At the business segment level, the number of metrics is determined by what?

• A. Business-specific requirements
• B. Industry-standard 25 metrics
• C. Regulatory category 40 metrics
• D. Company-wide 15 metrics

Answer: (A)

Metrics at the business segment level are determined by business-specific requirements. Each segment has its own processes, data types, risk exposures, and regulatory obligations, so the monitoring framework must be tailored to capture risks that truly matter for that segment. If a segment handles highly sensitive information or critical operations, more metrics are needed to monitor access controls, data handling, third‑party performance, continuity, and incident response. Conversely, a lower‑risk segment may require fewer metrics while still ensuring adequate oversight. Fixed industry standards, regulatory category counts, or company-wide quotas do not fit because they ignore segment-specific risk and operational realities.