All risk associated controls and treatments must be continually monitored and periodically reviewed so that evaluation of the risk reflects the current operating environment, and that the management process is operating as intended. The frequency of review will depend on the level of risk, the frequency of the activity and any changes of circumstances.

The objectives of monitoring and review are to:

• Understand how effectively the risk control environment is operating enabling further treatment/control modification to address gaps in performance
• Confirm that risk treatments have been implemented as planned
• Assess whether risk treatments have proven effective; and
• Determine any change in the overall risk profile, because of improvement to the control environment (i.e., by treatment implementation), or new risks added, or existing risks closed.

Supervisors, including District and Region Managers, should regularly review the completion of risk assessments, or when required for an activity, and the implementation of controls, especially where risks have been escalated to their level.

SGGO Boards and GGA Board should monitor the Risk Register on a regular basis and review on an annual basis.

The RMF and any changes that might affect it are reviewed on a triennial basis. Management will monitor the application of the risk management framework across GGA (SGGO management for SGGOs) and will make recommendations for any improvements to the Board of GGA through the Finance and Risk Committee.

It is necessary to refer to the Risk Appetite Statement for each risk category, and their associated acceptable risk ratings (see Table 2.4.4 Risk Appetite) to determine whether a risk is acceptable or if not, requires further treatment. If further treatment is deemed necessary, and yet the ‘treated’ risk rating is still above the accepted rating, then the relevant Girl Guide entity needs to decide whether to ‘tolerate’ this particular risk, or invest in further treatment to reduce the risk to its acceptable rating
The Risk Escalation table below indicates how a risk needs to be escalated depending on its rating.

Risk Escalation Table

The decision to accept a risk without further assessment or treatment, will need to be made based on the likelihood and consequences of the Risk occurring, and the ability of GGiA to absorb or recover from the Risk exposure should the Risk manifest.