“I often say that when you can measure what you are speaking about, and express it in numbers, you know something about it; but when you cannot measure it, when you cannot express it in numbers, your knowledge is of a meagre and unsatisfactory kind.”William Thomson (Lord Kelvin) · Electrical Units of Measurement · 1883 · «Electrical Units of Measurement», conferință la Institution of Civil Engineers, 3 mai 1883; Popular Lectures and Addresses, vol. 1 (1889), p. 73
A performance indicator describes what happened, while a risk indicator moves before it happens.
Kelvin's sentence, from an 1883 lecture on electrical units, is usually misquoted as what you cannot measure you cannot manage. The original is more honest: without numbers, knowledge stays meagre, but it is not absent. The difference matters, because a programme that measures only what is easy to count ends up reporting activity instead of effect. Clause 9.1 of ISO/IEC 27001:2022 asks four questions and wants a documented answer to each: what is monitored and measured, by which methods, when the measurement happens and who performs it, then when the results are analysed and by whom. A performance indicator says how well a control is running, for instance the share of systems patched within the deadline. A risk indicator is forward-looking: it rises before the risk materialises. Confusing the two means reporting the past and calling it early warning.
Why it matters Clause 9.1 often fails at audit not because numbers are missing but because the method, the timing and the name of the measurer are missing.