Risk Monitoring, Control, Reporting, and Organizational Learning

Introduction

Risk management does not end when risks are identified, analysed, or assigned to owners. Project conditions change continuously: assumptions become invalid, suppliers revise commitments, regulations evolve, technical evidence accumulates, and stakeholders alter priorities. Consequently, risk exposure is dynamic rather than permanent. A risk register that is accurate at project approval may be materially incomplete several months later.

Risk monitoring and control is the disciplined process of tracking identified risks, detecting emerging risks, evaluating changes in probability or impact, implementing responses, monitoring residual exposure, and communicating decision-relevant information. It also includes identifying when a risk has become an issue, controlling the use of contingency and management reserves, and converting experience into organizational learning.

At postgraduate level, the subject should be understood as a governance and decision system, not merely as periodic updating of a register. Effective control connects risk data with scope, schedule, cost, quality, procurement, benefits, change control, and organizational accountability.

Learning Objectives

By the end of this chapter, the learner should be able to:

1. Distinguish leading indicators, lagging indicators, triggers, issues, and risk events.
2. Design monitoring arrangements that link risk exposure to accountable actions.
3. Use risk audits, variance analysis, trend analysis, and reserve drawdown to assess control effectiveness.
4. Develop useful risk reports and dashboards for different governance levels.
5. Integrate risk decisions with formal change control and issue management.
6. Conduct post-project reviews and convert experience into reusable organizational knowledge.
7. Critically evaluate limitations, behavioural risks, data quality, and ethical issues in risk reporting.

1. Risk as a Dynamic Management Object

A risk is an uncertain event or condition that, if it occurs, may affect project objectives. Monitoring requires more than asking whether the event has occurred. It asks whether its causes are strengthening, whether the exposure has changed, whether responses are working, and whether new risks have appeared.

A useful distinction is:

• Inherent risk: exposure before considering planned responses.
• Residual risk: exposure remaining after responses have been implemented.
• Secondary risk: a new risk created by a response.
• Emerging risk: a developing uncertainty not yet fully represented in the original risk model.
• Issue: a current condition or event requiring management action, rather than a merely possible future event.
• Opportunity: uncertainty that may produce a beneficial effect.

Risk control is therefore a feedback process. Information from project execution changes the assessment of uncertainty; that assessment influences decisions; decisions change project conditions; and the resulting conditions generate new information.

A simple exposure representation is:

where:

• RE = risk exposure score;
• P = assessed probability of occurrence, normally between 0 and 1; and
• I = assessed impact using a defined scale or monetary unit.

This is a screening measure, not a complete probabilistic forecast. It assumes that probability and impact are defined consistently and that multiplication is meaningful for the selected scales. It should not be interpreted as an expected monetary value unless I is expressed in monetary units and the assumptions support that interpretation.

For a set of mutually exclusive, collectively exhaustive outcomes, expected monetary value may be expressed as:

where pᵢ is the probability of outcome i, Cᵢ is its financial consequence, and the probabilities sum to 1. In project practice, EMV is useful for portfolio comparison and reserve planning but can conceal variation, tail exposure, timing, correlation, and non-financial consequences. It should not replace scenario analysis or professional judgement.

2. Leading and Lagging Indicators

2.1 Leading indicators

A leading indicator provides evidence that a risk may increase or decrease before the adverse consequence occurs. Examples include:

• declining completion of design reviews before construction;
• increasing numbers of unresolved interface decisions;
• supplier financial stress or repeated late submittals;
• rising defect rates in early prototypes;
• declining attendance at safety briefings;
• increasing staff turnover in a specialist team; and
• repeated changes to a requirement that has not yet been baselined.

Leading indicators are valuable because they create response time. Their usefulness depends on causal relevance, timely collection, stable definitions, and a known action threshold.

2.2 Lagging indicators

A lagging indicator records an outcome after it has occurred. Examples include actual schedule delay, cost overrun, rejected deliverables, lost-time incidents, or realized claims. Lagging indicators are important for accountability and performance evaluation, but they often provide little time for prevention.

A mature control system uses both types. Leading indicators support prevention; lagging indicators test whether prevention and control have worked.

2.3 Triggers and thresholds

A trigger is an observable condition indicating that a risk response, escalation, or reassessment should occur. A trigger must be specific enough to support consistent action. “Supplier performance deteriorates” is weak; “two consecutive critical submittals are more than five working days late” is more operational.

