Most IT departments have many metrics they track. Server response times, ticket volumes, patch counts, utilization rates – the list goes on. But quantity doesn’t equal quality. The only metrics that truly count are the ones that show the link between IT and business performance, the type of metrics you can present to an executive team and they’ll instantly grasp why they are important.
Here are six of those you should have on hand.
System uptime and the cost of not tracking it properly
The concept of uptime is likely the most longstanding IT metric in existence, yet today, most organizations continue to measure it incorrectly. Stating that a solution is available 99.5% of the time might sound good, but that still equates to roughly 43 hours of downtime a year. Gartner cites the average cost of IT downtime is $5,600 per minute of business impact – that math speaks volumes.
The solution isn’t to just track another percentage. Define and track what each hour of unplanned downtime costs the business. When decision-makers view downtime as a loss of revenue rather than availability percentage points, discussions about IT spend become far easier to have.
Mean Time to Resolution, not ticket volume
The number of tickets cannot be used as an indicator of performance. For example, if 500 tickets are closed in a week, it doesn’t make any sense if each ticket took so long to resolve that employees were unable to work in the meantime. Rather than ticket volume, Mean Time to Resolution (MTTR) can better indicate how long the business was affected due to a problem.
MTTR should be tracked based on issue categories and not as an overall metric. Network issues, software failures, and access provision problems will have different impacts on the business relative to the acceptable resolution window. If you measure MTTR by the aggregate, you won’t get the visibility you require on these issues. However, you can see the broader picture by measuring it alongside other KPIs. For instance, if the First Contact Resolution rate is high, this indicates that your frontline support team and self-service tools are efficient. If the First Contact Resolution rate is low, it indicates that time and goodwill are being spent unnecessarily on reiterations.
Internal CSAT: treating employees like customers
IT departments who do not evaluate user satisfaction typically assume satisfaction. This assumption is mostly incorrect.
Internal CSAT surveys don’t have to be complex. A brief, frequently planned survey that asks employees to give a score to their most recent IT support encounter offers you a continually updated signal that just operational data is unable to supply. Technical statistics inform you what transpired. CSAT informs you of what the experience was, and it is exactly what establishes if workers have confidence in IT or avoid it at all costs.
Low CSAT scores commonly expose problems that don’t appear in any system log – ambiguous communication in the course of outages, support staff who are competent in technology but have difficulty in explaining solutions, or self-service solutions which are accessible but not put to great use. Repairing all those challenges doesn’t require brand new facilities. It simply requires you to know that they occur.
SLA compliance and what it actually proves
Service Level Agreements (SLAs) define what IT has committed to deliver. Tracking SLA compliance tells you if those commitments are being met, but it also determines if the commitments were realistic in the first place.
For instance, if you have an SLA compliance rate of 99%, well, that’s a good thing. Or is it? It might also be that the SLAs were written too conservatively to begin with. The metric only really matters when it is measured against business impact – which SLA breaches caused material disruption, and which were minor. If you are honest about it, not all missed SLAs carry equal consequences.
For mid-market and enterprise organizations that struggle to maintain performance across all of these metrics simultaneously – often because internal teams are stretched thin across too many priorities – working with a managed service provider like Auxilion can help design and implement the solutions needed to properly baseline, track, and improve these KPIs.
Project delivery rate: IT as a strategic function
If the only thing IT is measured on is keeping the lights on, it’ll get funded at the level required to maintain existing systems. It’s only when you move to looking at that project delivery rate – the percentage of projects that are completed on time, within scope, and within budget – that IT becomes the engine room of the business and not just the car it’s pulling along.
Budget variance and milestone adherence for a full project portfolio is effectively the barometer for how effective IT is at driving the business forward. If you are consistently under budget and able to deliver projects on time and on scope then everything is healthy. Consistent overruns or projects running over time or scope is an indication that something is happening structurally – poor requirements gathering, over-optimistic resource planning, projects approved not based on the reality of time and resources.
Digital transformation programs kind of live and die by this metric. Once you have a few wins under your belt you earn the right to do bigger and more complex things so this bit will make or break efforts in most cases.
Cybersecurity patch management rate
Measuring security incident frequency can be a good metric for overall risk exposure in an organization but, by its very nature, it’s a reactive metric. A better, proactive measure of the same factor is the patch deployment rate.
Specifically, how many days elapse, on average, from when a critical security patch is released to when it is installed on all endpoints throughout the organization? This is a measure of how responsive the organization and its service providers are to known vulnerabilities. The longer that takes, the longer hackers have to exploit a known security hole.
Some loopholes will be exploited prior to patching – sometimes very quickly. This is what APTs often rely on – taking their shot between the time that a vulnerability is publicly disclosed and the time that it is patched. Other attacks will piggyback on the work of others, trying the same exploit long after the window of vulnerability has closed.
These six metrics don’t cover everything an IT department does, but they cover what matters to the business. Uptime, resolution speed, user satisfaction, SLA compliance, project delivery, and security posture – measured consistently, they tell a coherent story about whether IT is functioning as a cost center or a genuine operational asset.