In ORM, what is the purpose of the 'supervise and review' step?

• A. To ensure implemented controls are effective and to monitor for changes.
• B. To draft risk assessment documents.
• C. To select control measures.
• D. To deploy hardware upgrades.

Answer: (A)

The point of supervise and review is to ensure that the controls already put in place actually work over time and to watch for changes that could alter risk. After controls are implemented, this step checks their effectiveness, gathers evidence of performance, and flags any drift or new risks caused by changes in processes, systems, people, or external conditions. It keeps the risk picture up to date, prompts re-evaluation of residual risk, and supports continuous improvement by informing adjustments to controls or assessments as needed.

Drafting risk assessments belongs to the analysis phase that identifies and evaluates risk. Selecting control measures happens earlier in the treatment or mitigation phase. Deploying hardware upgrades is a tactical action aimed at implementation, not the ongoing oversight described by supervise and review.