Key Risk Indicators (KRI) Development

Key Risk Indicators (KRIs)

What are KRIs?

Key Risk Indicators are metrics that provide early warning of increasing risk exposure. Unlike Key Performance Indicators (KPIs) that measure past performance, KRIs are forward-looking and predictive.

Characteristics of Effective KRIs

1. Predictive

Provide advance warning before risk materializes

2. Measurable

Quantifiable with reliable data

3. Timely

Updated frequently enough for early action

4. Relevant

Linked to material risks

5. Actionable

Clear thresholds trigger defined responses

Types of KRIs

Leading Indicators

Predict future risk events:

• Employee turnover rate
• System capacity utilization
• Regulatory inquiry volume
• Vendor performance scores

Lagging Indicators

Confirm realized risks:

• Incident counts
• Loss amounts
• Audit findings
• Compliance breaches

Current Indicators

Real-time risk exposure:

• Current risk limits utilization
• Control failures today
• Open vulnerabilities

Development Process

Step 1: Link to Key Risks

Start with material risks from risk register

Step 2: Identify Risk Drivers

What factors influence risk likelihood/impact?

Step 3: Select Metrics

What can be measured that relates to drivers?

Step 4: Set Thresholds

| Level | Definition | Action | |-------|------------|--------| | Green | Normal | Continue monitoring | | Amber | Elevated | Increase monitoring, prepare response | | Red | Critical | Immediate escalation and action |

Step 5: Define Data Sources

• System-generated
• Manual collection
• External sources

Step 6: Establish Reporting

• Dashboard display
• Report frequency
• Escalation protocol

Example KRIs by Risk Type

Operational Risk

• Employee overtime hours
• System downtime minutes
• Process exception rates
• Training completion rates

Cyber Risk

• Phishing test failure rate
• Patch compliance percentage
• Privileged account activity
• External vulnerability count

Credit Risk

• Delinquency rates
• Watch list additions
• Concentration metrics
• Covenant compliance

Compliance Risk

• Regulatory inquiry volume
• Policy exception requests
• Training delinquency
• Complaints received

KRI Dashboard Best Practices

• Traffic light visualization
• Trend arrows
• Threshold lines
• Drill-down capability
• Exception-based alerting