SLA compliance looks inflated when it is computed only from closed findings, because the slowest items are still open and therefore absent. A fair calculation includes open items that have passed their deadline as breaches, and reports them separately from closed ones.
The survivorship problem
Suppose a team closes most findings within target but leaves a few hard ones open for months. Compute compliance as closed on time over closed total and the open stragglers never count. The more neglected an item, the less it affects the figure. That is the opposite of what a metric about timeliness should do.
A fair definition
Take every finding whose deadline fell inside the reporting period. Classify each one:
| Outcome | Counts as |
|---|---|
| Closed before deadline | Met |
| Closed after deadline | Missed |
| Still open and past deadline | Missed |
| Still open and before deadline | Excluded for now, included next period |
| Properly paused or exempted | Excluded, with reason shown |
Compliance is met over met plus missed. The deadline cohort approach also makes the figure stable, because each finding is evaluated once, when its deadline passes.
Deadlines need definitions
Set the deadline from a start event and a severity based target. See when the remediation clock starts for the start event choices. Record the deadline on the finding when it is created, so later policy changes do not rewrite history unnoticed.
Pauses and exemptions
Clocks can legitimately pause, for example while waiting for an upstream fix to be published. Allow it, but require a reason, an owner and a review date. Report the count of paused items and their age. A large paused group with old dates is a hidden breach pile.
Companion numbers
Compliance alone is not enough. Add:
- The count of open findings past deadline, by age band.
- The oldest overdue item and its owner.
- The share of findings paused or exempted.
- The distribution of time to close, not just the rate.
How teams game it
Watch for severity being lowered to a longer deadline category, findings being closed and reopened to reset clocks, and exceptions used as a routine step. A reopen rate and a severity change log reveal these patterns. The point is not to accuse anyone, since most of these happen through unclear rules rather than intent. Clear rules and visible exceptions fix most of it.
Audit step
Recompute last quarter's compliance twice: once with closed items only, and once with the cohort rule. The gap between the two is a direct measure of how much the simple method flattered the result.
Safeguard does this kind of counting in one place: SBOM and dependency scanning, asset discovery and reachability analysis feed the same inventory, so each number can be traced back to its source. Policies carry the deadlines and exception rules, so the cohort rule can be applied the same way for every team. You can try a free scan at gold.safeguard.sh/scan.
Quick check
Why include open items?
Because late findings that never close are exactly the ones a timeliness metric should expose.
Can a clock ever pause?
Yes, with a recorded reason, owner and review date. Report paused items so they do not become a hidden backlog.
Last reviewed: 19 October 2026.
