Operational Risk Assessment/Management (ORM) is defined as:

Operational Risk Assessment/Management (ORM) is defined as:

• A. The measurement of risk levels using statistical methods only
• B. The process of identifying, assessing, and controlling risks arising from operational factors and making decisions that balance costs with mission benefits
• C. A training program for risk management
• D. A method for reporting near-miss incidents

Answer: (C)

Operational Risk Management is a systematic approach to dealing with risk in daily operations: you identify hazards, assess the risks (how likely they are and how severe their impact could be), implement controls to reduce those risks, and make decisions that balance the costs of controls with the benefits to accomplishing the mission. This definition captures the full cycle—from recognizing potential problems to actively managing them—rather than focusing only on measurement, training, or reporting. Measuring risk statistically is only a piece of the puzzle and doesn’t by itself drive actions. A training program describes education but not the ongoing process of managing risk. Reporting near-misses provides feedback, but without the steps of assessment and control, it doesn’t constitute the management process.

Operational Risk Management is a systematic approach to dealing with risk in daily operations: you identify hazards, assess the risks (how likely they are and how severe their impact could be), implement controls to reduce those risks, and make decisions that balance the costs of controls with the benefits to accomplishing the mission. This definition captures the full cycle—from recognizing potential problems to actively managing them—rather than focusing only on measurement, training, or reporting. Measuring risk statistically is only a piece of the puzzle and doesn’t by itself drive actions. A training program describes education but not the ongoing process of managing risk. Reporting near-misses provides feedback, but without the steps of assessment and control, it doesn’t constitute the management process.