Domain 2 · Objective reference 2B3 · Chapter 12 of 35
Monitor risk and request decisions
About 5 minutes · Detailed public baseline effective 2022; the replacement exam starts 3 November 2026 and its exact revised topic/task mapping remains unverified
Session only. Enable saving or download a backup from this course’s hub.
Completion is self-reported and does not certify understanding.
See it · Try it · Recall it
Picture the topic
Remember this: Reporting should request a decision not just display a color.
Explore the anchors
Collect current risk and control evidence.
Concept matching activity
Match this task or description to its concept:
Assess changes against tolerance.
Choose a concept before checking the explanation.
A quick way to study this topic
- Hide the explanation and redraw these three anchors from memory.
- Explain the difference between the anchors in your own words.
- Apply the distinction to the worked example below. Check the full lesson for assumptions and exceptions.
- Recall it again tomorrow, then after a few days. A memory hint is a retrieval cue, not a replacement for understanding.
Original academy illustrations and fictional exercises. These are learning simulations, not a real virtual machine, network assessment or measure of job readiness. Activities reset when you leave or reload; they do not change quiz scores.
What this chapter explains
- Management concept and decision mechanism
- Choose signals with a purpose
Management concept and decision mechanism
An indicator needs a population, source, interval, threshold and response owner. Interpret trends alongside changes in collection and business volume. An enterprise average can conceal critical concentrations, so retain material outliers and uncertainty in executive reporting. Communicate current exposure, movement, corrective action, the effect of delay and the decision requested. Reassess when accepted assumptions change, not only at a calendar date. Reporting activity is not the same as reducing risk; governance needs an accountable route for action when a threshold is exceeded.
Choose signals with a purpose
An indicator is useful when a change in it can lead to a decision. For example, a growing number of critical services without tested recovery arrangements may signal increasing exposure. Define the service population, evidence source, owner, update frequency, threshold, and action.
Separate a process measure from a risk signal. Training completion describes delivery. Repeated misuse of sensitive information may reveal an exposure that the training measure missed. Use several related signals instead of treating one favorable percentage as proof that risk is low.
Worked example
A 98% access-review result is supplemented with a separate report that every overdue item concerns payment administrators.
Check your understanding
What makes a risk indicator actionable?
Show explanation
A defined meaning and threshold, reliable data, an accountable owner and a specified action or escalation when conditions require it.
Source and study boundary
Official syllabus source. The reference identifies the topic being taught. Explanations and examples are original academy material; a topic link does not establish independent approval or sufficient exam mastery.