What activity evaluates the effectiveness of risk response measures and identifies changes that could affect how risk is managed?

• A. Monitor
• B. Assess
• C. Audit
• D. Report

Answer: (A)

Monitoring is the ongoing activity that tracks how well risk response measures are performing and flags changes in the risk environment that could alter how risk should be managed. By continuously observing control effectiveness, incident trends, and new or shifting threats, you determine whether responses remain appropriate and decide if updates to controls, risk appetite, or risk treatment plans are needed. This ongoing feedback loop sets it apart from assessing, which is typically a point-in-time or periodic evaluation of risk levels; auditing, which is an independent examination of controls and compliance; and reporting, which communicates risk information but doesn’t itself continuously evaluate effectiveness.