An IS auditor reviews the monthly IT performance dashboard presented to executive management. Every metric reported (e.g., number of security incidents last month, prior-month system downtime, tickets closed) describes outcomes that have already occurred. Management complains that the dashboard tells them what went wrong but never helps them prevent problems. What should the auditor recommend to BEST address this concern?