Keeping Britainês growing railway amongst the safest in the world requires sustained focus to deliver excellence in risk management. Our enforcement activities find that risk controls are not always consistently or reliably achieved. Whilst easy to find evidence of failure to manage risk at a discrete location, it is less easy to demonstrate systematic failure in the management system underlying discrete failures; and take action to lift the quality of risk control across an organisation. This paper sets out to examine this factor, the role of monitoring & review, and outlines one methodology adopted by Britainês railway national safety authority