Governance metrics

- Policy compliance rate - Training completion and assessment scores - Risk register health (open, aging, overdue) - Audit findings (open, remediated SLA) - Vendor risk assessment coverage