Conformance scores measure how an operation performs when audited. Finding aging measures something rarely asked: how long problems have been allowed to persist. An operation can hold a 94% conformance score while a Critical finding sits unresolved for eight months - the score says "mostly compliant," the aging says "one known risk, unaddressed, every single day."
What aging actually measures
For every open corrective action, aging is the elapsed time since the audit captured the finding. Aggregated, it produces the numbers that matter: the median age of open findings, the count past 30/60/90 days, the oldest open item at each site, and - most telling - the trend of the count of "long-open" findings. A rising conformance score with a falling aging curve is the signature of a healthy program. A flat score with a rising aging curve is a program that audits well and fixes nothing.
Why it is invisible on paper
Paper programs cannot measure aging at all - the data lives in filing cabinets, if it was ever recorded. Spreadsheet tracking measures it painfully and inconsistently, because due dates live in emails and statuses live in memory. The metric only becomes real when findings, due dates, and statuses are structured data - which is to say, when corrective actions are first-class objects with owners, dates, and recorded transitions.
How to act on it
Route the metric where it drives behavior: the review dashboard shows the overdue list rank-ordered by severity and age; automatic reminders fire at 30 days on Major and above; escalation notifications at 60 for any item. Quarterly reviews compare sites on aging, not just on scores - the site with the worst backlog gets the support visit, not the blame call. Because closure is re-verified by audit rather than asserted, the aging curve reflects verified resolution, and the team knows the number is honest.
The compounding reward
Organizations that watch aging report a boomerang effect: as open findings drop, conformance scores rise and stabilize, because the same risks stop re-appearing in successive audits. The metric stops being an afterthought to the audit program and becomes its operating loop: find, fix, verify, and watch the age-to-closure curve flatten.
The conformance score tells you what the site looked like on audit day. Aging tells you what the site has been living with since. Both numbers belong in the same review.