Which of the following is the MOST important reason for a risk practitioner to continuously monitor a critical security transformation program?

Validating the quality of deliverables is part of program management and quality assurance, but it's secondary to the direct management of risks that could prevent *any* deliverables from being achieved.

Detecting increases in program costs is an important aspect of financial control, but it's a symptom that often stems from unmanaged risks, making risk mitigation more fundamental.

Continuous monitoring allows a risk practitioner to identify new or changing risks, track the effectiveness of existing controls, and ensure that any emerging program risk events are addressed and mitigated without delay. This proactive risk management is critical for the successful completion of a security transformation program, as unmitigated risks can lead to significant delays, budget overruns, or failure to meet security objectives.

Providing timely reporting to the governance steering committee is a communication function of program management, but the *reason* for monitoring is to *enable* accurate and timely reporting on the program's health, particularly its risks.