How to Measure Connected GRC Program Health

Why is busy not the same as healthy?

Risk assessments may be completed.
Policies may be reviewed.
Controls may be tested.
Evidence may be collected.
Audits may be performed.
Vendors may be assessed.
Incidents may be logged.
Issues may be opened.
Dashboards may be published.

The program may look active.

The question is not only:

“Did we complete the GRC activity?”

The better question is:

“Did the activity improve ownership, evidence, remediation, assurance, and decision-making?”

What is Connected GRC program health?

Connected GRC program health is the degree to which a GRC program provides clear ownership, reliable data, connected workflows, timely remediation, useful evidence, strong assurance, business adoption, and decision-ready reporting.

A healthy Connected GRC program should answer:

• Who owns each material risk, control, issue, vendor, and remediation plan?
• Are top risks connected to controls, evidence, issues, incidents, vendors, and audit findings?
• Are obligations connected to policies, controls, evidence, testing, and regulatory response?
• Are controls tested and monitored where appropriate?
• Is evidence current, reviewed, accepted, and reusable where appropriate?
• Are issues remediated on time and validated before closure?
• Are business owners engaging with the program?
• Are audit and assurance activities aligned to material risks?
• Are dashboards trusted by leadership?
• Are board and executive reports tied to decisions?

A program is healthy when it helps the business manage risk.

It is unhealthy when it only helps GRC teams report activity.

Why does measurement matter?

Measurement shapes behavior.

If the program only measures activity, teams optimize for activity.

If compliance is measured only by assessments completed, the team may complete assessments that do not change risk.

If control testing is measured only by pass rate, teams may miss weak evidence quality or repeat root causes.

If issues are measured only by open count, teams may close issues too quickly without validation.

If audit is measured only by audits completed, the plan may not reflect assurance coverage over top risks.

If vendor risk is measured only by assessment completion, the organization may miss concentration risk, incident history, or resilience gaps.

Measurement must point the program toward better decisions.

OCEG’s GRC definition is useful here because it frames GRC around reliably achieving objectives, addressing uncertainty, and acting with integrity — not simply completing tasks.  

A Connected GRC health model should measure whether the program supports those outcomes.

Why is measuring volume a mistake?

GRC programs often measure volume because volume is easy.

Examples include:

• number of risks assessed
• number of controls tested
• number of policies reviewed
• number of issues opened
• number of issues closed
• number of vendors assessed
• number of audits completed
• number of evidence files uploaded
• number of incidents logged
• number of regulatory changes tracked

These metrics are not useless.

But they are incomplete.

A program can complete many tasks and still be unhealthy.

A better health model asks:

• Were the right risks assessed?
• Were the right controls tested?
• Was evidence accepted or rejected?
• Did findings lead to remediation?
• Was remediation validated?
• Did incident lessons update controls?
• Did vendor risk connect to critical services?
• Did regulatory change create action?
• Did the board receive decision-ready reporting?

Activity metrics tell you whether work happened.

Health metrics tell you whether the work mattered.

What does the Connected GRC health scorecard measure?

A practical Connected GRC health scorecard should measure ten dimensions.

These dimensions work together.

Poor ownership creates poor data.
Poor data creates weak reporting.
Weak reporting hurts adoption.
Poor adoption creates stale risk and evidence.
Stale evidence weakens assurance.
Weak assurance reduces board confidence.

Connected GRC health is systemic.

That is why it needs a scorecard, not one metric.

1. What is ownership health?

Ownership health measures whether risks, controls, evidence, issues, vendors, policies, incidents, and remediation plans have accountable owners.

This is the first health measure because everything else depends on it.

A risk without an owner is not managed.
A control without an owner is not reliable.
An issue without an owner is not remediated.
Evidence without an owner is not dependable.
A vendor without a business owner is not governed.

The IIA Three Lines Model reinforces the need for role clarity: first-line roles manage risk, second-line roles support and challenge, and internal audit provides independent assurance.  

Connected GRC should make those roles visible.

