In addition to the continuous monitoring of risks during normal operation of organization processes, periodic reviews of risk management are carried out by operational managers to verify that new risks have not appeared and that the risk treatment strategies applied are still suitable and effective. To determine this, control self-assessment questionnaires can be used.

In addition to the operational management reviews, audits that are internal or external to the activity offer an outside view of organization operation, and can reveal new malfunctions.

Audit findings will usually indicate systemic weaknesses of the risk management system. Actions taken in response to audits should be focused on remedying the system and not just the symptoms.