IRM/AIRMIC/ALARM A Risk Management Standard (2002) 8: 8 Monitoring and review of the risk management process

Keep a reporting and review structure so risks are properly identified and assessed and suitable controls and responses exist; audit policy and standards compliance regularly and review performance for improvement; identify changes in the organisation and its environment and adapt systems. Monitoring should give assurance that suitable controls are in place and procedures understood and followed, and check whether measures achieved what was intended, whether procedures and information were adequate, and what better knowledge and lessons would improve future assessments.