3.2.3. Risk Monitoring and Reporting
💡 First Principle: A risk treatment decision made once and never revisited is a snapshot of a moment that has already passed — controls degrade, business context shifts, and the risk that was accepted or mitigated last year may not be the same risk today.
Ongoing monitoring closes this gap through key risk indicators (KRIs) — measurable signals that a risk's likelihood or impact is changing (such as a rising number of failed login attempts, or an increasing count of unpatched critical systems) — reported on a defined cadence to the governance bodies established in Phase 2. Residual risk — what remains after a treatment is applied — is the specific figure that monitoring tracks over time; a control that was fully effective at deployment can quietly become less effective as the environment around it changes, and only ongoing monitoring surfaces that drift before it becomes an incident. (Inherent risk is the exposure before any treatment; residual risk is what remains after it.)
A useful KRI has a logical link to the risk's likelihood or impact, is measured on a recurring basis so its trend is visible, and has a threshold set where the change becomes meaningful and actionable — too low and it fires on noise, too high and it fires only after the risk has already worsened. A metric trending steadily toward its threshold warrants investigation before it crosses; likewise, residual-risk figures that have not moved in years despite business change deserve a check that the method is still sensitive to change.
⚠️ Exam Trap: Risk treatment is sometimes treated as a one-time decision that closes the item permanently. The correct answer recognizes that treatment must be monitored — controls degrade and business context changes, requiring periodic re-evaluation of residual risk.
Reflection Question: A risk was mitigated eighteen months ago with a specific control, and the risk register entry hasn't been reviewed since. What could have changed in that time that would make the original treatment decision no longer adequate?