Thresholds may be:

• Warning thresholds, prompting investigation;
• Action thresholds, requiring implementation of a planned response; and
• Escalation thresholds, exceeding the authority or tolerance of the project manager.

Thresholds should be agreed in advance where possible. Otherwise, teams may normalize deterioration or reinterpret evidence to avoid escalation.

3. Monitoring Architecture and Accountability

Monitoring arrangements should answer five questions:

1. What will be monitored?
2. Who owns the information and the response?
3. How often will it be reviewed?
4. What threshold changes the decision?
5. Where is the decision recorded?

A risk owner is accountable for ensuring that a risk is understood and managed; an action owner is responsible for completing a particular response action. They may be different people. For example, a project director may own a regulatory risk while the compliance manager owns the action to obtain an interpretation from the regulator.

A monitoring plan commonly includes the risk statement, causes, consequences, indicators, data source, frequency, threshold, response, owner, escalation route, and evidence required for closure. Closure should not mean that a risk has simply disappeared from a meeting agenda. It should be supported by evidence, such as an approved design, signed contract, completed test, or expiry of the exposure period.

Monitoring frequency should reflect velocity and consequence. A low-velocity procurement risk may be reviewed monthly, whereas a safety-critical construction risk may require daily controls. High frequency is not automatically effective; excessive reporting can create administrative burden and obscure material signals.

4. Risk Audits and Control Effectiveness

A risk audit is a structured examination of the risk management process and selected risk controls. It is not merely a compliance check on whether a risk register exists. An audit may examine:

• whether risks are being identified at the appropriate organizational levels;
• whether owners understand their responsibilities;
• whether assessments use consistent criteria;
• whether response actions are implemented and effective;
• whether assumptions remain valid;
• whether closed risks were closed on adequate evidence;
• whether reserves are being used for authorized purposes; and
• whether escalations are timely and transparent.

Audits may be performed by an internal assurance function, an independent project office, a peer team, an external auditor, or a regulator. Independence improves credibility, but auditors also need sufficient technical understanding to distinguish genuine control failure from legitimate uncertainty.

An audit finding should normally identify the condition, criterion, cause, consequence, evidence, owner, and corrective action. A finding such as “risk management is weak” is not actionable. A stronger finding is: “Of 18 high-priority risks sampled, 11 had no documented review of trigger status during the last reporting cycle; the risk manager will introduce evidence-based trigger reviews by 30 June.”

Audits can themselves create risks. Excessive emphasis on documentation may encourage ceremonial compliance, while a punitive audit culture can discourage early disclosure. Assurance should therefore test both records and actual decision behaviour.

5. Variance and Trend Analysis

Variance analysis compares planned or baseline values with actual or forecast values. Trend analysis examines movement over time and can reveal deterioration before a threshold is reached.

For a generic measure, absolute variance is:

where A is the actual or current value and B is the baseline, budget, target, or prior approved forecast. Percentage variance, when B is non-zero, is:

The sign must be interpreted in context. A positive schedule variance may be favourable or unfavourable depending on whether the measure is planned duration, earned value, or days ahead. Definitions must therefore accompany the number.

In earned value management, schedule variance is commonly represented as:

and cost variance as:

where EV is earned value, PV is planned value, and AC is actual cost, all expressed in the same monetary unit. A negative SV indicates less value has been accomplished than planned at the measurement date; a negative CV indicates that the accomplished work cost more than its earned-value budget. These measures are informative but do not explain causation and should be supplemented with schedule-network, quality, and risk analysis.

A trend may be assessed using a simple slope between two observations:

where y is the measured indicator and t is time. This is a descriptive measure, not proof of a continuing trend. It assumes comparable measurement conditions and should not be extrapolated blindly when the process is nonlinear, seasonal, or affected by a known intervention.

Worked example: interpreting a risk trend

A project tracks unresolved critical interface decisions. The count is 4 in week 1 and 10 in week 4. The average weekly change between these observations is:

If the agreed action threshold is 8, the week-4 value has already crossed it. The correct management conclusion is not simply that “risk exposure is 150% higher.” The team should investigate causes, identify affected work packages, assess schedule and quality consequences, and decide whether to implement the predefined response or escalate the matter.

