Risk Monitoring and Review

Why Risk Monitoring and Review Matters

Risk management is not a one-time event. Hazards change, processes evolve, people turn over, equipment ages, and the assumptions that made a risk assessment valid on Monday may be wrong by Friday. Risk Monitoring and Review is the step in the risk management process that keeps the whole system honest. It answers three critical questions: Are the controls we put in place actually working? Has anything changed that creates new risk or alters existing risk? Is the risk management process itself effective?

For the CSP exam, this topic is important because it ties together nearly every other domain. It connects to the Plan-Do-Check-Act (PDCA) cycle of ANSI/ASSP Z10 and ISO 45001, to the ISO 31000 risk management framework, to management of change, to incident investigation, to auditing, and to leading and lagging indicators. BCSP expects a safety professional to understand that residual risk must be verified, not assumed, and that a program without a feedback loop will drift toward failure. In the workplace, failure to monitor and review is a recurring root cause in major incidents: controls were installed, then degraded, bypassed, or made obsolete by change, and no one noticed until something went wrong.

What Risk Monitoring and Review Is

In the ISO 31000 framework, the risk management process consists of establishing context, risk assessment (identification, analysis, evaluation), risk treatment, and two activities that run continuously alongside everything else: communication and consultation and monitoring and review. Monitoring and review is deliberately shown as a parallel, ongoing activity rather than a final step, because it must occur throughout the process.

It is helpful to distinguish the two terms:

Monitoring is the continual checking, supervising, and observing of risk, controls, and the environment. It is ongoing and often real-time or near real-time. Examples include daily inspections, gas detection readings, observation programs, near-miss reporting, equipment condition monitoring, and tracking of key performance indicators.

Review is a periodic, structured activity undertaken to determine the suitability, adequacy, and effectiveness of risk assessments, controls, and the management system. Examples include annual risk register reviews, management reviews under Z10 or ISO 45001, post-incident reassessments, audits, and reassessment triggered by change.

Together they form the feedback loop that converts a static risk assessment into a living risk management system.

Key Objectives

1. Verify control effectiveness. Confirm that engineering, administrative, and PPE controls are in place, functioning, and used as intended. A machine guard that has been removed is not a control.
2. Detect change. Identify new hazards, changes in exposure, changes in process, personnel, materials, equipment, regulations, or organizational structure.
3. Validate assumptions. Risk assessments rest on assumptions about likelihood, severity, exposure frequency, and human behavior. Monitoring tests whether those assumptions hold.
4. Identify emerging risks. Trend analysis can reveal risks that were not foreseen in the original assessment.
5. Learn from events. Incidents, near misses, and audit findings feed back into updated assessments.
6. Drive continual improvement. The review process should improve not just individual controls but the risk management process itself.
7. Ensure residual risk remains acceptable. Risk that was tolerable yesterday may not be today.

How Risk Monitoring and Review Works

Step 1: Define what will be monitored and how. For each significant risk and its controls, establish measurable indicators. Determine the frequency of monitoring, the responsible party, the method, and the acceptance criteria. Document this in the risk register or risk treatment plan. A good risk register includes columns for control owner, verification method, verification frequency, and next review date.

Step 2: Select appropriate indicators. The CSP exam places strong emphasis on the difference between leading and lagging indicators.

Lagging indicators measure outcomes after the fact: Total Recordable Incident Rate (TRIR), DART rate, lost workdays, workers compensation costs, severity rate, fatalities, property damage. They are useful for trending but are reactive and can be misleading at small sample sizes.

Leading indicators measure activities and conditions that precede outcomes: percentage of corrective actions closed on time, inspection completion rates, near-miss reporting rates, training completion, safety observation counts, preventive maintenance compliance, management walkthroughs, hazard reports submitted, safety perception survey results. Leading indicators allow intervention before harm occurs.

A balanced monitoring program uses both. Exam questions frequently test whether you can classify an indicator correctly and whether you recognize that leading indicators are preferred for proactive risk management.

Step 3: Collect data. Data sources include inspections and audits, incident and near-miss reports, industrial hygiene sampling, equipment and process data, behavioral observations, maintenance records, employee feedback, regulatory updates, and external information such as industry alerts and manufacturer bulletins.

Step 4: Analyze and trend. Raw data must be turned into information. Techniques include trend charts, control charts, Pareto analysis, comparison against benchmarks and targets, and statistical tests where sample size permits. The goal is to detect deterioration in control performance or a shift in risk profile before it results in loss.

Step 5: Verify controls in the field. Desktop monitoring is not enough. Control verification should confirm three things: the control exists, the control is functioning, and the control is being used correctly. Higher-order controls in the hierarchy (elimination, substitution, engineering) are generally more reliable and require less frequent verification than administrative controls and PPE, which depend on human behavior and degrade more quickly.

Step 6: Define review triggers. Reviews occur on a scheduled basis (for example, annually for the risk register, or as defined by the management system) and on an event-driven basis. Common triggers that should prompt a formal review or reassessment include: a significant incident or serious near miss, a change in process, equipment, materials, or facility layout, a change in personnel or staffing levels, new or revised regulations or standards, audit findings or repeated inspection deficiencies, new information about a hazard such as a revised exposure limit, expansion of operations or introduction of a new product, and the passage of a defined time interval. Management of Change (MOC) is the formal mechanism that links change to risk review and is heavily tested.

