Monitoring Risk Mitigation Plans

Introduction
Monitoring risk mitigation plans is a core topic within the CRMA domain of Evaluating Risk Management Processes. Identifying a risk and deciding how to treat it is only half the job. The real test of a risk management process is whether the agreed mitigation actions are actually implemented, whether they work as intended, and whether the organization knows when they stop working. This guide explains why monitoring matters, what it consists of, how it operates in practice, and how to approach exam questions on the subject.

Why Monitoring Risk Mitigation Plans Is Important
1. Plans are not results. A documented action plan has no value until it is executed. Many organizations suffer losses from risks they had already identified because the mitigation was never completed, was delayed, or was quietly abandoned.
2. Risks are dynamic. The business environment, technology, regulation, and personnel all change. A mitigation plan that was adequate at design may become irrelevant or insufficient. Monitoring detects this drift.
3. Accountability. Monitoring creates visibility over who owns each action, what progress has been made, and where obstacles exist. Without it, ownership becomes blurred and actions fall through the cracks.
4. Residual risk alignment. Management and the board accept a certain level of residual risk on the assumption that mitigation will reduce inherent risk. If mitigation is incomplete, actual residual risk is higher than reported, meaning the organization is operating outside its risk appetite without knowing it.
5. Governance and assurance. Boards, audit committees, and regulators expect evidence that risk responses are tracked to completion. The IIA Standards require internal audit to establish a follow-up process to monitor the disposition of results communicated to management, and risk management frameworks (COSO ERM, ISO 31000) both include monitoring and review as essential components.

What Monitoring Risk Mitigation Plans Means
A risk mitigation plan (also called a risk treatment plan or risk action plan) is the set of agreed actions designed to bring a risk to within acceptable levels. It typically specifies: the risk being addressed, the response strategy (reduce, share/transfer, avoid, or accept with conditions), the specific actions, the action owner, target dates, required resources, and the expected effect on likelihood and impact.

Monitoring is the ongoing process of tracking these plans to confirm that:
- Actions are being implemented on schedule.
- Actions are achieving the intended reduction in risk.
- The risk itself has not changed in nature or magnitude.
- New risks have not been created by the mitigation itself.
- Issues, delays, and resource constraints are escalated appropriately.
- Completed actions are validated and formally closed.

In the Three Lines Model, primary responsibility for monitoring mitigation plans sits with first-line management (the risk and action owners). Second-line functions such as the risk management or compliance function provide oversight, aggregate reporting, challenge, and methodology. Internal audit, as the third line, provides independent assurance that the monitoring process is designed appropriately and operating effectively, and performs its own follow-up on audit-identified issues.

How Monitoring Works: Key Components
1. Clear ownership. Each mitigation action must have a single named owner with authority and resources to deliver it. Shared or committee ownership is a red flag because it diffuses accountability.
2. Measurable milestones and deadlines. Actions should be broken into stages with target dates, allowing progress to be assessed objectively rather than through vague status descriptions.
3. Status tracking tools. Risk registers, action logs, GRC software, or dashboards record the current status of each action (not started, in progress, delayed, completed, closed). The tool matters less than the discipline of keeping it current.
4. Key Risk Indicators (KRIs). KRIs are metrics that signal changes in risk exposure. Monitoring KRIs alongside mitigation progress shows whether the actions are actually moving the risk, not just whether tasks are being ticked off. For example, if the mitigation is a new training program for fraud awareness, a KRI might be the number of incidents reported or the number of control exceptions.
5. Periodic review meetings. Risk committees, management meetings, or project steering groups review overdue and high-priority actions, discuss obstacles, and reprioritize when needed.
6. Escalation protocols. Predefined triggers (such as an action more than 30 days overdue on a high-rated risk, or a KRI breaching a threshold) require escalation to a higher level of management or the board.
7. Validation and closure. Before an action is marked complete, evidence should be obtained that it has been implemented and is operating. Internal audit often performs this validation for audit findings; for other actions, second-line functions or independent reviewers may do so. Self-certification by the owner alone is weaker evidence.
8. Residual risk reassessment. Once mitigation is complete, the risk should be re-evaluated to confirm that residual risk is now within appetite. If not, further action is needed.
9. Reporting. Regular reports to senior management and the board should summarize mitigation status, overdue items, trends, emerging issues, and the overall risk profile. Reporting should be exception-based and prioritized so that attention focuses on what matters most.
10. Feedback into the risk management cycle. Lessons from monitoring (recurring delays, ineffective responses, inaccurate initial assessments) should feed back into risk identification and assessment to improve the process over time.

