N100FN100F
Published on

Measuring governance

Governance that is not measured gets judged on anecdotes: last week's blockage, last month's incident. Four simple indicators tell you whether the standard is met, whether exceptions are under control and whether governance helps or hinders.

Service line Multicloud Governance

Governing blind

Ask in any organisation whether its cloud governance works and you will get opinions: 'we are doing fairly well', 'there is a lot of chaos', 'the committee is a bottleneck'. All of them can be true at once, and none of them lets you decide what to improve.

Four indicators

Is governance working?Four indicators over six months: compliance, overdue exceptions, days to review and cost allocated.GOVERNANCE · INDICATORSIs governance working?Compliant resources71 % → 93 %month 1month 6Overdue exceptions14 → 2month 1month 6Days to review12 → 4 daysmonth 1month 6Cost allocated62 % → 94 %month 1month 6By trend, with an owner, reviewed every month.A 100% achieved through permanent exceptions is not a success.Illustrative data; they do not correspond to any real caseN100F · n100f.com

Compliance. The percentage of resources that meet the mandatory rules, by domain and by account. It comes straight out of the detective policies.

Overdue exceptions. How many exceptions have passed their date without being closed or renewed. It is the best indicator of whether the review process works.

Review turnaround. How many days a design takes from being submitted to having a verdict. It measures whether governance is slowing things down (we saw this in reviewing without slowing down).

Cost allocated. The percentage of cloud spend with a clear owner. It connects governance to the financial side: with no owner there is no accountability.

How to use them

  • By trend, not by absolute value. Going from 71% to 80% compliance says more than arguing about whether 80% is good.
  • With an owner for each indicator, like any deliverable in the responsibility map.
  • Reviewed at the tactical level, at the same rhythm as the standard.
  • Without turning them into blind targets. A 100% compliance figure achieved through permanent exceptions is not a success.

What the numbers do not say

Indicators show whether the system works, but not why. An indicator getting worse is the start of a conversation with the teams, not a verdict. And often the conclusion is that what needs to change is the standard itself.

That governance should change too, in an orderly way, is the last step.

How we apply it: Multicloud Governance.

If your cloud cost keeps growing and nobody knows why, or your architecture depends on whoever built it, let’s talk.

Let’s talk