Monitor
Monitor is how the governing body learns whether the strategy is being achieved, and how management turns measurement into feedback, priorities and early warning.
What clause 7.3.4 asks
Monitoring has two failure modes. One is too little: the board hears about security only after an incident. The other is too much: a monthly pack of control figures that nobody can tie to a decision. The clause steers between them. The board receives an effectiveness report for each management system, reads it against entity priorities, and sends those priorities back. Management measures, checks conformance with internal and external requirements, watches the changing entity, legal and regulatory scene, picks metrics, requires timely reporting, feeds results upward and warns the board about new developments. Performance is judged by its effect on the organization and the entity, not only by control efficiency. The warning duty is the early warning system.
Why it matters
Monitoring fails in two ways. The first is too little: the board hears about security only after an incident. The second is too much: a monthly pack of control metrics that nobody can connect to a decision. The clause sets a middle path. The board receives the effectiveness report for each management system and evaluates it against entity priorities, then sends the priorities back. Management does the measurement, the conformance check and the environmental scan, and it has a duty to alert the board to new developments. That alert duty is the early warning system. A board that only sees the scheduled pack will learn about a new threat or a regulatory change too late to shape the response.
What good looks like
Design the monitoring pack around decisions rather than data. Put the effectiveness report, the conformance position and the new developments first, then the supporting metrics. Set a timeliness rule for alerts so a material development reaches the board between meetings. Record the priorities the board sends back and check at the next meeting that they changed something. Test the environment scan by asking what changed in law, regulation, suppliers or the entity since the last report, and write the answer down even when it is nothing.
Evidence a board or an auditor asks for
The effectiveness report for each management system; the conformance position and exception log; the new developments alert record; the priorities communicated back and the actions they produced; the metrics with their entity impact reading.
- Record The effectiveness report for each management system
- Record the conformance position and exception log
- Record the new developments alert record
- Record the priorities communicated back and the actions they produced
- Record the metrics with their entity impact reading
Where it commonly fails
- The governing body hearing about security only after an incident
- Metrics that measure controls and never the entity exposure
- No route for an urgent development to reach the board between meetings
What to do before publication
Before the edition 3 text is published, put clause 7.3.4 on the entity governance and the objectives agenda, name the owner of each line above and give it a review date. When the final draft or the published text is available, compare it with this record and note every difference.
Read across
- 7.2.6 Objective 6: Ensure the security performance meets current and future requirements of the entity
- 7.3.2 Evaluate
- 7.3.3 Direct
- 7.3.5 Communicate