Ask a team where they track their KPIs, and you might get a few different answers. It could be an Excel sheet, an email, a dashboard, or a separate system altogether. The problem isn't that organizations don't have KPIs. It is everything around them that can become difficult to manage. Someone needs to define the KPI, set the target, assign an owner, collect the measurement, review the result, and figure out what happens when the target isn't met.
Eventually, someone needs to answer a fairly basic question: are we actually meeting the objectives we've set for security and compliance?
That is the problem behind Vamu's new KPI Management capability. It gives teams a structured place to define and manage KPIs, from setting the measurement and target to assigning responsibility, recording performance, managing breaches, and keeping a record of what happened along the way. Because it sits inside Vamu, KPIs can also be connected back to the wider governance work around them.
Define The KPI & How It Should Be Measured
A KPI can mean very different things depending on what you are trying to measure. For one objective, the right measurement might be a percentage. For another, it might be a number, a simple yes/no outcome, or whether a value falls within a particular threshold. Vamu supports all four measurement types.
When creating a KPI, you can define its name and description, assign an owner, and set the measurement type and frequency. Measurements can be weekly, monthly, quarterly, semiannually, or annually. The owner is also separate from the person creating the KPI, so an administrator can create one and assign responsibility to the person who actually owns the outcome.
You can also define what a good result means for that particular KPI. Sometimes higher is better, sometimes lower is better, and sometimes the right result is staying within a defined range. In other cases, the target needs to be an exact match. Vamu lets you define that logic when setting up the KPI, including targets and ranges where needed. This gives the system a clear basis for determining whether a measurement is on target, moving into warning territory, or has breached its target.
Keep KPIs Connected To The Work Around Them
A KPI does not always exist on its own. It may be tied to a control, policy, document, risk, or framework, particularly when it is being used to measure a wider security or compliance objective. Vamu allows a KPI to be mapped to multiple governance elements when it is created, so those relationships can be kept alongside the KPI rather than managed separately.
The Governance Mapping area gives users a view of these relationships, including how many KPIs are connected to controls, policies, documents, and risks. The mappings can also be edited later, so they can be updated as the underlying governance work changes.
Know When A KPI Is Moving In The Wrong Direction
Recording a measurement is only useful if you can understand what that measurement means. Vamu uses three performance states, on target, warning, and breach, to make that clearer.
A warning indicates that a KPI is moving outside its desired range and gives the team an early signal that it may need attention. A breach means the defined target was not achieved. That distinction is useful because a KPI that is beginning to move in the wrong direction may require a different response from one that has already missed its target.
When a submitted measurement is not achieved, Vamu automatically creates a breach linked to that KPI. The breach is generated from the measurement rather than being something a user has to create manually, keeping the issue connected to the KPI that identified it in the first place.
When There Is A Breach, There Is A Process For Dealing With It
Identifying a breach is only the beginning. Each breach can have a Corrective and Preventive Action (CAPA) associated with it, where the user can record the root cause, specify whether the action is corrective, preventive, or both, add a date, and attach supporting evidence.
The CAPA then goes through its own review process. It can be submitted for verification, rejected, or sent back with a request for clarification before being approved. Once the response has been dealt with, the linked breach and CAPA can be closed.
This creates a clearer chain between the original KPI measurement, the problem that was identified, and the action taken in response. Vamu also keeps track of breach status, including open, in progress, submitted, overdue, and closed items.
See What Is Happening Over Time
The latest measurement is useful, but the history behind it can tell you much more. Vamu keeps the current value, target, previous measurement, and the change from the previous update, along with any notes and supporting evidence submitted with the measurement.
Trend Analysis builds on that history by showing which KPIs are improving, stable, or declining. Users can filter into a specific KPI and look at its actual performance, target, and breaches, as well as review performance across longer periods such as one, three, and five years. The view can also be filtered by specific quarters.
This makes it easier to move beyond looking at a KPI as a single number and understand how its performance has changed over time.
