In ORM, controls should be selected based on what criterion?

In Operational Risk Management (ORM), the effectiveness of controls in reducing risk is the primary criterion for selecting them. This focus ensures that the controls implemented are directly addressing the identified risks and mitigating them effectively. By prioritizing effectiveness, organizations can ensure that the most significant hazards are managed appropriately, thus enhancing the overall safety and operational efficiency.

The other options consider various aspects that may influence selection but do not prioritize risk reduction. While ease of implementation can be important, it should not come at the expense of effectiveness. Cost-effectiveness is also a valuable factor, but the primary objective is to ensure that the risk is being mitigated effectively, regardless of cost. Popularity among personnel may reflect personal preferences or past experiences but does not guarantee that a control will adequately reduce risk. Thus, selecting controls based on their effectiveness in risk reduction aligns with the core principles of ORM.