Monitoring, Review, and Continuous Improvement
Monitoring, review and continual improvement ask whether risk management is working, not merely whether it is happening. The exam tests KRI design, assurance coordination, review triggers and the discipline of updating the register and treatment plans.
What to monitor
Monitor the external and internal context, risk status, control performance, treatment progress and the effectiveness of the framework itself. KRIs should be linked to a risk, have a baseline, threshold and owner, and be leading where possible. KPIs measure performance; KRIs signal risk exposure. Too many indicators dilute attention.
Assurance and review
Use control self-assessment, control testing, internal audit, external audit, incident reviews, scenario exercises, stress tests and maturity assessments. Map assurance to avoid gaps and duplication. Review frequency should reflect velocity and volatility: a fast-moving cyber risk needs more frequent review than a long-term property risk. Trigger reviews after incidents, threshold breaches, mergers, regulatory change, supplier failure or significant project change.
Worked example
A residual risk is scored 9 (likelihood 3 × consequence 3). A control test shows the approval control operated in only 70% of sampled cases, against a 95% target. The likelihood is re-rated to 4, giving residual 12, above the appetite limit of 10. Reasoning: the review tested effectiveness, not just existence; re-scoring followed the evidence; a corrective action (system-enforced approval) is assigned with a 90-day re-test; the risk is escalated until the re-test passes. Two quarters later the control operates at 97%, likelihood returns to 3, and the residual is 9. The register, action log and committee report all show the same history.
Traps that cost marks
Monitoring activity counts rather than outcomes; letting the register go stale between annual reviews; actions without owners or dates; relying on internal audit as the only assurance; setting KRIs without baselines or thresholds; reviewing at a fixed frequency regardless of risk velocity; failing to capture lessons after incidents; closing actions without evidence of effectiveness.