Measuring human risk: why completion rates are not enough

The completion rate measures participation, not behaviour or risk. What should you actually measure to find out whether your organisation’s exposure is falling?

· 5 min

Ask many organisations how their safety training is going, and they will reply with a completion rate. 80% of people have completed the course. That sounds like a good figure. In reality, it says nothing about the risk.

What does a completion rate actually measure?

The completion rate measures just one thing: how many people clicked through to the end of a piece of content. It does not measure whether they understood it, it does not measure whether their behaviour has changed, and, above all, it does not measure whether the organisation’s risk has decreased. It is an engagement metric disguised as a security metric.

A certificate proves that a person has attended a course. It does not prove that they will behave differently when it really matters.

What to measure instead

  1. Actual behaviour: how people really behave, not just whether they complete the courses
  2. Risk concentration: where and among whom is exposure highest?
  3. Trends over time: the risk is falling, and where
  4. Reacting under pressure: how people behave when faced with a choice, not in a quiz

From participation to results

The difference lies between an organisation that can say ‘we’ve trained everyone’ and one that can say ‘our risk has gone down, and we know where’. The former has a compliance metric. The latter has a security metric. Only the latter is really useful when presenting to a board or during an audit.

  • just 28% Some organisations combine training with behavioural monitoring (Mimecast)