Which IT governance metric best indicates adherence to policies and regulatory requirements?

• A. Portfolio value
• B. Schedule variance
• C. Compliance rate
• D. Risk exposure

Answer: (C)

Compliance rate directly captures whether policies and regulatory requirements are being followed. It measures the portion of controls, processes, or practices that pass audits or policy checks, reflecting actual adherence to rules such as PCI-DSS, GDPR, HIPAA, or SOX. By tracking how often policies are complied with, it provides a clear signal of governance effectiveness and highlights where remediation is needed.

In contrast, portfolio value focuses on the financial worth of initiatives, schedule variance looks at timing performance, and risk exposure gauges potential negative outcomes without directly measuring policy adherence.