Module 7

Compliance analytics and metrics: measuring whether it works

The map shows what a business intends to do. Analytics shows whether it works. The two are easily confused, because a clean dashboard is very reassuring and very easy to produce. A programme that reports 100 per cent training completion, 98 per cent of controls ‘green’ and no incidents may be in excellent health, or may simply be measuring things that do not move. The test of a compliance measure is whether it would change if the programme were failing. This module teaches how to choose and read measures that answer that question. You learn the difference between leading and lagging indicators, what makes a metric worth reporting, why a count without a denominator tells you little, how to read the results of testing and how many cases to test, what incident and near-miss data can show, why measures get gamed, how to rank the work by risk, and how to report to a board without spin. It closes with two cautions that apply to every metric: that monitoring people raises its own legal and ethical issues, and that AI tools used to monitor compliance need testing like any other control. All data and organisations are invented.

General education on regulatory mapping and compliance analytics, using invented regulations, regulators, companies and figures. It states common practice in simplified form and does not describe any one country's law, which differs and changes; rules on scope, interpretation, reporting, record keeping, monitoring of staff and penalties in particular vary. It is not legal or compliance advice, and it does not replace advice from a qualified lawyer on a real regulatory question.