6. Reserve Drawdown and Financial Risk Control

Project reserves are not a general-purpose fund. Their governance depends on the organization’s terminology and approved cost-management method. A contingency reserve is commonly associated with known-unknown risks within the project’s control; a management reserve is commonly held for unforeseen work within the overall project scope and controlled at a higher authority. Organizations must define these terms consistently because some standards and contracts use different arrangements.

A basic reserve balance is:

where Rₜ is reserve remaining at time t, R₀ is the opening reserve, Aₜ is approved additions up to time t, and Dₜ is cumulative authorized drawdown. All terms must use the same currency and scope definition.

Suppose a project starts with a contingency reserve of $500,000. Approved drawdowns are $120,000 for a ground-condition response and $80,000 for a supplier redesign. No additions are approved. The remaining reserve is:

The result does not mean that $300,000 is necessarily adequate. Management should compare it with the current quantified exposure, remaining duration, correlation among risks, and confidence in response effectiveness. Drawdown should be recorded with the triggering risk or issue, authorization, amount, date, forecast effect, and residual exposure.

A common control failure is to treat reserve consumption as a success metric in isolation. Low drawdown may indicate effective control, but it may also indicate delayed recognition, under-response, or hidden cost in another budget. Conversely, high drawdown may reflect responsible use of authorized contingency. Interpretation requires context.

7. Reporting and Dashboards

Risk reporting should support decisions rather than merely distribute information. Different audiences need different levels of aggregation.

• Work-package teams need actions, triggers, dependencies, and immediate decisions.
• Project governance boards need exposure by objective, escalation decisions, response effectiveness, forecast reserve, and material changes.
• Portfolio leadership needs cross-project concentration, shared dependencies, aggregate exposure, and capacity constraints.
• Sponsors and external stakeholders need concise information about tolerance breaches, major responses, and implications for benefits, compliance, cost, time, and reputation.

A useful dashboard may show the top risks, movement since the previous period, overdue responses, risks above tolerance, emerging risks, reserve balance and drawdown, issues converted from risks, and decisions required. A red-amber-green scheme is useful only when definitions are explicit. Colour without criteria creates false precision and may conceal uncertainty.

A dashboard should show direction, not only state. For example, a medium-rated risk with rapidly worsening indicators may require more attention than a high-rated risk that is stable and well controlled. Narrative should explain the significance, not repeat the register.

Data governance is essential. Each metric should have a definition, owner, source, update date, validation rule, and treatment of missing values. Automated dashboards can improve timeliness but can also amplify erroneous or stale data. A visually sophisticated dashboard does not compensate for weak measurement design.

8. Integrated Change Control and Issue Conversion

Risk monitoring frequently identifies a need to alter scope, schedule, cost, quality criteria, resources, procurement arrangements, or technical design. Such changes should pass through integrated change control. The risk team should not unilaterally alter a baseline merely because a risk has increased.

An integrated change proposal should explain:

1. the originating risk, issue, assumption, or opportunity;
2. the proposed change and alternatives considered;
3. effects on scope, schedule, cost, quality, resources, benefits, contracts, compliance, and residual risk;
4. reserve and funding implications;
5. dependencies and secondary risks;
6. authority required for approval; and
7. implementation, verification, and communication arrangements.

A risk becomes an issue when its uncertain event occurs or when a current condition requires action. For example, “the supplier may fail to deliver a certified component” is a risk. Once the supplier formally announces that certification will not be achieved by the required date, the condition is an issue. Conversion should preserve the history of the risk, including its cause, trigger, response, and realized consequence. Otherwise, organizational learning is lost and the same pattern may later be recorded as a new, disconnected risk.

Issue conversion does not imply that the original risk register entry should be deleted immediately. The realized risk should be linked to the issue record, residual consequences should be reassessed, and any secondary or cascading risks should be identified.

9. Post-Project Reviews and Organizational Learning

A post-project review examines what happened, why it happened, what was controlled effectively, and what should change in future work. It may be conducted at closeout, at major milestones, or after a significant event. A single final meeting is often insufficient because recall becomes selective and participants may rationalize decisions after outcomes are known.

Effective reviews distinguish:

• Outcome evaluation: whether objectives and benefits were achieved;
• Process evaluation: how decisions and controls operated;
• Causal analysis: why important outcomes occurred; and
• Transfer analysis: where the learning applies elsewhere.

The review should avoid simplistic blame. Outcomes are often produced by interacting technical, organizational, contractual, and behavioural conditions. Methods such as timelines, causal maps, barrier analysis, the “five whys,” and structured interviews can help, but each has limitations. The five-whys technique may oversimplify complex systems if it forces a single linear cause.

