To answer this it is helpful to consider two principle meanings behind the word measure: Measurement to refer to measurements usually tied to values and most often the counting of things: How many Similarly, for risk & compliance – methods without measurements is also nonsense. Measuring the effectiveness of risk & compliance controls (i.e. measures) will help to identify if the These companies have measures without measures which is waste.

The gap between the promises we have made and those we no longer keep is a measure of integrity. Measures of integrity do not only apply to people. These gaps are also a measure of integrity and keeping them in check is necessary to keep trouble at these troubles and the disruptions that ensue by maintaining integrity which requires that we have a measure are, how they will be met, and key results and objectives by which performance and outcomes can be measured

You Do What You Measure Goldratt reminds us that measurements play a dual role in our endeavours. Measurements also serve as instruments of influence, shaping our behaviours and actions. When selecting measurements, it is important to do so with the understanding that they should encourage For compliance to succeed, organizations can follow Goldratt's advice by introducing measurements that Measure progress based on the achievement of desired compliance outcomes rather than merely tracking

Improvement Systems (QRIS) for childcare, and higher education accreditation often includes quality measures Leverage Technology for Enhanced Compliance Measurement: Explore compliance management software: Consider

Each element can be expanded so that analysis can occur to design measures or discover vulnerabilities Consequence : The undesirable result of a loss event, usually measured in health and safety effects, Risk Measure Validity Barriers are the technical and human factors used to prevent threats from becoming Validity of Compliance Risk Measures While these definitions are described for process safety they are In fact, compliance risk measures would also benefit from the extended list of attributes defined by

However, many do not measure the effectiveness of their programs (75% according to HBR do not). A Measure of Effectiveness An important question to answer is how should compliance effectiveness be measured? How is compliance progress measured? Compliance effectiveness can be calculated by measuring if these promises have been kept over a specific

Saying what you will do and doing what you say is essential for organizations where staying between the lines is critical to mission success. If you want to lower your risks you need to foster a culture of integrity across all levels of your organization. For compliance, integrity is manifested when organizations take ownership of all their obligations and hold themselves accountable to them. In order to say what you will do requires that you first know what your obligations are. This means taking inventory of both regulatory requirements and voluntary commitments. Companies must then set appropriate organizational outcomes, targets, and goals commensurate with their level of commitment and operational risk. The way that companies say what they will do is by documenting their promises usually in the form of policy. To be effective policies must be put into practice. This is demonstrated when organizations operationalize their promises by embedding compliance objectives into programs, systems, processes, and procedures. You can call this compliance-by-design but it is really just ensuring that you do what you say. This is still not is not enough. Organizations must also hold themselves accountable. In fact, they must regulate themselves to provide assurance that they meet their obligations today and will meet them in future. Sustainability is the goal and integrity is the means. This involves continually evaluating performance and effectiveness of risk & compliance programs. Culture is a remnant of our actions. Organizations that continually say what they will do and do what they say will build and strengthen a culture of integrity.

. ▸ Governance regulates Programs ( Measure of Effectiveness ) ▸ Programs regulate Systems ( Measure of Performance ) ▸ Systems regulate Processes ( Measure of Conformance ) ▸ Processes regulate Work ( Measure of Adherence ) This is more than an integrated stack. This is the Measure of Integrity (MoI).

Assurance is an OUTCOME not an ACTIVITY That's why confidence levels are an important measure of success Measuring effectiveness of these capabilities is not something that traditional audit or assurance functions What measures can you take to make certain you can keep all your promises? What resources do you need to provide the necessary capabilities and measures?

Many organizations try to use measures of conformance to predict and possibly prevent future occurrences Lagging Indicators and Actions Lagging indicators measure what has already happened specifically after Leading indicators include measures of effectiveness of the preventive controls which are predictive Bottom Line Lagging indicators can never be leading as they measure things after the risk event. They may have utility to predict future risk events but this is limited as they often measure things

Digitizing reality requires measurement and classification. Data: classification and measurement Information: relevance and context Knowledge: explanation and correlation We classify before we measure. We decide what is relevant before context matters. When the quantitative side stands in for the qualitative side, the enterprise fails in a specific way: Measurement without classification measures the wrong things precisely.

Integrity is a measure of how well that state is maintained, and any loss of integrity is what we call Without that definition there is no reference against which to measure drift, no basis on which to design Loss of integrity is a measure of safety: how far we have drifted from that definition. Define what it means to be safe for your AI systems, measure the loss of integrity against it, and treat