- Reviews and evaluations are carried out on an ongoing basis, and led internally. As well, external reviews should be completed at intervals to give the organization the benefit of outside objectivity and expertise.
- Controls are reviewed as part of a continuous improvement process.
- Risks are monitored and evaluated constantly and programs and procedures are established to address these risks.