Ownership health metrics

Healthy signals

• Top risks have named owners.
• Key controls have owners, performers, reviewers, and evidence providers.
• Issues are assigned to owners with authority.
• Vendor ownership is tied to business use.
• Policy ownership is current.
• Escalation paths are clear.

Unhealthy signals

• Records are assigned to departments instead of accountable roles.
• Issues are owned by people who cannot fix the problem.
• Control owners do not know evidence expectations.
• Vendor owners are unclear during incidents or renewals.
• Ownership changes are not reflected in GRC records.

Ownership health is not about filling fields.

It is about accountability that works.

2. Data Relationship Health

Connected GRC depends on data relationships.

A risk record is more useful when it connects to controls, issues, incidents, vendors, evidence, and audit findings.

A control record is more useful when it connects to obligations, policies, evidence, testing, issues, and remediation.

An obligation is more useful when it connects to policies, controls, evidence, regulatory changes, and inquiries.

A vendor is more useful when it connects to contracts, data access, services, incidents, issues, and renewals.

Data relationship health measures whether these relationships exist and are maintained.

Data relationship health metrics

Healthy signals

• Top risks have mapped controls.
• Obligations map to policies and controls.
• Controls link to evidence and testing.
• Failed tests create issues.
• Incidents update risks, controls, or issues where appropriate.
• Vendors connect to critical services and open issues.

Unhealthy signals

• Risk reports rely mostly on self-assessment.
• Control failures do not affect risk views.
• Evidence sits in folders without control linkage.
• Vendor records lack service or contract context.
• Audit findings live in separate trackers.

This is one of the most important health dimensions.

If the relationships are weak, reporting will be weak.

3. Risk Health

Risk health measures whether risks are current, owned, connected, and useful for decisions.

A risk register is not healthy because it is complete.

It is healthy when it reflects reality.

COSO’s ERM framework emphasizes risk in relation to strategy and performance, which is the right lens for risk health: the risk program should help leaders understand what could affect objectives and decisions.  

Risk health metrics

Healthy signals

• Risks are linked to objectives.
• Risk ratings have rationale.
• Risk movement is tied to incidents, controls, issues, vendors, or external changes.
• Appetite thresholds are visible.
• Leadership sees which risks need decisions.

Unhealthy signals

• Risk ratings are updated only on calendar cycles.
• Risk ratings do not reflect incidents or control failures.
• Risks are not tied to objectives.
• Risk appetite exists but is not used in reporting.
• Top risks lack assurance coverage.

Risk health is about relevance.

A stale risk register can be complete and still unhealthy.

4. Control Health

Control health measures whether controls are owned, operating, evidenced, tested, and improving.

Controls are one of the most important connectors in Connected GRC.

They link risk, compliance, audit, evidence, issues, and remediation.

Control health metrics

Healthy signals

• Key controls are mapped to risks and obligations.
• Evidence requirements are clear.
• Control failures create issues.
• Repeat failures are decreasing.
• Controls are rationalized across frameworks.
• Control owners understand what they own.

Unhealthy signals

• Controls are duplicated across frameworks.
• Controls have owners but no evidence requirements.
• Controls pass without meaningful evidence review.
• Failed controls do not create issues.
• Control owners receive duplicate requests.

Control health is not only a pass/fail measure.

It is a measure of whether the control environment is understood and improving.

5. What is evidence health?

Evidence health measures whether the organization can prove what it says.

Evidence is one of the most practical indicators of GRC program health.

A program with poor evidence discipline will struggle with audits, regulatory inquiries, SOX, SOC 2, privacy, ESG, AI governance, vendor reviews, and board reporting.

Evidence health metrics

Healthy signals

• Evidence is tied to controls, periods, owners, and reviewers.
• Evidence acceptance rates improve.
• Duplicate evidence requests decline.
• Rejected evidence creates issues where material.
• Evidence is ready for audits and inquiries.

Unhealthy signals

• Evidence is stored in folders without context.
• Evidence is uploaded but not reviewed.
• Evidence rejection patterns are not analyzed.
• Control owners are repeatedly asked for the same files.
• Regulatory inquiry response requires evidence reconstruction.

