What does the monitoring and review phase entail in the risk management process?

• A. It is about documenting only.
• B. It is optional and rarely used.
• C. It is the initial step where risk is identified.
• D. It involves ongoing monitoring of risk and effectiveness of controls, with periodic reviews and updates to risk posture.

Answer: (D)

Ongoing oversight of risk and controls over time. This phase isn’t about one-off work; it’s continuous. You keep track of how high the risk remains, how well the controls are reducing that risk, and whether external or internal changes have shifted the landscape. Because of that, you perform periodic reviews to reassess risk levels, the effectiveness of controls, and whether the organization’s risk posture—its appetite and tolerance—still fits the current reality. When gaps or new threats appear, you update the risk assessment, adjust controls, and refresh the risk register and related governance artifacts. This continuous monitoring and regular updating ensure the risk approach stays relevant and effective as conditions change. The other descriptions fall short because monitoring isn’t limited to documentation, isn’t optional, and isn’t only the initial step of identifying risk; the essential work is the ongoing measurement and adjustment of risk and controls over time.