What is a key criterion for controls in Operational Risk Management (ORM)?

In Operational Risk Management (ORM), suitability is a key criterion for controls because it ensures that the controls implemented are appropriate and effective for the specific risks being addressed. Suitability evaluates whether the design and application of controls align with the organization's risk profile and operational context. It focuses on ensuring that controls can adequately mitigate identified risks, providing the necessary level of protection without being overly cumbersome or misaligned with operational objectives.

For instance, when assessing controls, it's important to consider the specific characteristics of the risk and the environment in which the organization operates. An unsuitable control may not address the risk adequately or could create additional challenges, thus failing to protect the organization efficiently.