A governance metric needs a denominator.

A count can look precise and still hide the question

Seventeen escalations. Ninety-eight percent coverage. Three incidents. Each number may be accurate, yet none is sufficient for a governance decision on its own. Seventeen out of how many decisions that were eligible for escalation? Coverage of which systems in the inventory? Three incidents across what volume of exposure and which time window?

The missing denominator is more than arithmetic. It names the reference set that makes comparison possible. Without it, a falling count might reflect lower risk—or simply lower activity, narrower monitoring or missing telemetry. A percentage can look reassuring while silently excluding systems that were never inventoried. Precision in the numerator does not repair ambiguity in the population beneath it.

Measure the risk you actually mapped

The NIST AI Risk Management Framework treats measurement as part of a continuous process spanning GOVERN, MAP, MEASURE and MANAGE. Its MEASURE guidance says what should be measured depends on purpose, audience and evaluation needs. It also calls for documenting metric selection, acceptable limits and risks that cannot be measured. That structure is useful because a metric is only interpretable in relation to the system and risk it was designed to represent.

This does not mean NIST prescribes one universal denominator. It means teams should make their measurement choices visible enough to evaluate. The appropriate reference set for blocked security events may be attempted events. For human overrides, it may be decisions eligible for review. For governance coverage, it may be the in-scope system inventory. Each choice expresses a boundary—and every boundary creates exclusions that should be named.

Use a metric card that can be challenged

A practical governance metric should travel with a compact record. I would include seven fields: the exact measure or numerator; the eligible population or opportunities; the system and policy version; the time window; exclusions and missing observations; the accountable steward; and the threshold that triggers review or action.

I call this a governance metric card. It is an editorial synthesis, not a NIST or GAO standard, and it does not turn a technical observation into authority. The steward field identifies who must examine the signal. The action threshold records an agreed trigger. The underlying policy still determines who may decide, intervene or accept risk.

The card also helps expose denominator drift. If a system version changes, monitoring coverage narrows or eligibility rules move, the series may no longer be comparable. A visible record gives reviewers a reason to pause before interpreting the apparent trend.

Test the decision, not just the number

The metric-card idea is proposed and unmeasured. A useful evaluation would give reviewers the same AI-system evidence in two formats: raw counts alone and counts accompanied by the seven-field card. Researchers could then change the exposure volume, omit part of the telemetry or shift a version boundary. Outcomes might include ranking errors, missed drift, review time and legitimate escalations.

That study would not ask whether more documentation is always better. It would ask whether the added context changes consequential decisions enough to justify its cost. Until there is evidence, the claim should remain modest: a denominator makes a number interpretable, but only an evaluation can show whether the full card improves governance practice.

Before approving an AI governance dashboard, ask one question: what had a chance to happen—and which cases are absent?