A component of the risk management plan is:

• A. Disciplinary action
• B. Monitoring control methods
• C. Policies and procedures
• D. Training and education

Answer: (B)

Monitoring control methods are essential because a risk management plan must show how the effectiveness of implemented controls will be tracked over time. This involves specifying what to monitor (metrics or indicators), how data will be collected, who is responsible for the monitoring, how often reviews occur, and what actions are taken if controls aren’t working as intended. This ongoing oversight allows you to detect changes in risk, verify that controls remain effective, and adjust strategies to keep risk at acceptable levels.

Disciplinary action relates to enforcement and human resources rather than the plan’s mechanism for oversight. Policies and procedures guide how work should be done and support risk management, but they aren’t the part of the plan that specifies how you monitor and verify control effectiveness. Training and education are important for implementing controls, but they describe activities to reduce risk rather than the systematic process of monitoring and adjusting controls over time.