Evidence health is a leading indicator.

If evidence is weak, assurance and reporting will eventually suffer.

6. What is issue and remediation health?

Issue health may be the most important operational measure in Connected GRC.

Findings only create value when they are fixed.

Issues may come from audit, compliance testing, cyber, privacy, vendors, SOX, ESG, AI governance, incidents, regulatory inquiries, or resilience exercises.

The source may differ.

The remediation model should be consistent.

Issue and remediation health metrics

Healthy signals

• Issues have owners, root causes, due dates, and remediation plans.
• High-severity issues are not aging without escalation.
• Closure evidence is defined up front.
• Material closures are validated.
• Repeat findings decline.

Unhealthy signals

• Issues are closed based on status only.
• Closure evidence is missing.
• Root causes are not tracked.
• Overdue high-severity issues are normalized.
• Repeat findings appear in multiple audits or testing cycles.

Issue health shows whether the program can drive action.

A program that identifies many issues but does not remediate them is not healthy.

7. Adoption Health

Adoption health measures whether the people who need to participate in GRC actually do.

This includes business owners, control owners, evidence providers, vendor owners, policy owners, risk owners, remediation owners, and executives.

Adoption is not only login activity.

Adoption is meaningful participation.

Adoption health metrics

Healthy signals

• Business users understand what they own.
• Evidence requests are clear.
• Assessments are completed on time.
• Owners respond through the system, not only email.
• GRC tasks are embedded in business workflows.
• Duplicate requests decline.

Unhealthy signals

• Users work around the system through email.
• Evidence is repeatedly late or rejected.
• Assessments require constant chasing.
• Business users do not understand GRC language.
• Leaders do not use dashboards.

Adoption health is where operating-model design meets reality.

If users do not use the program, the data will become stale.

8. Regulatory Readiness Health

Regulatory readiness health measures whether the organization can identify, interpret, implement, prove, and respond to obligations.

This includes regulatory change, obligation mapping, policy updates, control updates, evidence, issues, and inquiry response.

Regulatory readiness metrics

Healthy signals

• Obligations map to policies, controls, and evidence.
• Regulatory changes create assigned actions.
• Inquiries connect to obligations, controls, and evidence.
• Commitments are tracked and remediated.
• Readiness dashboards show gaps before deadlines.

Unhealthy signals

• Regulatory change is tracked but not implemented.
• Obligations live in legal memos only.
• Policies are updated without control updates.
• Regulatory inquiries trigger evidence fire drills.
• Commitments are tracked outside issue management.

Regulatory readiness health is about defensibility.

Can the organization show what it did and why?

9. Assurance Health

Assurance health measures whether the organization has appropriate assurance over the risks, controls, obligations, and remediation that matter most.

Internal audit has a distinct role in assurance. The IIA’s Three Lines Model describes internal audit as providing independent and objective assurance and advice on the adequacy and effectiveness of governance and risk management.  

A Connected GRC program should make assurance coverage visible.

Assurance health metrics

Healthy signals

• Assurance coverage aligns to top risks.
• Audit findings connect to risks, controls, and issues.
• Remediation validation is visible.
• Repeat findings decline.
• Audit planning uses risk, compliance, incident, and issue data.

Unhealthy signals

• Audit findings sit outside enterprise issue management.
• Top risks lack assurance coverage.
• Management action plans are overdue without escalation.
• Closed findings lack validation.
• Audit planning is disconnected from current risk signals.

Assurance health shows whether the organization can trust its risk and control story.

10. Reporting Health

Reporting health measures whether GRC dashboards and reports help leaders make decisions.

A report is healthy when it answers:

• What changed?
• Why did it change?
• What is outside appetite?
• What controls are failing?
• What evidence is missing?
• What issues are overdue?
• What incidents matter?
• What vendors create exposure?
• What remediation needs escalation?
• What assurance gaps exist?
• What decision is needed?

SmartSuite’s platform positioning emphasizes connected GRC workflows across risk, compliance, audit, third-party risk, resilience, privacy, AI governance, and ESG, which is the kind of connected source data needed for decision-ready reporting.  

