Computer science 150 to 200 words

In order to have a successful IG program, one of the eight (8) Information Risk Planning and Management step is to develop metrics and measure results. Why are metrics required?  Briefly provide your explanation

need references as well