A minor data leak occurs in an organization.

The correct answer isA. The need for continuous monitoring to detect and address emerging risks early. ISO 31000 emphasizes that risk management isdynamicand requires ongoing monitoring and review to identify changes in risk conditions, controls, and consequences.

In the scenario, the data leak initially appeared minor but escalated over time because it went undetected for weeks. This demonstrates how risks can evolve and intensify if not monitored effectively. Continuous monitoring enables organizations to detect early warning signs, respond promptly, and limit escalation of impacts.

Option B is relevant to understanding risk escalation, but the primary failure illustrated is the lack of timely detection. Option C is incorrect because relying only on initial assessments ignores the dynamic nature of risk. Option D is unrealistic and contradicts ISO 31000, which recognizes that residual risk always exists.

From a PECB ISO 31000 Lead Risk Manager perspective, continuous monitoring and review are essential to resilience and protection of value. Therefore, the correct answer isthe need for continuous monitoring to detect and address emerging risks early.