Monitoring, Review, and Continuous Improvement
Core idea
Risk management is a loop, not a project. Monitoring tracks whether controls operate and exposures move; review challenges whether the framework still fits the organisation and its environment. Candidates must understand key risk indicators and key control indicators, tolerance thresholds and escalation triggers, and the difference between monitoring (ongoing) and assurance (independent verification).
Review and improvement concepts
Know the triggers for review: scheduled cycles, incidents and near misses, significant change (new products, mergers, systems), regulatory change, and shifts in the external environment. Understand the value of lessons-learned exercises, root cause analysis, and the distinction between a control failure and a design gap. Recognise maturity models as a way to chart improvement, and the importance of closing the loop: findings must translate into owned actions with tracked completion. Also understand the role of internal audit findings, external assurance and benchmarking.
Traps
Questions often imply that a low incident count proves effectiveness; it may instead reflect under-reporting or weak detection. Another trap is treating near misses as unimportant, or reviewing the register without reviewing the framework. Watch for improvement actions recorded but never verified as complete, and for indicators that measure activity (number of workshops held) rather than outcome (reduction in exposure).
Worked rule of thumb
For each key risk, define at least one forward-looking indicator with an amber and red threshold. Example: supplier concentration above 25% of volume triggers amber and a sourcing review; above 35% triggers red and escalation to the risk committee. Then verify quarterly that thresholds are current and that breaches produced action, not just a note.