Reporting health metrics

Healthy signals

• Dashboards are traceable to source records.
• Reports show decisions, not only activity.
• Manual reporting effort declines.
• Risk movement is explained by drivers.
• Board reporting connects risk, controls, issues, vendors, incidents, and assurance.

Unhealthy signals

• Reports are assembled manually from multiple spreadsheets.
• Metrics cannot be traced to source records.
• Dashboards are not used by leadership.
• Reports show counts without context.
• Board reports bury decisions.

Reporting health is the final test.

If Connected GRC does not improve decision-making, the program is not healthy enough.

Leading and lagging indicators

A good health model uses both leading and lagging indicators.

Leading indicators

Leading indicators warn that problems may occur.

Examples:

• evidence rejection rate rising
• high-severity issues aging
• controls overdue for testing
• regulatory changes awaiting impact assessment
• vendors missing resilience evidence
• assessments overdue
• issue owners repeatedly late
• critical services lacking dependency maps
• control owner reassignment delays
• risk indicators breaching thresholds

Lagging indicators

Lagging indicators show what already happened.

Examples:

• audit findings
• regulatory inquiry gaps
• control failures
• incidents
• repeated issues
• missed regulatory commitments
• reopened issues
• failed remediation validation
• board escalations
• audit qualifications or deficiencies

Both matter.

A healthy program uses leading indicators to act before lagging indicators become findings.

Health metrics by audience

Different audiences need different measures.

Business owners

Need to know:

• what they own
• what is due
• what is late
• what evidence is required
• which issues need action
• what decisions are needed

Risk and compliance leaders

Need to know:

• risk movement
• obligation readiness
• control health
• evidence gaps
• open issues
• regulatory change impact
• adoption bottlenecks

Internal audit

Needs to know:

• assurance coverage
• audit findings
• management action status
• validation status
• repeat root causes
• control and evidence history

Executives

Need to know:

• risks outside appetite
• remediation blockers
• vendor exposure
• regulatory readiness gaps
• material incidents
• funding or risk acceptance decisions

Board and committees

Need to know:

• what changed
• what matters
• what is outside appetite
• what management is doing
• what assurance exists
• what decisions need oversight

One dashboard should not serve every audience.

Connected GRC program health should be measured through role-specific views.

A practical Connected GRC health dashboard

A strong health dashboard should include:

The dashboard should not be designed to make the program look good.

It should be designed to show where the program needs attention.

How do you score Connected GRC program health?

A simple scoring model can work well.

Use a 1–5 scale for each dimension.

For example:

This kind of scorecard helps leadership see where to invest next.

It also avoids pretending that the whole program is either mature or immature.

Most programs are uneven.

That is normal.

How often should you measure program health?

Different metrics need different cadences.

Do not measure everything every week.

Measure often enough to act.

The goal is not reporting volume.

The goal is timely management.

Avoid vanity metrics

Some metrics look good but do not say much.

Examples:

• number of risks in the register
• number of controls in the library
• number of policies published
• number of evidence files uploaded
• number of issues closed
• number of vendors assessed
• number of audits completed
• number of dashboards created

These can be useful operational measures.

But they should not be treated as health measures by themselves.

Better measures include:

• % of top risks mapped to controls
• % of controls with accepted evidence
• % of high-severity issues validated before closure
• repeat control failure rate
• evidence rejection rate
• regulatory changes with completed impact assessments
• critical vendors with current resilience evidence
• risks outside appetite with documented decisions
• audit findings tied to root cause and remediation
• dashboard metrics traceable to source records

Measure what creates trust.

Not what creates activity.

What does healthy look like in practice?

An unhealthy program says:

“We completed 82% of control testing, closed 43 issues, assessed 128 vendors, and reviewed 37 policies.”

A healthier Connected GRC program says:

“Two top risks moved outside appetite. The drivers are failed access controls, overdue vendor remediation, and one incident affecting a critical service. Evidence rejection increased in two control families, so remediation has been opened for evidence standards. Four high-severity issues are overdue, and two require executive decisions. Internal audit validated closure for six findings, while three remain pending retest.”

