Measurement, management review and corrective action

Measurement, management review and corrective action

IM-01 — Measurement policy

[Organisation] uses measurement to understand whether adopted SSDLC promises are being fulfilled and whether action is needed. Each measure identifies the decision it supports, population, period, data source, calculation, owner and limitations. Measures are interpreted with the underlying evidence and context. A favourable aggregate is not used to conceal a consequential failure or an unassessed area.

The programme owner maintains definitions so that changes in scope or calculation are visible between reports. Targets are established by the relevant authority from organisational objectives and risk criteria. Where no target has been adopted, the measure is reported as an observation rather than assigned an invented pass threshold.

IM-02 — Programme measures

IM-03 — Collect and interpret

The measure owner obtains information from the identified registers and records the extraction date and scope. The owner checks duplicates, missing records, inconsistent status and changes in population. A zero denominator is reported as no applicable population, not converted into a perfect percentage. Estimates and incomplete data are labelled with their limitations.

Trend interpretation considers changes in reporting, coverage, system use, suppliers and risk. More findings may reflect better assessment rather than worse operation; fewer reports may reflect a failed intake route. The owner provides the context needed for management to choose action. Measures of activity volume are distinguished from measures of outcome or effectiveness.

IM-04 — Corrective action

The responsible owner records the observed problem, affected promise or objective, evidence and immediate correction where needed. Cause analysis examines technical, procedural, resource, competence, authority and information factors relevant to the issue. The owner identifies whether other systems or activities share the same cause and records the scope of the action.

The action plan states the change to be made, responsible person, resources, target date, completion evidence and effectiveness test. The decision authority approves changes requiring its authority. Completion records demonstrate the action taken; effectiveness review determines whether the intended improvement occurred. Repeated findings trigger reconsideration of the earlier cause analysis and treatment.

IM-05 — Management review agenda

The sponsor or designated management authority conducts the review at [schedule] and when material conditions require it. Participants receive the current programme scope, policy changes, risk position, measures, assurance findings and decisions requested. The following agenda is used to record the review.

1. Confirm the review scope, participants, authority and previous actions.
2. Review changes in objectives, stakeholders, obligations and system scope.
3. Review adopted promises, implementation gaps, exceptions and deferrals.
4. Review risk decisions, changed exposure and unresolved uncertainty.
5. Review assurance coverage, evidence limitations and significant findings.
6. Review incidents, vulnerabilities, supplier performance and stakeholder feedback.
7. Review AI use, evaluation coverage, operating changes and consequential outcomes.
8. Review competence, capacity, resources and the practicality of procedures.
9. Decide corrective actions, investment, changed commitments and escalations.
10. Assign owners, dates, evidence and effectiveness reviews for each decision.

IM-06 — Review decisions and communication

The record states the information considered, decisions, rationale, dissent and unresolved matters. Decisions identify their authority and effect on policies, systems, resources and risk. Where management chooses continued operation with a known deficiency, the record identifies the accepted exposure and conditions through the risk process. A review meeting does not itself close the actions discussed.

The programme owner communicates decisions to those responsible for implementation and those affected. Policy changes follow document control; system changes follow configuration management. The next review confirms what happened and whether the expected result was achieved. Uncompleted actions retain their original due dates and the reasons for subsequent decisions.

IM-07 — Improvement records

Measure record: [IM measure ID; decision supported; owner]
Definition: [Population; period; numerator; denominator; units]
Source and quality: [Register/query; extraction; gaps; limitations]
Target and authority: [Adopted target; rationale; approval]
Result and interpretation: [Observation; trend; context; action]

Corrective-action record: [IM action ID; finding; affected scope]
Problem and evidence: [Condition; promise; consequence]
Cause analysis: [Evidence; contributing factors; other affected work]
Action: [Correction; systemic change; owner; resources; due date]
Verification: [Completion evidence; reviewer; date]
Effectiveness: [Expected outcome; method; observation period; result]
Decision and closure: [Authority; remaining risk; further action]

The custodian retains definitions, reports and review decisions with their versions so that later readers can understand why a decision was made. Assurance of the measurement process checks the trace from reported figures to underlying records and verifies that material limitations were communicated.