Key Metrics for Measuring Organizational Risk Culture

I’ve led 8+ major transformations. €7+ billion in combined revenue. Every company had values posters and vision decks. But the real metrics that matter are these: 👉 Do 80% of decisions happen behind closed doors? 👉 Does psychological safety score below 60% in employee surveys? 👉 Are <15% of people willing to challenge leadership in meetings? In one $400M transformation, we tracked the shift: when leaders started rewarding dissent instead of punishing it, psychological safety scores jumped 40%. The measurable impact? Decision speed increased 2x. Project delivery improved 35%. Voluntary turnover dropped by half. At a global packaging leader, this shift visibly drove growth momentum that was measurable in one year. At a multinational snacking company, it enabled 20% CAGR in emerging markets and delivered $50M incremental revenue. Culture isn’t a communication plan. It’s behavior you can measure and change. 💡 What’s one metric that would expose your organization’s real culture? #Culture #Leadership #Transformation #People #Strategy

Key risk indicators simplified ————- Key Risk Indicators are the “smoke signals” of your organization. Before a fire breaks out, smoke shows up. KRIs are those early warnings that tell you risk is rising, systems are weakening, and trouble is near. If you’re waiting for the fire, you’ve already lost. 1. KRIs are not KPIs. KPIs measure success. KRIs measure threats to that success. If your KPI is “Revenue Growth,” your KRI could be “% Revenue from One Customer.” Too much reliance = future risk. 2. KRIs should be forward-looking. If you measure what happened last year, that’s postmortem work. A smart KRI alerts you before risk materializes. Example: If staff turnover is creeping up in your IT department, your cybersecurity readiness is at risk — even before a breach. 3. Simpler is stronger. Avoid fancy metrics no one understands. Ask: a) What could kill us? b) How would we know it’s coming? c) What number would show the threat rising? That’s your KRI. 4. KRIs live in departments. Not in the Risk Office alone. Procurement knows when a vendor is about to default. HR sees when a toxic manager is bleeding morale. Finance senses when liquidity is drying up. Don’t centralize risk intelligence. Decentralize interpretation. Make KRIs everyone’s business. 5. Three signs of a good KRI a) Quantifiable – must be trackable. b) Thresholded – must show what “normal,” “watch,” and “danger” looks like. c) Actionable – if it crosses the line, someone must move. Examples of practical KRIs: 1. Cyber risk —% of systems with unpatched vulnerabilities 2. Liquidity risk —Cash ratio below 1.2 3. Operational risk—% of critical processes without backups 4. Credit risk —% of loan book in arrears over 30 days 5. Fraud risk —# of overrides without secondary approvals Don’t fall in love with spreadsheets and metrics. Fall in love with foresight. A good KRI doesn’t just measure — it prevents the funeral. I remain, Mr Strategy.

We are measuring activity. We need to be measuring risk. I’ve recently analyzed insights from ~2,500 conversations with security leaders who are building and operationalizing Human Risk Management (HRM) programs. The data reveals a painful reality: Most teams are stuck in a "compliance trap." They are running lean teams, drowning in manual workflows, and relying on "fragile reporting"—metrics like click rates and training completion that crumble under executive scrutiny. The most successful program owners are making a critical pivot. They are stopping the attempt to "boil the ocean" by training 100% of employees on everything. Instead, they are operationalizing a High-Risk Employee Model. They are moving beyond generic phishing simulations to look at the intersection of three specific variables: 1. Susceptibility (Likelihood): Who is actually exhibiting risky behavior? (Not just in phishing, but in Data Loss, AI usage, and Web browsing). 2. Targeting (Context): Who is being attacked? 3. Elevated Access (Impact): If this specific person clicks or pastes code into a public LLM, does it take down the business? The result? Instead of reporting "We have a 4% click rate," they can tell leadership: "We identified 50 high-access users who were susceptible to specific threats. After targeted intervention, risk in this critical group dropped by 40%." That is the difference between "activity" and "business impact." If you are struggling to defend your budget or gain traction with the Board, stop reporting on the 90% who are doing fine. Focus on the 10% who represent your true risk exposure. How are you shifting your metrics from "Compliance" to "Risk"? #HumanRiskManagement #CISO #SecurityAwareness #RiskManagement #Leadership