Lessons should be recorded in a repository using a searchable structure. A useful lesson record includes:

• project context and type;
• date and lifecycle stage;
• observed situation;
• consequence or evidence;
• contributing conditions;
• action that worked or failed;
• recommendation;
• applicability conditions;
• owner for institutionalization;
• status of adoption; and
• keywords and linked risks.

A lesson is not organizational learning merely because it is uploaded. Learning occurs when changed knowledge influences future decisions, methods, controls, training, contracts, standards, or resource allocation. Repositories therefore need curation, taxonomy, quality review, searchability, access controls, and periodic evidence that lessons have been reused.

10. Illustrative Case: MetroLink Control System Upgrade

Background

MetroLink, a fictional urban transport authority, initiated a 30-month project to replace a legacy signalling control system. The project involved software integration, trackside equipment, operator training, safety certification, and multiple suppliers. The approved cost baseline was $48 million, with a $4 million contingency reserve.

Problem

During the first six months, the dashboard showed the project as generally amber. However, three leading indicators deteriorated: unresolved interface decisions increased from 6 to 19, supplier technical queries older than ten working days increased from 2 to 11, and completion of independent safety evidence fell below the agreed threshold. The lagging indicators—actual delay and rejected tests—had not yet become severe.

The risk register contained a high-rated integration risk, but its owner reported it as stable because the formal integration milestone had not yet been missed. This revealed a weakness: the monitoring process focused on milestone outcomes rather than leading evidence.

Analysis

The project risk manager performed a focused audit. It found that:

• trigger definitions were inconsistent across work packages;
• interface decisions lacked a single accountable owner;
• supplier queries were being counted, but their age and criticality were not consistently classified;
• risk responses were listed but not linked to acceptance criteria; and
• reserve requests were recorded financially but not connected to risk IDs.

Trend analysis showed that unresolved interface decisions were increasing by approximately 4.3 per week over the most recent three-week period. More importantly, several decisions affected safety evidence and the critical-path integration sequence. The project board concluded that the risk had crossed the action threshold even though the contractual milestone remained achievable only under increasingly optimistic assumptions.

Approach and solution

The board approved an integrated response:

1. appoint a senior integration owner with authority across suppliers;
2. establish a twice-weekly interface decision forum;
3. classify open decisions by safety, critical-path, and non-critical categories;
4. require supplier responses within defined service periods;
5. commission an independent review of safety evidence; and
6. reserve $650,000 for specialist integration and certification support.

The change control record documented effects on cost, schedule, quality, safety assurance, and secondary risks. The reserve drawdown was linked to the integration risk and its associated issue records.

Four weeks later, the supplier advised that a required certification package would miss the planned date. The risk was converted into an issue, while a new secondary risk was opened concerning operator-training compression. The project did not hide the conversion by deleting the original risk.

Outcome

Interface decisions fell from 19 to 7 over six weeks. The certification date moved by twelve days, but the project avoided a much larger commissioning delay. The final contingency balance was $2.9 million. A post-project review found that the principal failure was not the absence of risk identification; it was weak trigger design, fragmented ownership, and excessive reliance on lagging milestones.

MetroLink revised its project governance standard. Future projects were required to define leading indicators for critical risks, link reserve transactions to risk and issue records, and perform an early control-effectiveness review before major integration.

Learning points

The case demonstrates that:

• a formally high risk can be poorly controlled if its indicators are weak;
• leading indicators create management time before consequences become irreversible;
• issue conversion should preserve causal history;
• financial controls and risk records should be integrated; and
• organizational learning requires changes to future governance, not merely a completed lessons form.

11. Challenges, Limitations, and Ethical Governance

Data quality and uncertainty

Risk data are often incomplete, subjective, delayed, or politically influenced. Numerical scores may create an appearance of objectivity even when probability estimates are based on thin evidence. Teams should record confidence, assumptions, data sources, and disagreement rather than suppressing uncertainty.

Behavioural and cultural pressures

Optimism bias, anchoring on the approved baseline, groupthink, escalation avoidance, and incentive systems can distort reporting. If managers punish early disclosure, risks will be reported late or reclassified as issues after damage occurs. Psychological safety is therefore a control condition, not merely a cultural preference.

