Author
William Thomson (Lord Kelvin)
1 reading card from 1 book · 1883.
1 card
Electrical Units of Measurement · 1883
A performance indicator describes what happened, while a risk indicator moves before it happens.
Kelvin's sentence, from an 1883 lecture on electrical units, is usually misquoted as what you cannot measure you cannot manage. The original is more honest: without numbers, knowledge stays meagre, but it is not absent. The difference matters, because a programme that measures only what is easy to count ends up reporting activity instead of effect. Clause 9.1 of ISO/IEC 27001:2022 asks four questions and wants a documented answer to each: what is monitored and measured, by which methods, when the measurement happens and who performs it, then when the results are analysed and by whom. A performance indicator says how well a control is running, for instance the share of systems patched within the deadline. A risk indicator is forward-looking: it rises before the risk materialises. Confusing the two means reporting the past and calling it early warning.
“I often say that when you can measure what you are speaking about, and express it in numbers, you know something about it; but when you cannot measure it, when you cannot express it in numbers, your knowledge is of a meagre and unsatisfactory kind.”