# Exercise: Design Your Progress Measurement System

Use this exercise to design a measurement system that will track your organization's progress toward integrated security risk management:

1.Metric Selection:

- Identify 2-3 process metrics that will show whether integration activities are occurring as planned
- Select 2-3 outcome metrics that will demonstrate the business value of integration
- Choose 2-3 perception metrics that will gauge stakeholder views of the integration effort
- For each metric, define how it will be measured, what data sources will be used, and what constitutes success

2.Reporting Format:

- Design a dashboard or report template that will present your metrics clearly to different audiences
- Consider different views for executive leadership, management teams, and working-level personnel
- Include both trend data (how metrics change over time) and comparison data (how metrics compare to targets or benchmarks)
- Incorporate qualitative information alongside quantitative metrics to provide context and insights

3.Assessment Schedule:

- Establish a regular cadence for collecting and analyzing each metric
- Define when and how comprehensive assessments will be conducted
- Schedule regular reviews with key stakeholders to discuss progress and adjustments
- Determine how assessment results will feed into planning and decision-making processes

4.Stakeholder Communication:

- Identify key stakeholders who need to be informed about progress
- Determine the most effective communication channels for each stakeholder group
- Develop messaging that connects progress metrics to stakeholders' priorities and concerns
- Plan how you'll address potential negative results or slower-than-expected progress

A well-designed measurement system not only tracks progress but also reinforces the importance of integration and helps maintain momentum through visible results and regular communication.

***

(c)[Kayne McGladrey](https://kaynemcgladrey.com/) - [Get the full book "Cyber Risk is a Myth"](https://www.routledge.com/Cyber-Risk-is-a-Myth-A-Business-Approach-to-Integrated-Risk-Management/McGladrey/p/book/9781041249054)