Chapter 8 of 13 · Months 2–3
Metrics: Findings Closed vs Risk Reduced
- How do I know if I am doing a good job?
- What should I report to leadership?
- Is closing lots of findings a good sign?
Early on, it is tempting to measure what is easy to count: findings closed, policies approved, questionnaires answered. These numbers go up when you work hard. They do not tell anyone whether the organisation is safer.
Activity vs outcome
| Activity measure | Outcome measure it should support |
|---|---|
| Findings closed this quarter | Top risks moved inside appetite |
| Access reviews completed | Accounts with excess access removed, and how fast |
| Suppliers assessed | Critical suppliers with known, accepted risk |
| Policies reviewed on time | Exceptions requested and how long they stay open |
Closing ten small findings can matter less than fixing one finding on a critical system. Weight your reporting by risk, not by count.
A short, honest dashboard
- The top risks, their owners, and whether each moved up, down or stayed the same, with one line on why.
- Overdue actions on high risks, by owner.
- Risks accepted this period, by whom, and when they expire.
- Controls that failed or were found on paper, and what was done.
- One or two trends that matter, such as how long critical findings stay open.
The question you might not ask out loud
My numbers look bad this quarter because I found more problems. Will that count against me?
Explain it plainly. More findings after a new check usually means better sight, not worse security. Say what changed in how you look, so leaders read the trend correctly.
Rule of thumb:Never round a number to look better or drop a metric because it went the wrong way. Once leaders suspect the dashboard is managed, they stop trusting all of it.
Measuring yourself
Some useful questions for your own review at three months: Do leaders ask you before making risk decisions, or only after? Do control owners send evidence without chasing? Are fewer surprises turning up in audits? Can you name the top risks and their status without looking? None of these is a percentage, and all of them matter.
Keep metrics few and stable. Changing the dashboard every quarter makes trends impossible to read.
Before you add a metric, write down the decision it should change. If a number going up or down would not make anyone do something different, it belongs in your working notes, not on the leadership dashboard. Ask the person who will read it what they would do with it, and listen to the answer.