Chapter 26
26Performance Evaluation: Measurement, Audit and Management Review
“An honest internal audit is kinder than any external auditor.”
Clause 9 of both standards requires the organisation to know whether its system actually works. It does so with three tools: monitoring and measurement, internal audit, and management review. All of them end in a decision.
Text in this figure
Monitoring, measurement · Clause 9.1 · indicators · Internal audit · Clause 9.2 · programme · Management review · Clause 9.3 · decisions · Improvement · Clause 10 · actions · Example indicators · MFA enabled · % of accounts · Critical vulns · Days to fix · Phishing sim · Click rate · Incidents · Time to contain · Models · Drift index · Figure 33
What Do We Measure?
| Indicator | What it tells us |
|---|---|
| Share of accounts with two-factor authentication | The strength of the front line against account takeover. |
| Mean time to fix critical vulnerabilities | The speed of technical response. |
| Phishing simulation click rate | The effect of awareness. |
| Time to revoke leavers’ access | Offboarding discipline. |
| High-impact systems with an impact assessment | AI governance. |
| Successful restore tests | Backup readiness in practice, not in theory. |
Internal Audit
A planned programme covering the whole system on a defined cycle, carried out by someone objective who does not audit their own work. A small agency can use an independent external auditor, or have one team’s manager audit another team. The output is clear findings: conformity, nonconformity or an opportunity for improvement.
Management Review
A periodic meeting, at least annually, in which leadership reviews: the status of previous actions, changes in context, measurement and audit results, incidents, feedback from interested parties, and opportunities for improvement. It produces decisions and resources, not just minutes.
External Audit and Certification
Certification has two stages: the first reviews documentation and readiness, the second tests actual implementation. Annual surveillance audits follow, with recertification every three years. Choose a certification body accredited by a recognised accreditation body.
From the Field
Do not hide a nonconformity from the internal auditor to look good. Every finding you discover and treat yourself is evidence of a living system, and every one the external auditor finds first is evidence of the opposite.
Measurement tells you where you are, audit tells you whether you believe yourself, and review decides where you go.
Lessons Learned
- 1Performance evaluation has three tools: measurement, audit and management review.
- 2A few clear indicators beat a crowded dashboard.
- 3Internal audit is objective, planned and covers the whole system.
- 4Management review ends in decisions and resources.
Tip: use ← → to move between sections.