Skip to content

Events Beat Reports: Why a Process You Only See in Reporting Is Already Out of Control

Events Beat Reports: Why a Process You Only See in Reporting Is Already Out of Control

A sales manager opens Monday's report and sees forty proposals sent last week, nine replies. The number is bad. What to do about it on Monday is unclear: thirty-one opportunities have already passed, and none of them can be revisited as if nothing happened.

The same process, built on events, behaves differently. An email left unopened for three days triggers a notification on day three, not on Monday. The difference isn't better analytics — it's that action is still possible.

In short

A report answers "what happened"; an event answers "what to do now". Report-driven management only works where the cost of delay is close to zero; in every other process, the time between a deviation occurring and its appearance in a report is long enough that the deviation stops being fixable. Moving a process onto events doesn't require an analytics platform — it requires deciding which facts count as events and who is obligated to act on them.

14 daysmedian dwell time before an attacker's presence in a system is discovered
9 vs. 25days to detection: internal tooling vs. an external tip-off
47%of executives made decisions on outdated data

Event-Driven Management vs. Metrics: The Real Difference

The distinction is practical, not terminological. A metric is an aggregate over a period — it has a value and no addressee. An event is a timestamped fact — it has an addressee and a prescribed action. The same observation can turn into either one, but only the second one manages anything.

An event has a time; a metric has a period. "This email hasn't been opened in three days" points to a specific document and a specific date. "Open rate: 62%" doesn't point to anything actionable.

An event has an addressee. It reaches the person who can act, not a report read by someone who can't. That difference decides a process's fate more than measurement accuracy does.

An event has a prescribed action. Not "pay attention" but "recheck the delivery channel" or "call the client". If the action isn't named in advance, the event turns into a notification, and notifications stop getting read by week two.

An event also captures absence. The most underrated class: "no reply received", "document not assembled", "field left blank". Absence doesn't generate a record on its own, so it has to be generated deliberately — and that's usually where manageability is lost.

ObservationAs a metricAs an event
Client didn't open the emailWeekly open rateDay three — notification to the manager, action: check the channel
Request not picked upAverage response timeAfter two hours — escalation to the team lead
Document assembled off-templateMonthly deviation rateAt assembly — sending blocked
Estimate exceeded by a thirdQuarterly project overrunOn hitting the threshold — mandatory conversation with the client

The third column requires nothing beyond a decision about what counts as an event and who acts on it. None of these four rows needs an analytics platform — all four run on the system the company already has.

The Gap Between a Fact and Its Discovery

The gap between an event and its appearance in a report has been measured in the field that spends the most effort on speed of detection — cybersecurity. If it takes weeks even there, an ordinary business process is no faster.

Study

The median dwell time of an undetected attacker in a system was 14 days in 2025, up from 11 days a year earlier. When discovered internally, the median is about 9 days; when notified by an external party, about 25 days.

Mandiant (Google Cloud), "M-Trends 2026", Executive Edition, March 2026. Metrics are built on targeted-attack investigations Mandiant Consulting conducted from January 1 to December 31, 2025, over 500,000 hours of incident-response work · services.google.com (PDF)

The caveat matters: the sample is companies that engaged external consulting after an incident — skewed toward more serious cases — and the exact number of investigations behind the median isn't disclosed. This isn't a direct proxy for management reporting either. But the 9-versus-25-day split shows exactly what's needed: the method of detection changes the timeline threefold, while the underlying fact stays the same.

A report tells you that you're late. An event tells you it's not too late yet.

What Report-Driven Management Actually Costs You

The cost of lag isn't abstract: decisions keep getting made, just on outdated data.

Study

47% of surveyed executives admitted that, in the past 12 months, they made a business-critical decision based on inaccurate, incomplete, or outdated financial data.

The Harris Poll on behalf of OneStream, May 2026. Online survey of 352 executives (CFOs, controllers, CTOs, CIOs, chief data officers) in the US, UK, and France; fieldwork March 16–19, 2026 · onestream.com

Caveat: this is a self-reported survey commissioned by a financial-software vendor — the commercial interest in showing the problem as acute is obvious, and the sample is limited to the finance function in three countries. What's useful here isn't the precision of the percentage but the admission itself: nearly half of executives know the data behind their decisions was stale, and made the decision anyway.

The classic example of cost of delay is how a company reacts to an inbound inquiry. Companies that contacted a lead within an hour were nearly seven times more likely to turn the contact into a qualified conversation than those who responded an hour later, and more than sixty times more likely than those who responded a day later; the average response time was 42 hours. I cover this study and its method in detail in the article on where the automation effect actually comes from; the point here is simple: a weekly report on a process like this physically cannot manage it, because its cycle is longer than the process's own cycle.

