Clause 9 - Performance Evaluation

Clause 9 of ISO 31000:2018 describes how organizations should evaluate the performance of their risk-management system, including monitoring and measuring risk treatment effectiveness, conducting internal audits, reviewing results against objectives, and using findings to drive continual improvement. It emphasizes a systematic, evidence-based approach to ensure risk policies remain appropriate and aligned with strategic goals.