Program Monitoring, Measurement, and Continuous Improvement
What to measure
A continuity programme needs evidence that it is effective, not merely busy. Candidates should know the difference between activity metrics (plans written, exercises run, staff trained) and outcome metrics (percentage of critical activities with a validated strategy inside RTO, mean time to close exercise findings, percentage of suppliers with verified continuity evidence, recovery capability confirmed by test). Outcome metrics drive improvement; activity metrics alone can hide weakness.
Concepts
- Performance indicators should be defined with a target, an owner, a data source, and a review cadence.
- Maturity models give a structured path from ad hoc to optimised practice; use them to plan improvement, not to score for its own sake.
- Audit and assurance provide independent verification; self-assessment alone is insufficient for high-risk activities.
- Corrective actions need root-cause analysis, not just symptom fixes.
- Management review closes the loop: performance, findings, risk changes, and resource decisions in one forum.
Traps
- Reporting only activity counts and calling it assurance.
- Setting indicators with no baseline, so trend is invisible.
- Treating an audit finding as closed when the document is updated but behaviour has not changed.
- Ignoring near misses and small incidents as learning sources.
- Improvement plans with no funding or owner.
Rule of thumb
If a metric cannot change a decision, stop reporting it. Every indicator should be able to trigger an action, a resource shift, or an escalation.
Worked example
A programme reports 100 percent of plans reviewed but cannot state how many critical activities have a tested strategy inside RTO. Add the outcome measure; it likely reveals that several activities fail their target, which becomes the improvement priority.