Now that you have built your risk control matrix and mapped controls to those risks (or determined another method of mitigating risk is desirable), you will now monitor those risks. It is important for an organization to do this as factors are ever-changing, that lead to new risks.