Risk monitoring is the ongoing work of noticing change. It should reveal whether exposure is increasing, controls are weakening, treatments are late, or assumptions are no longer valid.
Monitor several signals
- Key risk indicators and breaches
- Incidents, losses, complaints, and near misses
- Control tests and assurance findings
- Treatment milestones and overdue actions
- External changes and emerging risks
- Changes to objectives, suppliers, systems, or people
Set frequency by risk
A fixed annual review is not enough for rapidly changing exposure. Set frequency according to velocity, significance, control dependence, and the availability of timely information.
Use trigger-based reviews
Define events that require reassessment, such as a major change, threshold breach, incident, control failure, new dependency, leadership decision, or failed assumption.
Report movement, not only status
A useful report explains what changed, why it changed, the decision required, and whether actions are working. Static red, amber, and green labels can hide deterioration.
Review questions
- Is the risk still relevant?
- Have likelihood, impact, velocity, or confidence changed?
- Are controls operating and evidenced?
- Are treatments on time and effective?
- Is exposure outside appetite or authority?
- What decision is required?
Monitor the risk and the response
Progress reports often track whether actions are late but not whether the exposure itself is changing. A balanced review considers indicators, incidents, near misses, control performance, assumptions, external change, action status, and residual risk. A completed action may not reduce exposure if it was poorly designed or conditions changed.
Set review triggers
Calendar reviews are useful, but event-based triggers can be more important. Examples include a supplier downgrade, missed project milestone, control failure, material scope change, new regulation, rapid demand shift, or threshold breach. Triggers should identify who receives the information and what decision is expected.
Review meeting questions
- What changed since the previous review?
- Which assumptions have weakened?
- Are indicators leading, current, and understandable?
- Have treatments delivered the expected effect?
- Does any risk need escalation, closure, splitting, or consolidation?