When the measure becomes the game

Fausto and I were talking about KPIs, and I kept coming back to Goodhart's Law:

"When a measure becomes a target, it ceases to be a good measure."

It sounds like something from an economics paper, but it is painfully practical. You see it in operations, security, sales, compliance, customer service, and almost every environment where people are judged by a number.

A company wants better customer service, so it measures how fast agents close tickets. At first, that makes sense. Nobody wants a ticket sitting untouched for five days. Then the number becomes part of the scorecard. Suddenly the behavior changes. Tickets close faster, but not always better. Complex cases get avoided. Problems get split into smaller pieces. The dashboard improves while the customer still feels ignored.

That is the trap.

Metrics are supposed to help us see reality. But once bonuses, recognition, pressure, or performance reviews depend on the indicator, people start managing the indicator. Sometimes consciously. Often without even noticing it.

I do not think this is always malicious. Most people are not waking up thinking, "How can I corrupt this KPI today?" They are responding to incentives. If leadership says one number matters more than the work behind it, people will optimize for that number. If the system rewards appearances, appearances become part of the job.

The KPI starts innocent

Most bad measurement systems begin with reasonable intentions.

A security team tracks the number of vulnerabilities closed. A compliance team tracks audit findings. A call center tracks average handling time. A development team tracks story points, commits, or tickets completed. A risk team tracks overdue controls.

None of these numbers are useless. The problem starts when the number is treated as the truth instead of a clue.

In security, this can become especially dangerous. If the main KPI is vulnerabilities closed, teams may chase easy findings because they improve the count. If phishing performance is measured too narrowly, people may learn how to pass simulations without becoming more careful in real situations. If audit findings become the dominant signal, teams can become excellent at preparing for audits while still missing operational weaknesses.

The metric keeps moving. The risk does not always move with it.

That is where Goodhart's Law becomes more than a clever quote. It becomes a warning about governance.

People learn the scoring system

Any measured system becomes a game eventually.

That sounds cynical, but I do not mean it that way. People are adaptive. They learn what gets rewarded, what gets questioned, what gets ignored, and what creates trouble. After a while, the organization does not even need to say the quiet part out loud. The scorecard teaches everyone what matters.

If leaders reward closed tickets, people close tickets. If leaders reward low incident counts, people become very careful about what gets called an incident. If leaders reward green dashboards, people become skilled at keeping dashboards green.

The danger is that all of this can look like discipline from the outside. Clean charts. Better percentages. Fewer overdue items. Shorter cycle times.

But a clean dashboard can hide a messy reality.

That is why I do not fully trust any KPI until I understand the behavior it creates. A good question to ask is: if someone wanted to look good without improving the actual outcome, how would they game this number?

If the answer is easy, the KPI needs stronger context.

The number is not the outcome

The mistake is confusing a proxy with the thing itself.

A KPI is usually a shortcut. We cannot directly measure everything we care about, so we choose something close enough. Customer satisfaction becomes a survey score. Security posture becomes patch latency. Productivity becomes tickets completed. Operational maturity becomes the percentage of controls marked complete.

Sometimes the proxy is useful. Sometimes it is the best we have. But it is still a proxy.

The outcome is usually messier:

• customers feel properly served;
• risk is actually reduced;
• systems become more resilient;
• teams make better decisions;
• controls work outside the audit window;
• incidents are understood honestly, not hidden.

Those things do not always fit neatly into one number. They require judgment. They require conversations. They require leaders to look past the dashboard and ask what is happening underneath it.

Better measurement needs suspicion

I am not arguing against KPIs. Without metrics, organizations drift into opinions, politics, and vibes. Measurement matters.

But good measurement needs suspicion around it.

A useful KPI should provoke questions, not end the conversation. Why is this number moving? What changed in the process? What behavior are we encouraging? What are we not seeing? Does this still represent the outcome we care about, or has the team learned how to perform for the metric?

That last question is uncomfortable, but necessary.

A KPI can start as a fair signal and slowly decay. The business changes. People adapt. Tools improve. Reporting habits shift. The measure that once revealed the truth can become theater.

Leaders need to be willing to challenge green indicators. Especially green indicators. Red metrics usually get attention. Green ones create comfort, and comfort is where blind spots grow.

Use the metric, but do not worship it

The best use of a KPI is directional. It tells you where to look. It does not tell you the whole story.

If the number improves, ask what improved in the real world. If the number gets worse, ask whether the system became worse or more honest. If everyone looks perfect, ask what is being excluded from the measurement.

Goodhart's Law is not a reason to abandon measurement. It is a reason to stay humble about it.

A dashboard can help you manage.

It cannot replace attention.

And it definitely cannot replace judgment.