◇ OpenCyber Academy
Postgraduate · Chapter 10 · English

Chapter 10 — Metrics, reporting and the board

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 10 — Metrics, reporting and the board

Lesson map

Lesson 10 published. Map, example, EX046.

flowchart TD
  N0["Learning outcomes"]
  N1["10.1 Choosing metrics"]
  N2["10.2 Building the report"]
  N3["10.3 Attribution"]
  N4["10.4 Decisions"]
  N0 --> N1 --> N2 --> N3 --> N4
  N4 --> EX["Worked example"]
  EX --> Q["Exercise EX046"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["10.1 Choosing metrics"]
  N2["10.2 Building the report"]
  N3["10.3 Attribution"]
  N4["10.4 Decisions"]
  N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX046"]
[Learning outcomes]
    |
    v
[10.1 Choosing metrics]
    |
    v
[10.2 Building the report]
    |
    v
[10.3 Attribution]
    |
    v
[10.4 Decisions]
    |
    v
[Worked example] --> [Exercise EX046]

Learning outcomes

You will (1) design governance metrics for executives; (2) link metrics to business outcomes; (3) report honestly on progress.

10.1 Choosing metrics

Lucía chooses a small set of governance metrics for the board: proof of delivery completeness, carrier event timeliness, on-time delivery under contract definitions, disputed invoice value, access review completion and open high-priority data issues. Each links to an outcome the board cares about, such as revenue lost to disputes. She avoids metrics that measure activity alone, such as number of meetings held, which say little about whether governance improves the business. The governance group reviews the list and agrees each target with the relevant owner before the first report.

10.2 Building the report

The quarterly report fits on two pages: a table of metrics with targets and trends, three highlights, three concerns and decisions needed. Lucía writes in plain language and explains any change in definitions. She includes a chart of disputed invoice value before and after the proof of delivery fix. She notes that boards have limited time, so reports should make it easy to see what is working, what is not and what the board must decide. The board chair welcomes the format.

10.3 Attribution

The board asks whether governance caused the fall in disputed invoices. Lucía explains that the proof of delivery fixes are the most likely cause, since disputes fell mainly for shipments handled by the carrier that switched apps, but that other factors, such as a new customer contract template, may also contribute. She presents the evidence and its limits. Dr. Achebe notes that honest attribution protects credibility when future results are less favourable. She includes a short note on these limits directly beneath the chart.

10.4 Decisions

The report asks the board for two decisions: funding to extend governance to customer master data and approval of a policy that all new data sharing requires an owner's approval. The board approves both. Lucía records the decisions and their owners. She reflects that linking governance to visible financial outcomes made the board receptive, and that asking for specific decisions turned the report from information into action. Both decisions appear in the next report with their progress, so the board can see that its approvals led to action.

Worked example

Lucía selects outcome-linked metrics, writes a two-page board report with highlights, concerns and decisions, attributes falling disputes cautiously and secures funding and a sharing policy.

Synthetic case. Metrics are synthetic.

Errors and limits

Claiming full credit for improvements with several causes damages credibility.

Exercises

Continue studying — lesson 10 (chapter 10 of 12)

← Chapter 09 · Course chapter index · Chapter 11 →

Continue to the next authored lesson.