Ethical responsibilities

Risk reporting should be truthful, proportionate, and understandable to decision-makers. Material safety, environmental, legal, financial, or stakeholder impacts must not be concealed through aggregation or favourable colour coding. Confidential information must be protected, but confidentiality should not be used to prevent legitimate oversight. Conflicts of interest in risk ownership, assurance, procurement, and reserve approval should be declared and managed.

Technology and AI

Integrated project platforms can connect schedules, cost data, quality records, procurement information, issue logs, and risk registers. Machine-learning tools may identify unusual patterns, such as increasing defect rates or supplier delays. However, predictive outputs depend on data quality and historical relevance. AI-generated alerts should be treated as decision support, not as autonomous risk judgements. Human review is required for explainability, privacy, bias, cybersecurity, accountability, and consequential decisions.

12. Best-Practice Framework

A robust monitoring and learning system generally follows these principles:

1. Define risk indicators and triggers when risks are first assessed.
2. Assign separate accountability for risk ownership and response actions where appropriate.
3. Combine leading, lagging, and control-effectiveness indicators.
4. Review risk movement and causes, not only current ratings.
5. Use risk audits to test actual control effectiveness.
6. Link reserve drawdown to authorized risk or issue records.
7. Integrate risk decisions with formal change control.
8. Convert realized risks into issues while preserving history and identifying secondary risks.
9. Tailor dashboards to the decisions required by each audience.
10. Record assumptions, confidence, data sources, and dissenting views.
11. Conduct reviews during the project as well as at closure.
12. Convert lessons into revised methods, standards, training, contracts, and governance.
13. Protect honest escalation through fair accountability and psychologically safe reporting.
14. Periodically test whether the monitoring system itself is producing timely and useful decisions.

Chapter Summary

Risk monitoring and control is a continuous feedback process through which project teams detect changing exposure, evaluate responses, control reserves, escalate decisions, and maintain alignment with objectives. Leading indicators and triggers provide time for preventive action, while lagging indicators confirm realized performance and consequences. Risk audits examine whether controls work in practice, and variance and trend analysis reveal movement that may not be visible in a static risk rating.

Reserve drawdown must be authorized, traceable, and interpreted against remaining exposure rather than treated as a simple success or failure measure. Dashboards should communicate movement, thresholds, uncertainty, decisions, and accountability. When a risk occurs, issue conversion should preserve its history and identify secondary effects. Integrated change control ensures that risk responses affecting baselines, contracts, or benefits are evaluated systematically.

Post-project reviews create potential learning, but repositories alone do not produce organizational learning. Learning is achieved when evidence changes future decisions, processes, standards, capability, and governance. Ethical reporting, data quality, psychological safety, and human oversight of technology are essential to maintaining a trustworthy risk-control system.

Key Terms

Risk monitoring: Ongoing collection and interpretation of information about risk exposure and responses.

Risk control: Actions taken to maintain exposure within approved tolerances and objectives.

Leading indicator: A measure that provides advance evidence of a possible future condition or event.

Lagging indicator: A measure of an outcome after it has occurred.

Trigger: A defined observable condition that initiates investigation, response, or escalation.

Threshold: A boundary at which a specified management action is required.

Inherent risk: Exposure before planned responses are considered.

Residual risk: Exposure remaining after responses are implemented.

Secondary risk: A risk created by implementing a response.

Emerging risk: A developing uncertainty not fully represented in the existing risk model.

Issue: A current condition or event requiring action.

Risk audit: A structured examination of risk processes and control effectiveness.

Variance analysis: Comparison of actual or forecast values with a baseline or target.

Trend analysis: Examination of movement in a measure over time.

Contingency reserve: Authorized provision commonly associated with identified risks within the approved project scope.

Management reserve: Higher-level provision commonly controlled for unforeseen work within overall project scope, subject to organizational rules.

Risk dashboard: A visual and narrative display of material risk information for decision-making.

Integrated change control: Formal evaluation, approval, rejection, and implementation of changes across project dimensions.

Issue conversion: The transition of a realized risk into an actively managed issue while retaining its risk history.

Organizational learning: Durable improvement in organizational knowledge and practice resulting from experience and evidence.

Review Questions

5 Short Answer Questions

1. What is the difference between a leading indicator and a lagging indicator?
2. Why should a trigger be expressed as an observable condition?
3. Define residual risk and secondary risk.
4. What information should accompany a reserve drawdown?
5. Why is uploading a lesson to a repository insufficient to demonstrate organizational learning?

