A risk treatment plan that looks great on paper can still fail quietly, months later, if nobody's actually watching whether it's working. That's the gap monitoring and review is designed to close. It's the final — and arguably most overlooked — stage of the risk management process, and it's what turns risk management from a one-time project into something genuinely ongoing. Without it, even the best-designed treatment plan eventually goes stale as business conditions shift underneath it.

Monitoring and review sits at the end of the broader ISO 31000 risk management process, closing the loop back to context-setting and assessment — which is exactly why it deserves more attention than most organizations give it.

Choosing the Right Indicators to Track

You can't monitor what you haven't defined, so the first practical step is figuring out what "working" actually looks like for each risk. Most mature risk functions track two distinct types of metrics:

• Key Performance Indicators (KPIs) — measure how well a treatment is actually performing, such as the percentage of planned controls implemented on schedule.

• Key Risk Indicators (KRIs) — early warning signals that a risk is starting to escalate, such as a rising number of failed login attempts (signaling growing cyber risk) or increasing supplier delivery delays (signaling supply chain risk).

The distinction matters: KPIs tell you whether you did what you said you'd do, while KRIs tell you whether the underlying risk itself is getting better or worse — regardless of what your plan says. Relying on only one of these gives an incomplete picture.

Setting a Review Cadence That Actually Makes Sense

Not every risk needs the same level of attention. A one-size-fits-all review schedule — say, reviewing everything annually — tends to under-monitor critical risks and over-monitor low-priority ones, wasting effort in the wrong places.

A more practical approach ties review frequency to severity:

• Critical risks — reviewed monthly, or even continuously through automated dashboards where possible

• Moderate risks — reviewed quarterly, with clear triggers for escalation if conditions change

• Low risks — reviewed annually, or whenever a related business change occurs

Assigning clear ownership matters just as much as frequency. Whoever owns a risk's treatment plan should also own tracking its indicators — otherwise monitoring becomes everyone's job, which in practice often means it becomes no one's job.

Building this kind of structured monitoring rhythm is exactly the sort of practical skill covered in a proper ISO 31000 certification — rather than improvising a review schedule from scratch, formal training gives you tested frameworks for deciding what to track, how often, and who should own it.

Recognizing When a New Treatment Cycle Is Needed

Monitoring isn't just about producing reports — its real purpose is catching the moment when a risk drifts outside acceptable limits again. This is where the idea of residual risk comes back into play: if ongoing tracking shows that a previously treated risk is creeping back toward unacceptable levels, that's a signal a new treatment cycle needs to begin, not a sign that monitoring "failed."

Organizations that treat this as a normal, expected part of the process — rather than a setback — tend to respond faster and with far less internal friction than those who treat every re-emerging risk as a surprise.

Turning Monitoring Into a Genuine Feedback Loop

The organizations that get the most value from ISO 31000 don't treat monitoring as a compliance checkbox at the end of the process. They treat it as the mechanism that keeps everything else honest — context that was accurate a year ago might not be accurate today, and criteria that made sense during calmer conditions might need revisiting after a major market shift.

Done consistently, monitoring and review is what makes risk management a living practice rather than a document that gets filed away and forgotten. It's the difference between an organization that reacts to the same kinds of surprises repeatedly, and one that gets measurably better at anticipating them over time.