Most business continuity dashboards count activity: plans updated, exercises held, business impact analyses complete, training finished. Leadership reads them once, sees green, and stops reading. That is not a failure of attention. Activity counts measure effort, and effort is not what leadership is asking about.
Why activity counts do not land
“100 percent of plans reviewed this year” says the plans were opened. It does not say they would work. “Twelve exercises held” says the calendar was busy. It does not say anything was learned, or that the findings closed. A dashboard that is green every quarter teaches the people reading it that there is nothing to read.
The questions leadership actually asks about the program are simpler than the dashboard:
- Where do we stand?
- Where are we weak?
- Are we getting better?
Each one has a metric that answers it.
Where do we stand: one score
One overall maturity score, against a named standard, on a defined scale, with the level in words. “2.6 against ISO 22301: repeatable but intuitive” is a sentence a board member can repeat to another board member.
The standard and the scale are what make the number mean something. Without a named standard, nobody knows what was measured. Without a published scale, nobody knows whether 2.6 is good. Ours is the 0 to 5 maturity scale, with the level definitions from COBIT, and the level descriptions are the same on every question, so a 3 means the same thing everywhere it appears.
Where are we weak: the domain view
An overall score averages strengths and weaknesses together, which is useful for a headline and misleading on its own. A 2.8 overall can hide a 3.6 in business continuity and a 1.4 in IT disaster recovery. Leadership needs to see that split, because it is where the next decision sits.
Show each domain against its target. The gap between the two is the metric that matters most, because it says how far each part of the program is from where the organization decided it should be. If you have not set targets yet, what should your maturity target be walks through it.
Are we getting better: the trend
The same standard, the same scale, once a year, side by side. A single score is a snapshot. The second assessment is where measurement starts to pay off, because it shows whether the money and effort spent in between moved anything.
Set expectations for how fast a score moves. In our assessment work, programs that commit to a structure typically move from the 1.5 to 2.5 range into 2.5 to 3.5 within about two years. A few tenths of a point in a year, concentrated in the domains you targeted, is real progress. A full point in a year usually means the first score was too harsh or the second one too generous.
Keep the operational metrics, underneath
Activity and operational measures still matter. They are how the program team runs the program, and they are the evidence behind the maturity score. They just are not the headline.
| Measure | Who reads it | What it tells you |
|---|---|---|
| Overall maturity score and level | Board, executive sponsor | Where the program stands against the standard |
| Domain scores against targets | Executive sponsor, program owner | Where the program is weakest, and how far from target |
| Change since the last assessment | Board, executive sponsor | Whether the program is improving |
| Exercise findings closed on time | Program owner | Whether exercises lead to change |
| Recovery objectives met in tests | Program owner, IT | Whether recovery works as designed |
| Business impact analysis and plan currency | Program owner, plan owners | Whether the basics are kept up |
The first three go in the board pack. The rest go in the program review, and they feed the next assessment: an exercise program whose findings never close will not score well on exercising, however many exercises it runs.
A one-page view for the board
What fits on one page and gets read:
- The overall score and the level in words
- Domain scores against targets
- The change since the last assessment
- Where you sit against peers on the same standard, if a fair comparison exists
- Three sentences: what moved, what did not, and the one decision you need from them
The last line is the one most often missing. A board pack that reports without asking for anything gets filed.
What to avoid
- Completion percentages as the headline. They measure the program’s paperwork, not its capability.
- Red, amber, green without a scale behind it. Colors invite argument about the color, not the program.
- Changing the standard or the scale between years. It breaks the trend, which is the most valuable number you have.
- Scores nobody challenges. The most common inflation in a self-assessment is scoring the existence of a document as a 3. If the same person writes the plan and scores it, have someone else read the evidence.
How ResiliencyPulse produces it
This is the view ResiliencyPulse is built to produce. Every finalized assessment produces a two-page executive summary: the score, the level in words, domain scores, the biggest gaps, a benchmark position when a publishable peer cohort exists, and an AI-written paragraph your team can edit. History, targets, and trends carry across assessments, so next year’s summary shows the movement. The features page has the detail.
If you need to make the case for measuring before you can measure, the business case page puts the cost next to the alternatives. To see roughly where your program stands today, take the self-check.