A privacy officer is designing a dashboard for continuous monitoring of the privacy program. Executive leadership has complained that the current metrics only reveal problems after they have already caused harm, such as the number of breaches reported and regulatory fines incurred. Leadership wants earlier visibility so corrective action can be taken proactively. Which metric would BEST address this concern?