Compliance dashboards — the metrics that actually move risk.

Two dashboards, not one.

The dashboard most SAM teams ship to the executive team is the dashboard the SAM team would have wanted to see four years earlier in their own career — deep, granular, full of inventory counts and entitlement balances. The dashboard the executive team actually needs is a different artefact entirely. It shows exposure trending, remediation velocity, and spend convergence, and it stays under twelve numbers. Anything more is detail the audit committee will not read.

In our experience across 340+ engagements, the cleanest separation we have seen is a two-layer model: a Board-level Compliance Dashboard with twelve metrics and a quarterly cadence, and an Operating Dashboard with full granularity for the IT asset and procurement teams. The board dashboard rolls up from the operating dashboard, not the other way around. When the board dashboard does not summarise the operating dashboard it has no value; when the operating dashboard does not roll into the board dashboard it has no audience.

The twelve board-level metrics

Across the boards we have briefed on software compliance posture, twelve metrics consistently land. The remainder produce questions that distract from the strategic conversation.

1. Open audit exposure ($). Sum of vendor-claimed amounts on active audits, net of provisional reserve.
2. Estimated unmitigated exposure ($). Internal estimate of gap-to-entitlement before any vendor letter has arrived.
3. Renewals at risk (count, $). Number of contracts renewing in next 12 months where reconciliation has not been completed.
4. License waste ($). Entitlement purchased but not assigned or deployed — a recoverable cost line.
5. Compliance debt trend. Quarter-on-quarter movement of total estimated gap. The slope matters more than the level.
6. Remediation velocity. Audit findings closed per quarter vs. average claim age. Slow closure inflates settlement cost.
7. Vendor risk concentration. Top-three vendor share of total exposure. Concentration over 60% requires explicit governance attention.
8. SAM coverage ratio. Vendors with active reconciliation as % of spend. Target above 85% for top spend.
9. Average days to entitlement review. Time from PO to entitlement registered in SAM tool. Above 30 days indicates governance break.
10. Cloud commitment burn. Actual consumption vs. committed spend on AWS, Azure, GCP and equivalent SaaS commits.
11. Shelfware ($). Entitlements without assignment for >90 days. Recurrent shelfware is a renewal-leverage indicator.
12. Audit settlement multiple. Final settlement as multiple of initial claim. Below 0.4 is strong; above 0.7 indicates weak defence posture.

What the SAM team lives in daily.

The operating dashboard exists for the IT asset, procurement and finance teams who own day-to-day exposure. Its purpose is to surface drift the moment it starts, not to summarise the year. Operating dashboards we have seen work tend to converge on three views: entitlement health, deployment drift, and contract motion.

Entitlement health

Per vendor, per SKU: entitled volume, assigned volume, deployed volume, gap. Refreshed weekly from the vendor portal and the deployment scanner. The trap is in not normalising the metric — Microsoft Office 365 E3 "assigned" in the tenant is not the same as "entitled" under the EA; assigned counts include trial assignments, M&A migrations and dormant users. The dashboard should compute the contractual position, not the vendor-portal position.

Deployment drift

Configuration changes that move workloads across licence boundaries: SQL Server edition upgrades, Oracle option enablement, Adobe deployment-package switches, Salesforce feature licence assignment. The dashboard surfaces these as alerts, not as steady-state metrics. The right cadence is daily for high-risk vendors (Oracle, Microsoft SQL) and weekly for others. Feeding those alerts into an ongoing software license optimization programme turns the dashboard from a monitoring tool into a cost-recovery one.

Contract motion

Renewal calendar, true-up windows, audit anniversaries, support repricing windows, ULA certifications. A live contract calendar that surfaces obligations 180 days out converts compliance work from reactive to scheduled. The single most damaging metric we see on operating dashboards is "renewals discovered with <60 days notice" — it should be zero.

Where Fortune 500 actually sits.

Benchmarks are useful only against comparable estates, but the patterns are consistent enough to be worth naming. Across the Fortune 500 engagements we have visibility into, the typical posture sits roughly in the following ranges. Outliers in either direction warrant investigation.

• Audit settlement multiple: median 0.45, top quartile 0.30, bottom quartile 0.75. Reveal Compliance engagements average 0.32.
• Shelfware as % of vendor spend: median 18%, top quartile 8%, bottom quartile 30%. License Optimization engagements recover 22% on average.
• SAM coverage of top-10 vendors: median 70%, top quartile 92%, bottom quartile 45%.
• Time from PO to entitlement registration: median 45 days, top quartile 14 days, bottom quartile 90+ days.
• Renewal preparation lead time: median 90 days, top quartile 180 days, bottom quartile 30 days. The bottom quartile pays approximately 25% more on renewal.
• Vendor risk concentration (top-3): median 55%, often dominated by Oracle, Microsoft, SAP. Concentration above 70% should be explicitly governed.

Building the dashboard without buying another tool.

The most common failure mode in compliance reporting is the procurement of an additional tool that promises a board-ready dashboard. The dashboards we have seen survive a CIO transition are built on top of whatever SAM tooling and BI platform the company already runs. They are built from three layers.

First, a normalised entitlement layer — typically a small data warehouse table per vendor, populated from the Ordering Documents. Second, a deployment layer — the existing SAM tool, ITSM or AAD/HRIS feed. Third, a presentation layer — Power BI, Tableau, Looker, whatever the company uses for finance reporting. The work is the entitlement layer, because it cannot be vendor-generated. Build it once, version-control the inputs, and the rest follows.

Refresh cadence

Board dashboard: quarterly, locked at quarter-close. Operating dashboard: weekly for entitlement health, daily for deployment-drift alerts, real-time for contract-motion alerts. Avoid refreshing the board dashboard outside the quarterly cycle — mid-quarter changes tend to be noise and erode the dashboard's credibility.