In risk management, what is done after implementing mitigations?

• A. Document decisions and monitor effectiveness.
• B. Immediately restart risk assessment.
• C. Cancel the risk management plan.
• D. Remove mitigations and revert.

Answer: (A)

After implementing mitigations, the important follow-up step is to document what was decided and how the effectiveness will be tracked over time. This creates a clear record of the actions taken, the rationale behind them, who is responsible, and the triggers or metrics used to judge success. Monitoring effectiveness means collecting data to verify that the mitigations actually reduce either the probability or impact of the risk, watching for any residual risk, and noting any unintended consequences. Keeping the risk register and stakeholder communications up to date is part of this process, ensuring everyone knows current risk posture and next steps. If monitoring shows the mitigations aren’t working as intended or new information emerges, the plan is revisited and adjustments are made accordingly.