There is a particular silence that ends a GRC function, and it always follows an update that shows the function is fancy and busy. A leader walks the executives through the numbers - risks closed, assessments delivered on time, the backlog burned down. Then someone asks the only question that matters: what changed because we did any of it? The room goes quiet, and the next GRC budget ask dies in that silence. Activity metrics that can't connect to impact don't just fail to win budget, they mark the function for cuts, because they prove you consume resources with nothing to show for it. The question that decides funding is the one that produced the silence: is the business taking better risks because the function is there? Most effectiveness metrics can't answer it. A CMMI Level 3 appraisal next to a risk register nobody has opened in months proves you built the structure, not that it changes a decision. Closed ticket counts prove the team is busy. A bad function produces excellent versions of both. The problem is the kind of number, not the presence of one. Start with appetite. Is the business operating inside a risk appetite that is genuinely real, numbers-based, owned by leadership and calibrated to how the organization actually trades risk for return? Measure how much exposure sits outside it, and whether the breaches were deliberate calls or quiet drift. The caveat carries the whole test: an appetite that lives only on paper makes the number theater. Then trend. An incident is not automatically a failure; the first line sometimes accepts breakage as the cost of moving fast, and that can be the right call. So don't score governance on raw incident counts. Score it on direction: are the vetted, calibrated key risk indicators moving the right way over time, and is the measured effectiveness of your material controls rising? Coverage and audit pass rates tell you the controls exist; effectiveness tells you they work. Improving indicators are the cleanest evidence that real exposure is dropping, not that the team stayed busy. Then reach. Track the ratio of risks the business brings to you versus the ones you have to surface; a rising self-reported share is the clearest proof risk thinking is embedded rather than imposed. Then ask the stakeholders who own the biggest exposures: has the GRC function informed a real decision in the last year, and do they believe their organization is taking the right risks responsibly? Then efficiency. The mandatory governance work that reduces no risk by itself, evidence, attestations, audit support, automated and quality-controlled with the saved hours counted, is proof the function speeds the business up rather than taxing it. None of this cleanly fits on a slide, but all of it is measurable, and it is the case that defends 2LOD investment. Make that case in numbers, and you separate a function that protects the business from one protecting its own documentation.

Most HR teams obsess over KPIs. 📊 𝗕𝘂𝘁 𝗳𝗲𝘄 𝘁𝗿𝗮𝗰𝗸 𝘁𝗵𝗲 𝗿𝗶𝘀𝗸𝘀 𝘁𝗵𝗮𝘁 𝗱𝗲𝗿𝗮𝗶𝗹 𝗽𝗲𝗿𝗳𝗼𝗿𝗺𝗮𝗻𝗰𝗲 𝗯𝗲𝗳𝗼𝗿𝗲 𝗶𝘁 𝗵𝗮𝗽𝗽𝗲𝗻𝘀. Here's the problem: 📉 KPIs tell you what happened. ⚠️ KRIs tell you what’s about to happen. If you're only tracking time-to-hire, engagement scores, and promotion rates, you’re already playing catch-up. Think about this:   • Low workforce morale   • DEIB risks   • Exit interview trends   • Succession planning vulnerabilities These are 𝗞𝗲𝘆 𝗥𝗶𝘀𝗸 𝗜𝗻𝗱𝗶𝗰𝗮𝘁𝗼𝗿𝘀, and they’re just as critical as KPIs, especially in today’s volatile landscape. ✅ KPIs = Performance lens ✅ KRIs = Prevention lens We need both to lead HR with foresight, not hindsight. 📥 Read our full breakdown: https://aihr.ac/3JnwlQG 💬 What’s one risk metric you wish your HR dashboard included?

Too many organisations are killing their risk culture through the very metrics designed to measure it. If your dashboards show things like “100% of staff completed training,” “zero incidents reported,” or “all audit actions closed on time,” you don’t have a healthy culture ... you have a compliance illusion. These metrics make people look good, not act better. They reward hiding bad news, rushing fixes, or ticking boxes instead of improving judgement and behaviour. Real culture metrics look at behavioural change, not paperwork. They tell you whether people actually did something differently after the training, whether near misses are being raised, and whether lessons from incidents are being embedded, not buried. Because culture is shaped by what you reward. If you reward silence, fear, and neat reports, that’s exactly what you’ll get. If you reward curiosity, learning, and early challenge, you’ll get a culture that manages risk before it becomes a crisis. That’s what this carousel explores: eight common “risk culture metrics” that quietly backfire ... and what to measure instead if you actually want insight, not optics. 💬 Which of these flawed metrics have you seen most often in your organisation? ♻️ Share it with someone on a mission to improve their organisations risk culture. 🔔 Follow Tim Buckley for more practical insights on leadership, risk, and driving real impact ... not just ticking boxes. INTEGRAL assurance Beyond the Lines™ #Risk #RiskCulture #RiskManagement #Audit #InternalAudit #Leadership #Controls #CultureChange