The second report is more useful.

It tells leaders what changed, why it matters, who needs to act, and what decisions are needed.

That is Connected GRC program health.

Where should you start?

Organizations do not need to build a perfect health scorecard all at once.

Start with the areas that reveal the most about program reliability.

Start with issue health

Issue health shows whether the program can turn findings into action.

Relevant links:

• Issues Management
• How to Turn Findings Into Remediation Work That Actually Gets Done
• Internal Audit Management
• Enterprise Risk Management

Start with evidence health

Evidence health shows whether the organization can prove its controls and obligations.

Relevant links:

• Unified Risk and Compliance Workflows
• Compliance Assessments & Testing
• Control Framework & Regulatory Libraries
• Regulatory Inquiries

Start with control health

Control health shows whether risk and compliance are supported by operating discipline.

Relevant links:

• How Controls Connect Risk, Compliance, Audit, and Remediation
• Control Libraries That Reduce Duplication Instead of Creating It
• Compliance Assessments & Testing
• SOX Compliance

Start with reporting health

Reporting health shows whether leaders can make decisions from GRC data.

Relevant links:

• How to Make GRC Reporting Useful to the Board
• Enterprise Risk Management
• Internal Audit Management
• Connected GRC Maturity Model

Start with adoption health

Adoption health shows whether the program works for the business.

Relevant links:

• Why GRC Programs Fail
• Connected GRC for Business Unit Leaders
• Risk and Control Self-Assessment
• Policy Management

The best starting point is the area where leadership currently has the least confidence.

Common mistakes to avoid

Mistake 1: Measuring activity as health

Activity matters, but it does not prove the program is healthy.

Measure connection, quality, action, and decisions.

Mistake 2: Using too many metrics

Too many metrics create noise.

Start with a small scorecard and expand only where useful.

Mistake 3: Ignoring data quality

A dashboard built on poor data creates false confidence.

Measure ownership, source traceability, evidence quality, and missing mappings.

Mistake 4: Treating all issues equally

A high-severity issue tied to a top risk matters more than a low-risk documentation gap.

Use severity and risk impact.

Mistake 5: Reporting closed issues without validation

Closed does not always mean fixed.

Measure validated closure.

Mistake 6: Measuring adoption only by logins

Adoption is meaningful participation, not system access.

Measure task completion, evidence quality, timeliness, and business-user engagement.

Mistake 7: Forgetting decisions

If the dashboard does not show decisions needed, it is not measuring what matters most.

A practical health assessment

Pick one top risk.

Then ask:

• Is the risk tied to a business objective?
• Is there a named owner?
• Is appetite defined?
• Are controls mapped?
• Are key controls tested?
• Is evidence accepted?
• Are open issues visible?
• Are overdue remediations escalated?
• Are related incidents visible?
• Are related vendors visible?
• Are audit findings connected?
• Is assurance coverage clear?
• Are dashboards source-traceable?
• Is there a decision needed?

Now score the risk from 1 to 5:

• 1: Most answers require manual search.
• 2: Records exist, but relationships are weak.
• 3: Core relationships exist, but reporting is still manual.
• 4: Reporting is decision-ready and traceable.
• 5: Risk signals update continuously and trigger action.

Repeat this for several top risks.

That simple exercise will reveal program health faster than a long survey.

Final thought

Connected GRC program health is not measured by how much work the program produces.

It is measured by whether the program creates reliable ownership, trusted data, useful evidence, timely remediation, meaningful assurance, business adoption, and decision-ready reporting.

A healthy program helps leaders understand what changed, why it matters, who owns the response, what evidence supports the view, what remains unresolved, and what decision is needed.

That means measuring more than activity.

Measure ownership.
Measure relationships.
Measure risk movement.
Measure control health.
Measure evidence quality.
Measure remediation validation.
Measure adoption.
Measure regulatory readiness.
Measure assurance coverage.
Measure reporting usefulness.

That is how to measure Connected GRC program health.

Not by asking whether the program is busy.

By asking whether the program helps the organization manage risk better.