Valeo · security governance / January 2026
When 73% looks more precise than the data actually is
Percentage-based status was tempting, but in several cases the source data was not stable or comparable enough for a single number to represent genuine precision.
Situation
Executives naturally ask for percentages because they are quick to compare and easy to chart. The problem appears when numerator and denominator contain items of very different significance and evidence quality. A simple missing document and a multi-team control gap may each count as one item while representing entirely different levels of risk.
Approach
I did not ban percentages; I surrounded them with the uncertainty and categories needed to interpret them. Closed, in-progress, blocked and interpretation-pending items were shown separately, as were critical gaps. Trend lines were used only where the same calculation rules had been applied consistently across time.
Outcome
The report became less satisfying as a single neat number but much more useful in discussion. An overall value around 80% could no longer hide the fact that the remaining 20% contained the highest-risk items. Management decisions were therefore based on the actual residual work rather than an average.