Assessment: Mittenda Limited IE · Regulation: EU 2023/1113 · Roles: PSP, Intermediary PSP, CASP, Intermediary CASP
Stage 5 — Monitoring
ISO 31000:2018 §6.6 — Monitoring and review — what this requires
ISO 31000:2018 §6.6 — Monitoring and review
The purpose of monitoring and review is to assure and improve the quality and effectiveness of process design, implementation and outcomes. Ongoing monitoring and periodic review of the risk management process and its outcomes should be a planned part of the risk management process. Monitoring and review should take place in all stages of the process.
How this app differs from ISO 31000
ISO 31000 says that monitoring and review should take place in all stages of the process. This app puts them in one stage, Stage 5, with one sign-off that you can reopen. Each indicator keeps only its latest reading, not a history of readings. You log reassessments on this page when something changes.
Track risks and controls over time through Key Risk Indicators and Key Control Indicators, watch treatment plans through their lifecycle, and log reassessments when something changes. Stage state: In progress
Indicator status
Each indicator's latest reading is classified against its amber / red thresholds. Red indicators are breaching their alert level; amber are early warnings; indicators with no reading yet are unmeasured.
No indicators yet
Key risk and key control indicators (KRIs / KCIs) track your risks and controls over time. Add indicators with their latest readings and this panel shows how many are breaching, in warning, or normal.
Assurance currency
Monitoring is a lens over the analysis-phase control evidence. For each rated control: how independent its assurance is (assurance line — 1st-line self-testing is weakest, external strongest), when its effectiveness was last reviewed, and whether that review is current. Surfaces controls that are rated but unassured, only low-independence assured, or stale.
No control effectiveness has been rated yet — assurance currency appears once controls are assessed.
Treatment plans
Treatment plans recorded against in-scope risks during Evaluation. Monitoring watches them to completion; a plan past its target date that isn't closed is overdue.
Reassessments
Scheduled and triggered reassessment cycles. Logging a trigger records why the assessment was revisited, which risks it affects, and can reopen stages for re-work.
Monitoring sign-off
Capture KRIs / KCIs with readings and watch treatment plans to completion. Lock when the monitoring baseline is set and ready for sign-off.