Monitor
Whether reality agrees with the estimate, and how fast the organisation learns. 7 components, chapter 18 of the book.
Risk data discipline
Every number that reaches a risk report is accurate and reconciled, complete across entities and risk types, timely including in a crisis, adaptable to unplanned questions, and carries lineage: source, transformation and owner, walkable backward. Applies to the register as much as to a capital ratio.
Source: BCBS 239 [17]
Indicators
Every indicator has a threshold; every breach and its escalation are traceable to a recipient and an action; leading indicators are reported apart from lagging ones, never mixed in one view. Threshold is distinct from limit and tolerance.
Events, near misses and root cause
Losses and near misses enter one base with cause in a fixed taxonomy; barrier analysis names from the register the control that should have prevented and the one that should have detected the event, and why each did not; corrective action is systemic; a recurrence chart is kept until closure is demonstrated. Failed controls get their measured effectiveness and ratings revised.
Common incident schema
One structured incident record compatible with the supervisory exchange format, four sections and three phases; loss base, cyber log and third-party incidents are views of it; barrier that failed and recurrence status are extensions that keep the base record valid.
Source: FSB FIRE [27]
Calibration
Estimates are confronted with outcomes: likelihood bands against event counts, detection ratings against escapes, simulated distributions against losses; scales and models are recalibrated with the evidence and every change is versioned so trends survive it.
Continuity
A business impact analysis per process with maximum tolerable outage, recovery time and recovery point; the resource inherits the most demanding function's recovery time and the recovery point dictates backup frequency, both written as tests; exercises produce corrective actions tracked to closure.
Lifecycle and triggers
Every register object has a lifecycle state with continuous authorization and an explicit disposal step; substantial change triggers reassessment and reopens the design gate; early warning runs on at least three cadences and, for physical hazards, four pillars.
Source: NIST SP 800-37 [20]; COSO principle 15 [2]; INFORM [7]; UNDRR [24]