5 Long Answer Questions

1. Explain how risk monitoring operates as a feedback system throughout the project life cycle.
2. Discuss the design and use of risk audits, including their benefits and possible behavioural limitations.
3. Explain how variance analysis and trend analysis should be combined with professional judgement.
4. Describe how risk reporting should differ for work-package teams, project boards, and portfolio leadership.
5. Evaluate the relationship between risk monitoring, issue management, and integrated change control.

3 Analytical / Application Questions

1. A project’s unresolved critical decisions rise from 5 to 14 over three weeks, while the formal milestone remains on schedule. Design a monitoring response using indicators, thresholds, ownership, escalation, and reporting.
2. A project has a $1.2 million contingency reserve. It makes authorized drawdowns of $250,000, $175,000, and $90,000, while receiving an approved addition of $100,000. Calculate the remaining reserve and explain why the balance alone is insufficient to judge risk health.
3. Using the MetroLink case, propose two changes to governance that would reduce the probability of late escalation in a future project. Justify each change using leading indicators, control effectiveness, and organizational learning.

Multiple Choice Questions with Answers

Question 1

Which statement best describes a leading risk indicator?

A. It records the final cost after project closure.

B. It provides advance evidence that risk exposure may be changing.

C. It documents a risk that has already become an issue.

D. It confirms that a reserve has been fully spent.

Correct Answer: B. It provides advance evidence that risk exposure may be changing.

Question 2

A risk trigger is best defined as:

A. A subjective colour assigned to a dashboard.

B. The name of the person who owns a risk.

C. An observable condition that initiates a specified management action.

D. The total value of all project risks.

Correct Answer: C. An observable condition that initiates a specified management action.

Question 3

If a project has an opening reserve of $500,000 and authorized drawdowns of $120,000 and $80,000, with no additions, what is the remaining reserve?

A. $200,000

B. $300,000

C. $380,000

D. $700,000

Correct Answer: B. $300,000

Question 4

In the formula SV = EV − PV, a negative schedule variance generally indicates that:

A. More planned value has been achieved than scheduled.

B. Actual cost is lower than earned value.

C. Less value has been accomplished than planned at the measurement date.

D. The project has no remaining risks.

Correct Answer: C. Less value has been accomplished than planned at the measurement date.

Question 5

What is the principal purpose of a risk audit?

A. To eliminate all uncertainty from the project.

B. To test risk processes and the effectiveness of controls.

C. To replace the project change-control board.

D. To guarantee that reserves will not be used.

Correct Answer: B. To test risk processes and the effectiveness of controls.

Question 6

When a previously uncertain supplier failure actually occurs, the most appropriate action is generally to:

A. Delete the original risk without retaining its history.

B. Convert or link it to an issue and reassess consequences.

C. Ignore it until the next annual audit.

D. Classify it as a closed opportunity.

Correct Answer: B. Convert or link it to an issue and reassess consequences.

Question 7

Which practice most directly supports organizational learning?

A. Storing lessons without assigning applicability or ownership.

B. Reporting only successful outcomes to senior management.

C. Using reviewed lessons to change future methods, standards, or decisions.

D. Replacing all professional judgement with automated scores.

Correct Answer: C. Using reviewed lessons to change future methods, standards, or decisions.

Question 8

Why should dashboard colour definitions be explicitly documented?

A. Colours automatically calculate expected monetary value.

B. Without criteria, colours can create inconsistent interpretation and false precision.

C. Colour definitions eliminate the need for narrative.

D. Colour coding is required only for financial reporting.

Correct Answer: B. Without criteria, colours can create inconsistent interpretation and false precision.

Question 9

Which statement about management reserve is most accurate?

A. It should be spent automatically before project completion.

B. It is always identical to contingency reserve in every organization.

C. Its use and authority should follow the organization’s approved governance rules.

D. It can be used without recording a reason or authorization.

Correct Answer: C. Its use and authority should follow the organization’s approved governance rules.

Question 10

Why should AI-generated risk alerts normally receive human review?

A. AI systems cannot process any project data.

B. Human review is needed for data quality, explainability, bias, accountability, and context.

C. Automated alerts are legally required to be ignored.

D. Human review guarantees that forecasts are correct.

Correct Answer: B. Human review is needed for data quality, explainability, bias, accountability, and context.