Create and maintain measures
This heading introduces five steps for building and maintaining the measure set.
What the published 2016 guidance says
This heading introduces five steps for building and maintaining the measure set. The triggers for review matter as much as the first design. A measure is created once, then revisited at planned intervals or when the environment changes materially: scope, structure, interested parties, objectives, law, a run of stable results, or a new or retired technology. The review should cost less than the first build, which is possible only if the construct was documented well enough to be understood later.
What it means in practice
This is the maintenance heart of the programme. Measures are created once, then reviewed at planned intervals and on substantial change: scope, structure, interested parties, objectives, law, stable results, or new technology. The review should cost less than the first build, which is only true if the construct was documented properly.
Status of this record. For 8.3, this page states the published 2016 guidance, not the DIS text. The DIS is at stage 40.60 and is not public. Check the published edition before you rely on the row.
What good looks like
Give the measure set a version, an owner and a review date. Record the trigger for the last review and the changes made. Keep the retired measures with the reason, so the history is not lost.
Evidence an assessor asks for
- Performance evaluationThe measure register with a version, an owner and a review date
- Performance evaluationThe trigger list used at the last review
The question an assessor will ask
An assessor will ask for the measure register with a version, an owner and a review date. The test for 8.3 is whether that record can be produced for a live sample, not whether the guidance is described in a procedure.
Common gaps
- Measures are created and never reviewed
- The review trigger list is missing, so a scope or tool change passes unnoticed
- The review costs as much as the first build because the construct was never documented
Before the next review
Before the next review, test this against one live record: measures are created and never reviewed.
What to check when the revision publishes
When DIS 27004 is published, compare the 8.3 Create and maintain measures record with this page. Ask whether the information need, the formula, the target, the frequency or the owner changes. Update the measure register and the kit, not the requirement, because the clause 9.1 duty stays as it is.