A county GRC steering committee asks for operational health of the compliance program, not a list of policy PDFs. Which KPI set best fits?
Select an answer to reveal the explanation.
Short Explanation
Leaders want pulse checks, not PDF counts. On-time testing, effectiveness rates, and how old open issues are — that is the compliance scoreboard that matters.
Full Explanation
Operational health of a county compliance program is best shown with percent of controls tested on time, percent effective, and aging of open compliance issues. Those KPIs tell a GRC steering committee whether civic controls are being tested, passing, and remediated—not whether PDFs exist. Counting unused ServiceNow licenses and ITSM reopen rates fails by concept because platform license hygiene and ITSM reopen metrics are not compliance-program effectiveness measures. Counting PowerPoint slides and email volume to control owners fails by concept because communication volume is activity theater, not control assurance. Average Wi-Fi strength and printer uptime fail by concept because facilities metrics are unrelated to Policy and Compliance outcomes. Exam caveat: CIS-RC program reporting emphasizes on-time testing, effectiveness, and issue aging as core operational KPIs. Operational check: build or open a compliance dashboard showing on-time test percentage, effective percentage, and open-issue age buckets for the county scope, and present those three measures to the steering committee instead of document counts. In civic IRM programs, retain configuration and decision evidence so examiners can reconstruct why this design supports public services.