. The remaining step, supervise, provides ongoing oversight to maintain control effectiveness and feed lessons back into the cycle.