Risk and Control Monitoring and Reporting is the continuous, systematic process of measuring whether controls are performing as designed, tracking whether risk levels remain within accepted tolerances, and communicating that status to the right stakeholders at the right level of detail. It is the ongoing surveillance phase that follows control design and implementation: a repeating cycle of evidence collection, indicator measurement, threshold comparison, exception escalation, and structured reporting. In CRISC terms, it operationalizes the feedback loop between risk response actions and the organization's actual risk posture.
Where it stops · what it isn't
- —IS: Ongoing, repeating surveillance of whether existing controls are working and whether risk levels are shifting — producing structured reports for multiple stakeholder tiers.
- —IS: The process of defining KRIs (Key Risk Indicators) and KCIs (Key Control Indicators), thresholds, escalation paths, reporting cadences, and dashboards.
- —IS NOT: Control testing — point-in-time assessment of whether a control was correctly designed and implemented (covered in the Control Implementation, Testing and Effectiveness cubelet).
- —IS NOT: Risk identification or risk assessment — finding and sizing new risks (covered in earlier CRISC competencies).
- —IS NOT: Risk treatment planning — deciding which control response to implement (covered in the Risk Treatment Plans cubelet).
- —IS NOT: Data collection and aggregation infrastructure design — monitoring consumes that infrastructure but does not design it (covered in the Data Collection, Aggregation, Analysis and Validation cubelet).
- —IS NOT: Internal or external audit — monitoring is a management activity; auditors independently assess whether the monitoring process itself is adequate.
Connected concepts in the graph
Every cubelet sits in a knowledge graph. Here's what this one connects to.
REQUIRESPerformance Risk and Control Metrics (KRI/KCI definition)Control Implementation, Testing and EffectivenessData Collection, Aggregation, Analysis and Validation
PART OFCRISC Domain 3: Risk Response and Reporting
ENABLESBoard and Executive Risk ReportingRegulatory Compliance Evidence (SOX 404b, HIPAA, PCI-DSS)Continuous Improvement and Control Remediation
RELATED TORisk Treatment Plans
CONSTRAINSThird-Party and Vendor Risk Management (scope boundary)