A threshold is the value at which a metric stops being informational and starts requiring a response. Without one, a metric is a reading. With one, it is an instruction.
Most metrics work better with three bands than with a pass and fail line.
A normal band, where no action is required.
A review band, where the owner examines the cause and reports on it at the next cycle.
An escalation band, where a named person outside the immediate team is told, within a defined time.
The middle band is what stops threshold management from becoming a binary argument about whether the line was crossed.
In advance, with the owner of the value, before the first reading is taken under the new target.
This is the whole discipline. A threshold negotiated after a number goes red is not a threshold, it is a defence, and everyone in the room knows it.
Derive them from something rather than picking round numbers. An agreed protection level. A regulatory expectation. A documented risk appetite statement. The historical distribution of the metric, so the review band sits where genuine deviation begins rather than where normal variance already reaches.
That last point gets skipped often. A threshold set inside the metric’s ordinary range generates constant alerts, and within two quarters the review step is being skipped as routine.
Thresholds need a review cycle of their own, separate from the metric.
A band that has never been breached in two years is either evidence of a well-controlled process or evidence of a threshold set too loose to matter. Usually the second.
A band breached every period has stopped functioning as a signal. Either the process cannot meet it, in which case the target is wrong, or nobody is responding, in which case the escalation path is wrong.
From the blog