Which is the third step in the four steps of Operational Risk Management (ORM)?

• A. Identify hazards.
• B. Develop controls and make risk decisions.
• C. Implement controls and monitor.
• D. Assess hazards.

Answer: (B)

In Operational Risk Management, the steps flow from identifying hazards, to assessing them, then to developing controls and making risk decisions, and finally to implementing those controls and monitoring their effectiveness. The third step is to develop controls and make risk decisions. That means designing measures to eliminate or reduce hazards, selecting which controls to put in place, and deciding whether to proceed with the operation given the residual risk. This decision often involves weighing options like engineering controls, administrative actions, or personal protective equipment, and determining if the risk is acceptable or if more mitigation is needed.

Identifying hazards is the first step because you can’t manage what you haven’t seen. Assessing hazards is the second step where you evaluate likelihood and severity to understand risk. Implementing controls and monitoring is the final step, when you put the chosen controls into place and track their effectiveness over time.