8020 Exam Preparation Material | ORM Certificate - 2023 Update

Explanation:
Third-Party Risk Management (TPRM)
PRMIA highlights the importance of conducting thorough due diligence on third-party vendors and service providers.
This includes evaluating compliance programs, risk management frameworks, financial stability,
strategic objectives, and operational history.
Key Areas of Third-Party Risk Assessment
Compliance and Risk Infrastructure → Ensures that the provider meets regulatory and security requirements.
Financial Health → Determines whether the provider has the financial stability to support long-term service delivery.
Business Strategy → Helps assess alignment with the organization’s risk appetite and goals.
Operating History → Evaluates experience and reliability in delivering services.
Explanation
Incorrect C Ignoring these critical factors increases the risk of working with an unreliable vendor.
Incorrect C Onsite visits are highly valuable as they provide first-hand insights into operational controls. PRMIA encourages risk managers to conduct site visits.
D. A review of the pay levels of the staff supporting Incorrect C Employee salaries are not a primary risk
the service. factor in vendor assessments. The focus should be on the vendor’s security, compliance, and
operational risks.
PRMIA Reference for Verification
PRMIA Third-Party Risk Management (TPRM) Guidelines C Details best practices for vendor risk assessments.
Basel Principles on Outsourcing and Third-Party Risk C Provides regulatory guidance on evaluating third-party service providers.

Explanation:
Process Mapping is a risk management tool used to visualize workflows, identify inefficiencies, and detect control gaps. PRMIA defines process mapping as an essential operational risk management tool.
Step 1: Understanding Process Mapping
Helps analyze complex, process-intensive activities (Option A).
Reveals control weaknesses that could lead to operational risks (Option B).
Improves hand-offs and collaboration between teams (Option C).
Step 2: Why "All of the Above" is Correct
Process mapping serves multiple risk management purposes, making all listed options valid.
PRMIA Risk Reference Used:
PRMIA Operational Risk Management Guidelines C Recommends process mapping to identify inefficiencies and control gaps.
PRMIA Risk Governance Framework C Encourages visualization tools for process improvement.
Final Conclusion:
Process mapping improves risk awareness, identifies control gaps, and enhances operational workflows, making Option D the correct answer.

Explanation:
Near Misses in Operational Risk
A near miss is an event that could have led to a loss but was avoided or mitigated before actual financial impact occurred.
PRMIA emphasizes that near misses should be reported, recorded, and analyzed because they provide valuable insights into potential vulnerabilities in risk controls.
However, since they did not result in actual financial losses, they are not included in the calculation
of Operational Risk Capital.
Opportunity Costs in Operational Risk
Opportunity costs refer to the loss of potential gains due to missed strategic opportunities.
These are not directly quantifiable as operational risk losses and are not included in Operational Risk Capital calculations.
PRMIA’s Operational Risk Framework states that operational risk is about actual losses rather than theoretical costs.
Why Other Answers Are Incorrect Option
A. Ignored.
B. Recorded and Analyzed. Used in calculation of Operational Risk Capital.
D. Reported, Recorded, and Analyzed,
Used in calculation of Operational Risk
Capital.
PRMIA Reference for Verification
C. Onsite visits are not advantageous for understanding the third party's risks and control environment.
Why Other Answers Are Incorrect Option
B. An assessment of a third party should not include its compliance and risk infrastructure, financials, business strategy, and operating history.
PRMIA Operational Risk Management Standards C Defines near misses and opportunity costs. Basel II & III Operational Risk Framework C Outlines the principles of operational risk capital calculations.

Explanation:
Impact Tolerance is a key concept in Operational Resilience, defined as the ability of a firm to withstand, respond to, and recover from disruptions. According to PRMIA and global regulatory frameworks (such as the Bank of England's Operational Resilience Framework), impact tolerance is specifically tied to business services rather than processes.
Step 1: Defining Impact Tolerance
Impact tolerance is the maximum acceptable level of disruption to an important business service, beyond which there would be intolerable harm to customers, financial markets, or regulatory obligations.
It is not the same as risk appetite or risk capacity, as those deal with broader organizational risk exposure.
Step 2: Why Business Services Matter
PRMIA defines business services as end-to-end services delivered to clients and stakeholders, such as payments processing, trade execution, or loan approvals.
Disruptions to these services directly impact customers and financial stability, making business service resilience the core focus of impact tolerance. Step 3: Why the Other Options Are Incorrect
Option A ("tolerance for disruption to a particular business process")
Incorrect because impact tolerance applies to services, not just internal processes.
Option C ("a firm's risk appetite statement")
Incorrect because risk appetite focuses on how much risk a firm is willing to take, while impact
tolerance is about surviving disruptions.
Option D ("a firm's risk capacity statement")
Incorrect because risk capacity is the maximum level of risk a firm can bear, which is broader than business service disruptions.
PRMIA Risk Reference Used:
PRMIA Operational Resilience Guidelines C Defines impact tolerance as a service-based metric. Bank of England’s Operational Resilience Framework C Establishes impact tolerance as a limit on business service disruption.
Final Conclusion:
Impact tolerance focuses on business services, not just internal processes or risk appetite, making Option B the correct answer