The information security manager is defining how often each risk in the register should be monitored. Which approach is MOST appropriate?
Select an answer to reveal the explanation.
Short Explanation
You check a pot on the stove more often than one in the fridge. Monitoring should match how big and how fast-moving each risk is, so the high, volatile ones get watched closely and the low, stable ones don't eat your week.
Full Explanation
Monitoring consumes resources, so its frequency should be proportional to the significance of the risk and its volatility. High risks, risks close to appetite and risks driven by fast-changing threats warrant frequent monitoring, often through key risk indicators, while low and stable risks can be reviewed less often. This risk-based approach directs attention where a change would matter most and is defined through the risk management process, so it is consistent and defensible. Monitoring everything monthly looks fair but wastes effort on low risks and may still be too infrequent for the most volatile exposures, because uniform treatment ignores differences in risk. Tying monitoring to the annual audit cycle confuses assurance with management; audit provides periodic independent evaluation, while risk monitoring is a continuous management responsibility, and a year is far too long for significant risks. Letting each control owner choose produces inconsistent practice and gives the decision to people who may not see the enterprise-wide risk picture; control owners operate controls, while frequency should follow the risk rating set by risk governance. Exam caveat: frequencies should be revisited when a risk's rating changes. Operational check: confirm the register records a monitoring frequency for each risk that matches its current rating.