After implementing a risk management policy, continuous monitoring of risks incurred using regular measurement of a number of parameters (eg: pollution levels, available budget, etc.) must be established to verify its efficient operation.

This can be done in particular through incident database management. Each incident is listed here and the resulting losses are evaluated. In certain cases, it is enough to ensure that the incident monitoring activity has been correctly executed and that it has not produced results exceeding anticipated tolerance thresholds.

If new risks are identified at this point, they should be added to the list of risks managed by the organization. Operational managers or the risk management manager within the organization must take these into account at the next risk review.