What is operational risk management (ORM)?
Operational risk management (ORM), along with enterprise risk management (ERM), is defined as the discipline of driving down the cost and frequency of losses resulting from inadequate or failed internal processes and failure to comply to internal or external regulations by people, technology, or from external events. While the discipline has been at the forefront of highly regulated industries for years, the increase in regulatory measures such as the Health Insurance Portability and Accountability Act (HIPAA), the Occupational Safety and Health Act (OSHA), 404C, 404A, REG AB, the Gramm-Leach-Biley Act, Basel II and the Sarbanes-Oxley Act of 2002, have required organizations to take a broader, more disciplined approach to operational risk management. For many organizations, operational risk management has been addressed through specialized departmental initiatives. Finance, risk management, internal audit, IT, and human resources departments have each approached their responsibilities
