Risk Management
Key Risk Indicator (KRI)
A Key Risk Indicator (KRI) is a metric that signals changes in risk levels, providing early warning of increasing risk exposure. KRIs are monitored continuously and have defined thresholds that trigger alerts and action when exceeded.
KRIs differ from Key Performance Indicators (KPIs) in that KRIs measure risk levels while KPIs measure performance. A well-designed KRI has: a clear link to a specific risk, a measurable data source, defined thresholds (green/amber/red), a designated owner, and a defined response when thresholds are breached. KRIs enable proactive risk management — identifying and addressing risks before they materialize into incidents. They are a core component of continuous monitoring.
Examples
- •Number of failed login attempts per hour (cyber KRI) — threshold: >100 = amber, >500 = red, triggering investigation.
- •Vendor performance score decline (third-party KRI) — threshold: score drops below 80% = amber, below 70% = red, triggering reassessment.
- •Open compliance findings past due date (compliance KRI) — threshold: >5 overdue = amber, >10 = red, triggering escalation.