how do you monitor a risk management plan?