Internal Audit's Role
Internal auditors evaluating this area should ask:
- Is there a defined, documented process for tracking mitigation actions?
- Do all significant risks have mitigation plans with owners and dates?
- Is the status information accurate and current? (Test a sample of actions marked complete against supporting evidence.)
- Are overdue actions identified, explained, and escalated?
- Are KRIs defined, monitored, and acted upon?
- Does the board or audit committee receive meaningful reporting on mitigation progress?
- Is there evidence that completed actions actually reduced the risk?
- Does management reassess risk after mitigation?
Internal audit must preserve independence: it can advise on the design of monitoring processes and assess their effectiveness, but it should not own or manage the mitigation plans themselves. Taking ownership of risk responses is a management responsibility and would impair objectivity.

Common Weaknesses Examiners Like to Test
- Actions marked complete without supporting evidence.
- Repeated extension of due dates without escalation.
- Owners who have left the organization with no reassignment.
- Mitigation plans that address symptoms rather than root causes.
- Monitoring that tracks activity (tasks done) but not outcomes (risk reduced).
- Reports that list everything without prioritization, burying critical overdue items.
- No reassessment of residual risk after mitigation.
- Internal audit performing management's monitoring role, creating an independence problem.

How to Answer Exam Questions on Monitoring Risk Mitigation Plans
CRMA questions in this area are usually scenario-based. You are given a situation and asked to identify the best course of action, the most significant weakness, or the most appropriate role for internal audit. Use this approach:

Step 1: Identify what the question is really asking. Is it about the design of monitoring, the effectiveness of monitoring, the role of a particular party, or the appropriate response to a monitoring finding?
Step 2: Apply the Three Lines Model. Management owns and monitors mitigation plans; second line oversees and aggregates; internal audit assures. If an answer has internal audit implementing or owning a mitigation action, it is almost always wrong.
Step 3: Prefer evidence over assertion. Answers that involve obtaining independent evidence that actions were completed and are working are stronger than answers that rely on management confirmation or self-assessment alone.
Step 4: Prefer outcome measures over activity measures. If the question asks how to determine whether mitigation is effective, look for answers involving KRIs, residual risk reassessment, or testing control operation, not simply confirming the task was finished.
Step 5: Think about escalation and governance. When a scenario describes repeated delays or overdue high-risk actions, the best answer typically involves escalating to senior management or the board, not simply extending the deadline or noting it in the register.
Step 6: Eliminate extreme or absolute answers. Options that say internal audit should take over the plan, that all actions must be audited every month, or that monitoring is unnecessary once a plan is approved are distractors.

Worked Example
Scenario: A risk register shows that a high-rated cybersecurity risk has a mitigation action (implement multi-factor authentication) that has been marked complete by the IT manager. The internal auditor is asked what is the most appropriate next step.
Weak answer: Accept the status because the IT manager is the action owner and is accountable.
Weak answer: Reopen the action and personally oversee the MFA rollout.
Strong answer: Obtain evidence that MFA has been deployed and is operating across the relevant systems, and confirm that the residual risk rating has been reassessed accordingly.
The strong answer reflects independent validation, outcome focus, and residual risk reassessment, all while keeping internal audit in an assurance role.

Exam Tips: Answering Questions on Monitoring Risk Mitigation Plans
1. Remember that the owner is management, never internal audit. Questions frequently test this independence principle in disguised ways.
2. Completion is not effectiveness. When the question asks whether a risk has been mitigated, the answer must involve checking that the risk level actually changed, not just that an action was completed.
3. Look for the word 'evidence'. Validation of completed actions through evidence is consistently the preferred approach over verbal or written assurance from the owner.
4. Overdue high-risk items demand escalation. If a scenario describes a significant risk with a long-overdue action, choose the answer that escalates to an appropriate governance level.
5. KRIs are your friend. When asked how to monitor whether a risk is increasing or whether mitigation is working on an ongoing basis, KRIs with defined thresholds are usually the best option.
6. Reporting should be prioritized and exception-based. If a question concerns board reporting, prefer concise, risk-ranked summaries highlighting overdue and critical items over exhaustive lists.
7. Link to the broader framework. Monitoring and review is a component of both COSO ERM and ISO 31000; the IIA Standards require follow-up on engagement results. Referencing these principles helps when two answers seem close.
8. Watch for mitigation creating new risks. A sophisticated distractor may ignore that a control or action can introduce new exposures (for example, outsourcing introduces third-party risk). The best answer considers this.
9. Read the role in the question stem carefully. Whether you are answering as the CAE, an internal auditor, a risk manager, or a line manager changes which action is most appropriate.
10. Manage your time. Scenario questions can be long. Identify the key issue (ownership, evidence, escalation, effectiveness, independence) quickly and match it to the answer that best addresses that issue.

Summary
Monitoring risk mitigation plans closes the loop in the risk management cycle. It ensures that agreed responses are implemented, that they actually reduce risk, that changes are detected, and that accountability is maintained. Management owns the process, second-line functions oversee it, and internal audit provides independent assurance that it works. In the exam, favor answers that emphasize clear ownership, evidence-based validation, outcome measurement through KRIs and residual risk reassessment, timely escalation, and preservation of internal audit independence.