Moving a Process to Event-Driven Management in Three Decisions

The work takes a few hours and comes down to three decisions. None of them is technical.

Three decisions that turn an observation into a manageable event. Skip any one of the three and you get a notification that stops getting read.
01Which fact counts as an event, and at what threshold
02Who's the addressee, and what are they required to do
03What happens if the action doesn't get done
04Report: share of events closed on time
reporting is built on top of events, not instead of them: it measures execution, not a substitute for response

The first decision is harder than it looks, because it requires naming a threshold. "Taking too long to respond" isn't an event. "Hasn't opened the email in three days" is. The threshold isn't chosen for precision — it's chosen from practice: it has to be shorter than the time in which the situation can still be changed.

The third decision separates a working scheme from a decorative one. If a missed action produces nothing, the event fades into the background within a month. Escalation doesn't have to be harsh — it just has to make the failure to act visible.

The fourth node explains why reporting still belongs in an event-driven scheme. It doesn't disappear, but its subject changes: instead of "what happened in the process", it measures "how well we handled the events". It's the only report you can actually manage with a weekly cycle.

When a Weekly Report Is Still the Right Tool

An event-driven scheme isn't free: every event needs an addressee and their time. Some processes are objectively better served by a report, and naming them keeps you from building events everywhere.

A report is the better tool where the cost of delay is close to zero: seasonal analytics, channel-performance evaluation, quarterly planning. It's also better where what matters isn't a single record but a trend: one deviation means nothing here, ten in a row mean something. And it's indispensable for decisions about changing the process itself — those can't be made off a single case.

The usual mistake runs the other way: there's no event layer at all, and a report is asked to manage day-to-day operational work. The tell is a recurring line in status meetings: "why are we only finding out about this now".

Four Steps You Can Finish in a Day

01

Write down the three questions that come up in every status meeting

Those are usually exactly the missing events: "why didn't the client reply", "why is the request still sitting there", "why is the amount different".

02

Set a threshold for each one

A number of hours or days after which the fact becomes an event. The threshold has to be shorter than the time in which the situation can still be changed.

03

Name the addressee and the action

One person, one prescribed action per event. Two addressees means neither one responds.

04

Measure the share closed on time

That's the new report. If the share is below half, the threshold is wrong or the addressee is overloaded.

If "why are we only finding out about this now" comes up twice a month in status meetings, the process has no event layer, and no amount of analytics will substitute for one.

Questions About Moving From Reports to Events

How is event-driven process management different from a dashboard?

A dashboard shows status to whoever opens it; an event reaches the person who has to act, and it carries a prescribed action. A dashboard answers "how are things going", an event answers "what to do now". A dashboard nobody opens for three days straight is no different from not having one; an event nobody closes stays visible and triggers escalation.

How do you know a process needs events instead of reporting?

By the cost of delay. If less time passes between a deviation occurring and the point where it can still be fixed than the report's own period, a report cannot manage that process. The practical tell: "why are we only finding out about this now" comes up regularly in status meetings — that's a direct sign of a missing event.

How many events should a process have?

In my experience, three to five per process. More than that and the addressee stops distinguishing between them — notification fatigue sets in and events lose their force. If it feels like you need ten, some of them probably shouldn't be events at all but constraints: something that can't be done wrong doesn't need a notification.

Do events require a separate system?

No. All four examples in the table run on an ordinary CRM or task-tracking system, functioning as the company's system of record: a rule, a time threshold, a notification to the owner, and a record of the fact. Dedicated observability platforms are for processes generating thousands of events a day; for a process with a few dozen, a platform just adds one more place nobody checks.

Where the internal figures come from

The event examples (a notification about an unopened email on day three, triggered follow-up emails, blocking the send of an incomplete document, per-manager statistics) come from the product description of Alego.Digital's own product — a proposal generator — and from the client-interaction protocol from the same period. These are the author's company's internal materials; they haven't been independently verified and are given as an illustration of the mechanics. The "three to five events per process" benchmark is the author's estimate from implementation practice, not a measured figure.

External sources
  1. Mandiant (Google Cloud). M-Trends 2026, Executive Edition, March 2026. services.google.com
  2. The Harris Poll for OneStream. Companies Are Scaling AI on Data They Don't Trust, May 2026 (survey of 352 executives, March 2026). onestream.com
  3. Oldroyd J. B., McElheran K., Elkington D. The Short Life of Online Sales Leads. Harvard Business Review, March 2011. hbr.org