Most CISOs are measuring the wrong things. We obsess over dashboards full of vulnerabilities, alerts, and audit checkboxes, but ignore the real indicators of whether our program is working. What if we measured these? -Employees reaching out before there's an incident -Teams looping us into early-stage decisions -Non-security people asking smart questions about risk -Business leaders seeking our counsel -Security champions emerging organically across the org That’s the win. That’s the KPI. It's not just about detection, patch rates, or compliance scores. It's about culture, trust, and behavioral change. And most security programs aren’t tracking any of this… ->because it’s harder to measure, harder to automate, and impossible to fake. If you’re not approachable, helpful, and a business enabler... then all the policies, tools, and frameworks in the world won’t save you. If you're a CISO and you're not measuring cultural impact, you're not measuring success. #ciso #fciso #security #leadership #business

Key Risk Indicator (KRIs) vs Key Performance Indicators (KPIs) — The Metrics That Keep You Ahead of Risk We often rely on KPIs to understand how well we performed: were we on time, productive, efficient? Useful, yes — but they only tell the story of yesterday. KRIs, on the other hand, shine a light on tomorrow. They highlight the early signs that something is drifting: the near misses, the small process failures, the equipment checks that didn’t happen, the weak signals that often appear long before a major event. That’s where the true value lies — foresight. Here’s a simple real example: A team reports “zero incidents this month.” The KPI looks excellent. But the KRIs tell a different story: an increase in near misses, rushed tasks, overdue inspections and a rise in equipment faults. Nothing has gone wrong yet, but the risk environment has changed significantly. This is why KRIs matter. They show you what KPIs can’t. They shift your mindset from explaining results after the fact to taking action before a problem turns into an incident. Use both — but let KRIs guide your decisions. Because leading with foresight is far safer than reacting with hindsight. I have attached a small article in this matter. https://lnkd.in/dhxy9YWh #RiskManagement #SafetyLeadership #KRIs #KPIs #ProactiveSafety #RiskCulture #SafetyFirst #OperationalExcellence #DataDrivenSafety #EarlyWarningSystems #Risk #Leadership #Management #Safety #Performance #Culture #Nearmiss #Drift

Folks, I know at times when it comes to metrics for human centric security it can be a bit confusing on where to start. We just finished up the latest Security Culture for Leaders course where do a deep dive into metrics, this is how we as a class found it easier to approach. We measure four areas all related 1. Culture (what people think and feel): In many ways this helps measure motivation. 2. Knowledge (what people know): In many ways this helps measure ability. These "levers" help drive 3. Behavior (what people do): This is how we manage human risk. But why are we changing behaviors, why are we managing human risk? To reduce risk to the overall organization. 4. Strategic metrics (KPIs / KRIs): These are the metrics that senior leaders care about (such as attacker dwell time) One of the things we often discuss in class is that when it comes to human metrics the WHAT to measure is the easy part, the HOW to measure is the challenging part. How do you approach metrics? What single metric have you found to be the most useful? SANS LDR521 Security Culture for Leaders - sans.org/ldr521 SANS Security Leadership SANS Institute #securityculture #securityawareness #humanrisk #metrics

“Culture” gets talked about a lot in compliance. But how often do we actually measure it? 📊 Regulators expect it. Boards ask about it. And yet, many organizations still struggle to move from intuition to evidence.    I break down how to measure culture in a meaningful, defensible way, using a combination of:    ✔ Direct inputs (like surveys, interviews, and focus groups)  ✔ Indirect indicators (like turnover, hotline data, training completion, and policy engagement)    When you look at culture through multiple lenses, patterns emerge. Risks become clearer. And conversations with leadership become far more productive. Because culture isn’t just something you feel-it’s something you can understand, track, and improve. Want to learn more? Subscribe to the newsletter to receive the free downloadable. ✨    https://lnkd.in/e3saMSpg