Home » Security Leadership » Metrics/Budgets

In Brief

Metrics Basics

Business executives use metrics to report on the operations that they lead. Here is a to-do list:

September 01, 2006 — CSO —

How do you put a price on security operations, since the best results occur when nothing goes wrong? Business executives use metrics to report on the operations that they lead. Here is a to-do list for establishing a measurement program that's meaningful to everyone in the company.

KNOW WHAT'S IMPORTANT. Listen to top executives and business unit leaders discuss their priorities.

Identify one or two security metrics vital to their success. Consider: loss reduction (be specific), cost reductions, shorter cycle times, use of technology versus use of people, elimination of vulnerabilities that affect uptime, reliability and so on.

RISK ANALYSIS IS A MUST. Make risk analysis part of every metrics project. Assessing the risks, costs and benefits of business activities is part of the CSO's job. The work involved offers a potential wealth of metrics that can bolster your recommendations to corporate leaders.

IDENTIFY INCIDENT TRENDS that matter to key senior managers. Track changes monthly or quarterly. Focus on what's important in your business. Consider: safety violations, workplace violence, public safety, emergency medical technician response times, issues that invite regulatory sanctions,

losses as a percentage of sales, numbers of employees who are subjects of business-conduct investigations.

DEVELOP A FEW VALUE INDICATORS that provide reliable information that you can track.

Candidates include security cost per employee as a percentage of sales or revenue, the property protection cost per square foot of occupied space, case cost versus recovery and case cost over time.

Benchmark these costs against comparable peers.

SET UP A SECURITY COUNCIL. If security functions are spread among various departments (such as human resources and legal affairs), this group can develop metrics goals for the organization.

TRACK CHANGES. Develop several confidence indicators, such as annual customer satisfaction surveys, posted on your corporate intranet. Or track business process improvement recommendations, made in incident postmortems, to see which are accepted and which are rejected.

USE METRICS IN PLANNING. Build your annual business plan around two or three "reach objectives" that have at their heart a specific measurement like "in the next fiscal year, reduce background investigation cycle time by 15 percent and case cost by 5 percent."

CHECK YOUR NUMBERS. Make sure they are accurate before you present them.

Source: ADAPTED FROM "THE METRICS QUEST"