A city's risk register is refreshed only during the annual budget cycle even though systems and threats change monthly. What improvement best aligns with sound risk management?
Select an answer to reveal the explanation.
Short Explanation
Risk isn't a once-a-year Christmas ornament. Systems and attackers move; the register has to keep up with monitoring and real metrics. Annual budget theater alone leaves eleven months of blind spots.
Full Explanation
Risk management requires ongoing monitoring and periodic measurement of control effectiveness, not a register frozen to the annual budget calendar while systems and threats change monthly. Annual-only refresh creates stale residual-risk views that mislead investment and false assurance between budget cycles. Permanently freezing scores to protect last year's council narrative, replacing monitoring with a rare tabletop, or deleting residual-risk fields because annual updates 'imply' stability all undermine continuous risk governance. Municipal IT and threat landscapes shift with new SaaS, patches, personnel changes, and seasonal events; continuous monitoring and regular reporting keep leadership decisions aligned with current exposure. Exam caveat: CISSP frames risk monitoring and reporting as continuous activities supporting governance, not once-a-year paperwork. Operational check: establish cadence for control metrics, vulnerability and incident trends, and risk-register updates; escalate material changes between budget cycles; and brief executives with current residual risk rather than last year's snapshot. Tie monitoring outputs to owners and due dates so stale entries are remediated or formally re-accepted. Use automation where feasible for control health signals, and reserve deep workshops for material architecture or threat shifts.