Techniques to undertake risk monitoring include external and internal audits, appraisal of an enterprise’s risk management strategies, policies and procedures, and physical inspections.

Target outcome of risk monitoring

The target outcome of risk monitoring is to determine if the risk management objectives were achieved and which improvements can be made to enhance the risk management process. A number of questions should be answered during the risk monitoring stage:

• Is the risk profile of the organization altered?
• Are assumptions on which the risk management strategy were determined are still relevant?
• Is the risk management process effective and efficient?
• Does the risk management strategy still comply with government laws and regulations (if changes in laws and regulations occurred)?
• How does the risk management process contribute to the ultimate objective of the enterprise, which is wealth maximization of the shareholders?

Risk monitoring of the risk management environment includes monitoring of environmental risks and operational risks.

• Environmental risks refer to risks which occur in the external environment and over which the enterprise has no control. For example, if an unexpected adverse event occurs, management needs to re-evaluate the situation and adjust the organization’s risk management strategy and risk management implementation plan. This will ensure that unfortunate incidents do not evolve into a crisis.
• Operational risks refer to risks which occur in the internal environment of the enterprise and over which enterprise has control.

Ongoing risk monitoring of the enterprise risk management (ERM) process allows enterprises to identify new risks in a timely manner. As an example a new risk, such as new regulatory requirements, can be identified and attended to in a timely manner. It allows maintaining an up to date organizational risk profile. Potential opportunities and threats are also paid attention to. It also makes possible to identify risk management practices that are inefficient or inappropriate, which must be followed by suitable adjustments. This allows decreasing costs of such practices.

Further, risk monitoring allows confirming if assumptions and analysis underlying risk management strategies and implementation plans were correct. If not, timely adjustments must be made, which will lead to further improvements in the efficiency of the process. Questioning every assumption may be too time consuming. In such case, a list of key assumptions must be compiled and monitored.

Benchmarking

One of the ways to improve the risk management process is by using benchmarking methodology. Benchmarking refers to comparing certain performance indicators of the business to those of the competitors. It also can refer to comparing certain performance indicators between business units within the same enterprise. This methodology can be expensive and time consuming. Therefore, focusing on the crucial areas for success of the risk management process may be most appropriate.

Risk management training should also be undertaken to ensure employees’ improvement in risk management abilities, skills, knowledge and awareness, and to further enhance quality of risk monitoring.