Lesson · 7 min · Stage 7
Metrics that mean something
Learning goal: Measure governance honestly and spot false security.
For reference purposes only. Not legal advice.
Draft: not yet fact-checked or legally reviewed
Key points
- Five core indicators: policy adoption, control completion, audit readiness, remediation speed and exception backlog age.
- A watermelon metric is green on the outside and red inside.
- Look for contradictory signals across metrics.
- Balance leading indicators (what predicts) with lagging ones (what already happened).
- Prefer verified evidence over self-reported attestations.
Who this is for: anyone new to the topic. Related stage: Monitor and respond.
Five core indicators
| Indicator | What it shows |
|---|---|
| Policy adoption rate | Share of teams or systems that formally adopted the policy |
| Control completion rate | Share of mandatory controls implemented and verified as working |
| Audit readiness score | A composite of adoption, execution and evidence quality |
| Remediation velocity | Average days to close a gap or finding |
| Exception backlog age | Average age and number of open exception requests |
Watermelon metrics
A watermelon metric looks green on a dashboard and red underneath. Two classic patterns:
- 100% adoption, rising exception backlog. Teams sign the policy but immediately file exceptions because it is unworkable in production. That is paper compliance.
- Static readiness score in a growing estate. A steady 85% while AI systems grow from 5 to 50 usually means the new systems are skipping assessment.
Leading and lagging
Lagging indicators report what already happened, such as control failures or audit findings. Leading indicators move first, such as training completion or policy review cadence. Low training today predicts weaker controls next quarter, so track both.
Verified beats attested
An organization reported a 98% control completion rate. It was based only on survey answers from software leads. An independent check found 40% of deployed language models lacked active logging and drift alerts. Self-reporting looked like control; it wasn’t.
Checks to run
- Correlation: if adoption rises while exception age grows, review the policy for friction.
- Forecast: do today’s leading indicators explain next quarter’s results?
- Evidence: can each number be traced to a log, a record or a test?
What to do now
- Pick three metrics and, for each, name what would make it misleading.
- Add one leading indicator next to every lagging one.
Sources
- General guidance. Supplied governance study notes (module 3) No single primary legal source applies.
Reviewed 2 Oct 2026.
Terms used: Drift, Watermelon metric.
Was this page useful? Tell us what is missing or wrong ↗ · Report a correction