After implementing controls in a risk assessment, what is the next step?

• A. Expand controls indefinitely.
• B. Ignore feedback and proceed.
• C. Monitor and review effectiveness of controls.
• D. Publish the risk assessment report.

Answer: (C)

After you put controls in place, you need to verify how well they’re working by monitoring and reviewing their effectiveness. This creates a feedback loop: you measure performance, check whether residual risk stays within acceptable levels, and detect any changes in conditions or new threats. With this information, you can adjust controls, update the risk register, or reallocate resources to maintain or improve risk reduction. Expanding controls without evidence, ignoring feedback, or simply publishing the report don’t close the loop on risk management; they miss the crucial step of ensuring and sustaining control effectiveness over time.