Develop or update measures
A measure must be defined closely enough that someone else can repeat it.
What the published 2016 guidance says
A measure must be defined closely enough that someone else can repeat it. The guidance uses a template with nine fields: an identifier; the information need; the measure itself, as a percentage, count, frequency or average; the formula or scoring rule; the target; the implementation evidence; the frequency; the responsible parties; and the data source and reporting format. An optional tenth field records the action to take when the target is missed. Data can come from logs, scans, training records, surveys, incidents, audit, continuity exercises or management review.
What it means in practice
A measure needs enough definition to be repeated by someone else: identifier, information need, formula, target, implementation evidence, frequency, responsible parties, data source and reporting format. Add the action to take when the target is missed. Collect once and use the data for several purposes where you can.
Status of this record. For 8.3.3, this page states the published 2016 guidance, not the DIS text. The DIS is at stage 40.60 and is not public. Check the published edition before you rely on the row.
What good looks like
Write the construct in the nine template fields and add the action. Have a second person repeat the formula on one period. If the result differs, the definition is not yet good enough.
Evidence an assessor asks for
- Performance evaluationA measure definition per measure carrying all Table 1 descriptors
- DocumentationSelection rationale recording collection cost, tooling and fitness for purpose
- Performance evaluationTargets with the basis on which they were set
The question an assessor will ask
An assessor will ask for A measure definition per measure carrying all Table 1 descriptors. The test for 8.3.3 is whether that record can be produced for a live sample, not whether the guidance is described in a procedure.
Common gaps
- Measures defined as a name and a number with no formula, target or owner
- Targets set at last year's result and never stretched
- Composite scores built from several subjective ratings
Before the next review
Before the next review, test this against one live record: measures defined as a name and a number with no formula, target or owner.
What to check when the revision publishes
When DIS 27004 is published, compare the 8.3.3 Develop or update measures record with this page. Ask whether the information need, the formula, the target, the frequency or the owner changes. Update the measure register and the kit, not the requirement, because the clause 9.1 duty stays as it is.