Topics in this domain
- Risk Response Options: Accept, Mitigate, Transfer, Avoid
- Aligning Responses with Appetite and Tolerance
- Cost-Benefit Analysis of Risk Responses
- Bias in Risk Decisions and Reporting
- Risk Owners and Control Owners
- RACI and Escalation
- Third-Party Risk Governance and Due Diligence
- Contracts, SLAs and the Right to Audit
- Monitoring Third Parties and Planning Exit
- Managing Issues, Findings and Control Deviations
- Risk Acceptance, Exceptions and Exemptions
- Control Frameworks and Their Purpose
- Control Types and Functions
- Designing and Selecting Controls
- Implementing Controls and Why Implementations Fail
- Control Design versus Operating Effectiveness
- Control Testing: Objectives, Evidence and Frequency
- Building and Tracking Risk Action Plans
- Collecting and Aggregating Risk Data
- Validating Risk Data Quality
- KRIs, KPIs and KCIs
- Thresholds, Escalation Triggers and Appetite
- Metric Pitfalls and Misuse
- Continuous Monitoring versus Periodic Assessment
- Tailoring Risk Reports to the Audience
- Heat Maps, Dashboards and Scorecards
- Identifying and Assessing Emerging Risks
- Integrating Emerging Risk into Decisions
Continuous Monitoring versus Periodic Assessment
Two complementary approaches
Who does what
Where continuous monitoring fits
- Privileged access and configuration changes.
- Patch and vulnerability status.
- Backup success and recovery tests.
- Payment and transaction anomalies.
- Cloud configuration drift.
Example. A cloud posture tool alerts within minutes when a storage bucket is made public. The annual risk assessment still reviews whether cloud governance, ownership and appetite fit the business’s growing cloud use.
How the exam asks about it
| If the question asks… | The answer is usually… |
|---|---|
| Main benefit of continuous monitoring | Timely detection of changes and failures |
| Does it replace risk assessment? | No; they complement each other |
| Who owns continuous monitoring | Management |
| Monitoring alerts nobody reviews | Little value; assign ownership |
In short
- Continuous monitoring uses automated data to watch risks and controls in near real time.
- Periodic assessments give the broad view: context, scenarios, appetite and gaps tools can't see.
- Use continuous monitoring for fast-changing, high-risk areas and key controls.
- Monitoring is a management responsibility; audit may use it but stays independent.
- Automated monitoring needs good data, tuning and someone to act on alerts.
Exam traps
- Thinking continuous monitoring replaces risk assessment.
- Relying only on annual assessments for fast-changing risks.
- Deploying monitoring tools with nobody reviewing the output.
- Confusing management's continuous monitoring with audit's continuous auditing.
Slides
Click the slide and use the arrow keys. F toggles full screen.
Two complementary approaches
Who does what
1 / 7