Data points used by organizations to evaluate the relationship of the organization to operational risk. Metrics can include information about risks and controls, as well as processes, performance, and compliance, for example. Metrics can be narrowly focused on a single risk, or they can be an aggregate of information across the organization.