Business segment level metrics typically focus on what, and how is the number of metrics determined?

• A. Business and operational risks; the number depends on business-specific requirements
• B. Only regulatory compliance; fixed at 25 metrics
• C. IT security posture; fixed at 12 metrics
• D. Customer acquisition metrics; always 40 metrics

Answer: (A)

Segment-level metrics are about monitoring the risks and performance drivers that are unique to a specific business segment, focusing on both business and operational risk that could impact that segment’s outcomes. The number of metrics is determined by the segment’s particular risk profile and requirements—there is no fixed count. You identify material risk drivers through a risk assessment, consider data availability and quality, and prioritize metrics that are actionable for stakeholders and that truly reflect potential impact and likelihood. This tailored approach helps ensure you’re watching the right signals for each segment without overloading teams with irrelevant data.

The other options miss this tailoring. Focusing only on regulatory compliance ignores the broader business and operational risks a segment faces. Limiting metrics to IT security posture narrows the view to a single domain, not the full spectrum of risks. Emphasizing customer acquisition metrics shifts attention to growth rather than risk signals, and fixed metric counts assume uniformity across segments, which doesn’t reflect real-world variation in risk and complexity.