Patterns across signals
The most useful information in monitoring is usually a pattern across signals or across time.
| Pattern | What it usually means |
|---|---|
| Strong posture, weak remediation | The team documents its state well and is not closing the gaps it has identified. |
| Strong process, weak posture | Reviews happen on schedule, and implementation does not deepen between them. The process is running without driving work. |
| High urgency, improving trend | A bad position that is getting better. It may need watching more than intervention. |
| High urgency, worsening trend | A bad position that is getting worse. It needs engagement now. |
| Reviews clustered in one part of the year | Each resource may look on schedule, but the work is done in a burst. That invites box-ticking and is hard to sustain. |
| The same control area weak across many resources | A capability gap or a deliberate deferral. It calls for a different response from scattered individual gaps. |
Coverage and evidence
Two posture measures are worth reading as a pair: how much of its scope a resource has implemented, and how much of that is backed by evidence.
| Coverage | Evidence | Reading |
|---|---|---|
| High | High | Strong |
| High | Low | Undocumented. Controls are claimed without support, which carries a risk of box-ticking. |
| Low | High | Selective. There is depth without breadth. |
| Low | Low | Weak |
Systemic or isolated
Ask how many resources share the problem. If a team's main issue affects one or two resources, it is probably isolated, and the place to look is the resource.
If the same issue appears across many of a team's resources, it is systemic. That calls for a conversation about the team's overall approach, and fixing resources one at a time will not resolve it.
Trend
A score without a trend is incomplete. Two teams with the same score are in different situations if one has been improving for three months and the other declining.
Movement sustained over a longer period is more reliable than a change in one short window, which may only reflect timing, such as a batch of approvals just before a reporting date. Trend is also how you find out whether an earlier intervention worked.
How much to trust a score
- New teams. Their scores still rest partly on defaults. Treat them as early signals.
- Local settings. The weights and thresholds behind a score can be tuned by each organization, so the same number may mean different things in two places.
- Age of the data. A thorough assessment done long ago, with no follow-up, can show a strong posture that is no longer true. Monitoring is a synthesis of what has been reported.
- Missing scope. A resource with no defined scope cannot be scored meaningfully on posture. Treat that as an administrative gap to fix first.
Patterns that keep recurring deserve a standard response. From Pattern to Playbook describes how to build one.