Make Recurring KPIs Easier To Create
Some KPIs will need to be created repeatedly with similar configurations. For those situations, Vamu includes KPI Templates, which allow users to save a KPI configuration and apply it when creating a new KPI.
Instead of setting up the same measurement type, frequency, target configuration, and other details again, the user can apply an existing template and make the changes needed for the new KPI. Templates can be edited, duplicated, archived, restored, or deleted.
The same principle applies to existing KPIs. If a KPI needs to be reused, users can duplicate it, which copies its existing configuration and creates a new KPI that can then be adjusted and submitted for approval.
Give Teams One Place To Submit Measurements
KPI management does not stop once a KPI has been created. Measurements still need to be submitted, reviewed, and kept up to date. The KPI Measurements area allows users to submit measurements for multiple KPIs without opening each KPI individually.
A measurement can include the measurement date, an optional comment, and an attachment. The approver can then determine whether the target was achieved or not achieved. There is also a reminder action that can send a notification to the KPI owner when a measurement needs to be submitted. At this stage, the reminder is a notification within the system, while email reminders are planned for a future iteration.
Get The Bigger Picture From The Dashboard
When there are a large number of KPIs, looking at them individually is not enough. The KPI dashboard brings the overall picture together, showing the total number of KPIs and breaking them down by status, including active, draft, pending approval, and retired KPIs.
It also provides an overview of target, warning, and breach performance, along with the reporting-period performance trend. Users can see open and closed breaches, repeated breaches, governance coverage, and which KPIs are improving, stable, or declining.
The KPI scoreboard brings the detail into the same view, including the current measurement, target, period, status compared with the previous measurement, and breach information. From there, users can drill into the areas that need more attention.
Keep A Record Of What Happened
For a capability built around measurement and accountability, having a record of activity is important. Vamu's audit trail records actions across the KPI module, including who performed the action, what they did, which KPI it affected, the previous status, the new status, and the timestamp.
That includes actions such as creating or updating a KPI, submitting it for approval, approving or rejecting it, retiring it, changing ownership or project assignments, sending reminders or escalations, and duplicating KPIs. This gives teams a history they can refer back to when they need to understand what changed and when.
Organize KPIs Around Projects
As the number of KPIs grows, organization becomes just as important as measurement. Vamu allows users to group related KPIs into projects, giving teams a way to keep KPIs connected to the areas or objectives they belong to.
The module also supports bulk actions, so users can select multiple KPIs and export them, group them by project, reassign their owners, or duplicate them rather than having to perform those actions one at a time.
Report On KPI Performance
The reporting area includes KPI Trend Reports, Performance Reports, Audit Reports, and a generic reporting option. Reports can be filtered by time period, framework, department, owner, action type, specific KPIs, or all KPIs.
Once a report has been generated, users can preview it and download it as a PDF or Excel file. Previous reports can also be accessed and deleted. The current reports are table-based, with graphical reporting discussed as a future improvement.
When The KPI Owner Isn't A Vamu User
The person responsible for a KPI is not always going to be someone working directly inside Vamu. The module allows a KPI to be assigned to an external owner by adding their name and email address.
The external owner gets access through a separate portal. After receiving an email and verifying their access, they can see the KPIs assigned to them and submit their measurements through the portal. This allows the person responsible for a measurement to participate in the process without needing access to the full Vamu application.
From Tracking KPIs To Managing Them
The original request behind this capability was fairly straightforward: give an organization a more organized way to manage employee KPIs, set targets, and measure performance. But once you start managing KPIs at scale, the requirement quickly becomes more than simply having somewhere to enter a number.
You need to know who owns the KPI, what the target means, whether performance is improving or declining, and what happens when the target is missed. You also need to be able to trace the actions taken afterwards and connect the KPI back to the wider governance work around it.
That is what we wanted to bring together with Vamu's KPI Management capability: a structured way to define KPIs, measure them, understand their performance over time, manage breaches when targets are missed, and keep the history around those decisions in one place.
If you'd like to see the KPI Management capability in action, get in touch with the Vamu team for a demo.
