According to the PMBOK® Guide, specifically within the Project Risk Management Knowledge Area, Monitor Risks (formerly Monitor and Control Risks) is the process of monitoring the implementation of agreed-upon risk response plans, tracking identified risks, identifying and analyzing new risks, and evaluating risk process effectiveness.
Continuous Process: Risk management is not a one-time event. Because the project environment is dynamic, new risks can emerge at any time, and existing risks can change in probability or impact. Therefore, this process is performed throughout the life of the project.
Integration with Execution: As project work is executed, the team gathers work performance data. This data is used to determine if:
Assumptions are still valid.
Risk contingency reserves are adequate.
Project policies and procedures are being followed.
Risk responses are as effective as expected.
Lifecycle Persistence: From the moment the project is authorized until the final administrative closure, the project manager and team must remain vigilant. While the intensity of risk monitoring might peak during high-complexity phases, the process itself never stops until the project ends.
Analysis of other choices:
Choice A (At project initiation): While high-level risks are identified in the Project Charter during initiation, the monitoring and controlling of those risks cannot happen until there is a plan to monitor and work being performed to control.
Choice B (During work performance analysis): Work performance analysis is a tool/technique and an input used within the process of monitoring risks, but it does not define when the process occurs.
Choice D (At project milestones): While formal risk audits or reviews often take place at major milestones or phase gates, limiting risk monitoring only to these points would leave the project vulnerable to risks that emerge between milestones.
