Monday morning, board meeting. The CISO proudly presents the numbers: 98% of accounts use MFA, 95% of employees have completed the security training and a backup runs every night. Everyone nods approvingly. Then the CFO asks one question:
"Great. But does that actually make us safer? And by how much?"
The room goes quiet.
Organisations invest millions every year in cybersecurity, continuity and risk management. Firewalls are replaced, MFA is rolled out, employees attend training and one policy document follows another. Yet the simplest question of all remains surprisingly often unanswered: does it actually work?
In my view, that is the biggest blind spot in security and compliance. An implemented control is not yet an effective control.
The flaw behind the checkmark
The classic approach to risk management goes like this: you identify a risk, choose a control, implement it and check whether it is in place. Checkmark. Risk managed.
But that last step only measures whether a control exists, not whether it works. Three examples:
So the relevant question is not "Have we implemented the control?", but:
"To what extent does this control reduce the risk?"
A small difference in wording, a fundamentally different way of looking at things.
Measure outcomes, not activities
To assess effectiveness, you decide up front what a control should achieve and how you will measure that outcome. For technical controls, that is often surprisingly easy.
Take an endpoint security solution. Don't just measure how many endpoints are connected, but also:
For backups, two numbers matter: the Recovery Time Objective (how quickly are you operational again?) and the Recovery Point Objective (how much data do you lose?). For security awareness, phishing simulations and behavioural measurements show whether behaviour really changes.
You can carry out a great many activities without lowering the risk one bit. So measure what it delivers, not what you do.
KPIs tell you what you do, KRIs tell you where you stand
The difference between a KPI and a Key Risk Indicator (KRI) makes this concrete:
| Topic | KPI (activity) | KRI (risk) |
|---|---|---|
| Awareness | 98% completed the training | Phishing test click rate down from 18% to 6% |
| Vulnerabilities | Number of patches applied | Number of critical vulnerabilities open for more than 30 days |
| Backups | Backup runs every night | Restore test met within the agreed RTO |
| Access | 98% of accounts have MFA | Number of successful logins on accounts without MFA |
The right-hand column tells you far more about your actual risk. Measuring is not a goal in itself: the measurement should help you make better decisions.
From security language to boardroom language
A control never stands alone. Against ransomware, for example, you deploy endpoint protection, network segmentation, MFA, backups, monitoring and awareness at the same time. The real question is what that whole set does to the original risk.
Suppose you estimate the potential damage of a ransomware attack at €5 million. The controls make an incident less likely and limit its impact. The remaining risk is €1 million.
Then you have not just "solved a security issue". You have reduced €4 million of potential risk. That is information a board member or CFO can work with.
A worked example
Suppose you estimate the annual expected loss of a risk at €500,000, and a new control costing €100,000 a year halves that loss:
| Item | Amount per year |
|---|---|
| Expected loss without control | €500,000 |
| Expected loss with control | €250,000 |
| Estimated risk reduction | €250,000 |
| Cost of the control | €100,000 |
Is that a guaranteed €150,000 profit? No, risks remain uncertain. But it is a far more solid basis for a decision than the observation that "the solution complies with the standard".
More controls do not mean more security
Budgets are limited, and there is always more you could do: more tooling, more monitoring, more checks, more audits. Sometimes an investment of €50,000 delivers an enormous risk reduction, while €200,000 elsewhere barely adds anything.
That is why every investment decision deserves this question:
Which control delivers the greatest demonstrable risk reduction per euro invested?
That changes the conversation in the boardroom. From "We need a new security tool." to "This risk could cost us this much. With this investment we expect to reduce it by this percentage."
The second story is a lot stronger.
Effectiveness is not an annual audit exercise
A control that works today may fall short tomorrow. Threats change, technology changes, people come and go and the organisation itself changes. A control works fine until a new vulnerability appears. A backup strategy seems adequate for years, until a large-scale disruption shows that recovery capacity falls short.
So you monitor effectiveness continuously, not once a year for the auditor. Dashboards help, but only if they answer the right question. A dashboard with hundreds of technical KPIs is of little use if management still cannot see which risks have gone down. A good dashboard shows at a glance:
Which risks do we face, which controls do we have for them and how effective are they?
The standards ask for it too
This is not a theoretical wish. ISO 27001 requires in clause 9.1 that you not only determine what you monitor and measure, but also evaluate the effectiveness of your management system. And the NIS2 Directive explicitly lists, in Article 21, policies and procedures to assess the effectiveness of cybersecurity risk-management measures. So expect your auditor to ask more and more often: show me that it works.
My view: stop collecting checkmarks
Don't get me wrong: compliance, certifications and frameworks are definitely valuable. They provide structure and make sure you don't forget important topics. But they should never become the end goal. You can be fully compliant and still be vulnerable.
That is why I believe organisations need to go one step further: not only demonstrate that a control exists, but demonstrate what it delivers. That requires a different kind of collaboration between IT, security, risk, finance and the business. Together, they should be able to answer:
How uComply helps
In uComply, risks and controls are not kept in separate lists but linked to each other. You record a risk in the risk register, link the controls that should manage it and see which requirements of ISO 27001, NIS2 or BIO2 you cover at the same time. If a control turns out to be less effective than expected, you turn it into an improvement action with an owner and a deadline. The Flightdeck dashboard gives your management the overview that matters: which risks are in play, which controls are in place and where action is needed.
In closing: stay curious about the outcome
The future of risk management does not lie in ever more controls, checks and reports, but in demonstrable effectiveness. An organisation that can show that an investment of €100,000 substantially reduces a risk has a much stronger story than one that can only report that a new security solution is running.
So don't be satisfied just because a control has been implemented. Keep asking:
These are not questions for the CISO or IT manager alone. They matter to the whole organisation.
Effective risk management is not about as many controls as possible, but about as much demonstrable risk reduction as possible with the resources you have.
Want to see how you keep track of risks, controls and their effectiveness in one place, with a dashboard your management understands too? Book a no-obligation demo.