Step 7: Conduct the review. A structured review examines whether the hazards identified are still complete and current, whether likelihood and severity ratings remain valid, whether controls are adequate and effective, whether residual risk is acceptable, whether treatment plans were implemented, and whether the risk management process itself worked as designed. Management review under ANSI/ASSP Z10 and ISO 45001 requires top management to evaluate the suitability, adequacy, and effectiveness of the OHSMS using inputs such as audit results, incident data, performance against objectives, stakeholder communications, and changes in context.

Step 8: Act and document. Findings must drive action: update the risk assessment, strengthen or replace controls, revise procedures, reassign resources, or change objectives. Document what was reviewed, what was found, what decisions were made, who is responsible, and when actions are due. Documentation provides evidence of due diligence and enables future trend analysis.

Step 9: Communicate. Results of monitoring and review should be shared with affected workers, supervisors, management, and other stakeholders. Communication closes the loop and reinforces worker participation, a core element of Z10 and ISO 45001.

Step 10: Improve the process. Ask whether the monitoring approach itself is effective. Are the right indicators being tracked? Are reviews happening on schedule? Are actions actually being closed? This is the continual improvement element of PDCA.

Connections to Standards and Frameworks

ISO 31000: Monitoring and review is a continuous activity spanning the entire risk management process. Its purpose is to assure and improve the quality and effectiveness of process design, implementation, and outcomes.

ISO 45001 and ANSI/ASSP Z10: The Check phase of PDCA includes monitoring, measurement, analysis, performance evaluation, internal audit, and management review. The Act phase covers nonconformity, corrective action, and continual improvement.

ANSI/ASSP Z590.3 (Prevention through Design): Emphasizes that risk assessments must be revisited through the life cycle of a facility, process, or product.

OSHA Process Safety Management (29 CFR 1910.119): Requires process hazard analyses to be updated and revalidated at least every five years, requires management of change, incident investigation, and compliance audits at least every three years. These are regulatory examples of mandated review cycles.

Common Pitfalls in Practice

Relying solely on lagging indicators. Treating a risk assessment as a completed document rather than a living record. Failing to link change management to risk review. Verifying that controls exist on paper without checking the field. Not closing out corrective actions. Reviewing only after incidents rather than proactively. Normalization of deviance, where gradual drift from standards becomes accepted. Measuring what is easy rather than what matters.

Exam Tips: Answering Questions on Risk Monitoring and Review

1. Know where monitoring and review sits in the process. If asked which element of ISO 31000 occurs throughout the entire process rather than as a discrete step, the answer is monitoring and review (along with communication and consultation). It is not the last step; it is continuous.

2. Classify indicators correctly. Anything that measures an outcome after injury or loss (TRIR, DART, lost time, severity rate, costs) is lagging. Anything that measures preventive activity or condition before loss (inspections completed, near misses reported, training, corrective action closure, observations) is leading. When asked for the most proactive or best predictor of future performance, choose a leading indicator.

3. Recognize review triggers. When a question describes a change in process, equipment, chemicals, personnel, regulation, or an incident, the best response almost always involves reassessing risk or reviewing the hazard analysis through management of change. BCSP favors answers that update the assessment rather than answers that simply add training or PPE.

4. Verification means field confirmation. If a question asks how to determine whether a control is effective, prefer answers that involve observing, testing, measuring, or auditing the control in use over answers that involve reviewing documentation alone.

5. Apply the hierarchy of controls to monitoring frequency. Administrative controls and PPE depend on human behavior and need more frequent verification than engineering controls or elimination. If a question asks which control requires the most ongoing monitoring, lean toward lower-order controls.

6. Understand management review. Questions about Z10 or ISO 45001 management review test who conducts it (top management), what it evaluates (suitability, adequacy, effectiveness), what inputs it uses (audits, incidents, objectives, changes, stakeholder input), and what outputs it produces (decisions on improvement, resources, and changes to the system).

7. Know regulatory review intervals. PSM process hazard analysis revalidation every five years and compliance audits every three years are commonly tested numbers.

8. Watch for qualifiers. Words like first, best, most effective, and primary purpose change the correct answer. The first step in responding to a trend of rising incidents is usually to analyze the data to identify causes, not to immediately implement a solution. The primary purpose of monitoring is to determine whether risk remains acceptable and controls remain effective.

9. Think in terms of PDCA. If an answer choice describes checking performance and feeding results back into planning, it aligns with the Check and Act phases and is likely correct in a continual improvement context.

10. Eliminate answers that treat risk as static. Any option suggesting that a completed risk assessment needs no further attention, that a control once installed is permanent, or that lagging data alone is sufficient should be eliminated.

11. Remember residual risk. After controls are applied, residual risk must be evaluated and periodically re-evaluated. Questions may ask what should be done after controls are implemented; the answer involves verifying effectiveness and reassessing residual risk.

12. Use the safety professional perspective. BCSP questions are written from the viewpoint of a competent safety professional who uses data, engages workers, documents decisions, and drives systematic improvement. When two answers seem plausible, choose the one that is more systematic, data-driven, and preventive.

Quick Review Summary

Monitoring is continuous checking; review is periodic structured evaluation. Both run alongside the entire risk management process. Use a balance of leading and lagging indicators, with emphasis on leading for proactive management. Verify controls in the field for existence, function, and use. Trigger reviews on schedule and on change, incidents, audit findings, and new information. Link change to review through management of change. Document findings, act on them, communicate results, and improve the process itself. Residual risk is never assumed to remain acceptable; it is verified. Mastering these principles will prepare you for both the exam and the real responsibility of keeping a risk management system alive and effective.