What Is a Key Risk Indicator?
A Key Risk Indicator (KRI) is a metric that provides early warning of changes in risk levels, enabling proactive risk management before risks materialize into incidents. KRIs are a core component of continuous monitoring and are essential for maintaining real-time visibility into the organization's risk posture.
What Makes a Good KRI
An effective KRI is: measurable (has a clear data source), relevant (linked to a specific risk), predictive (provides early warning before the risk materializes), actionable (triggers a defined response when thresholds are breached), and timely (data is available frequently enough to be useful). KRIs should have defined thresholds (green/amber/red) and designated owners who are accountable for monitoring and response.
KRIs vs. KPIs
KPIs (Key Performance Indicators) measure performance against targets — they ask 'How well are we doing?' KRIs measure risk levels — they ask 'What is our risk exposure?' A KPI might be '95% on-time delivery' while the corresponding KRI might be 'number of late deliveries per month.' Both are needed, and they complement each other — declining KPIs often signal increasing KRIs.
KRI Thresholds and Responses
Each KRI should have defined thresholds that trigger specific responses: green (within appetite — continue monitoring), amber (approaching limit — increase monitoring, investigate causes), red (exceeds limit — escalate, investigate, and take corrective action). The response should be predefined so action is taken immediately when a threshold is breached, not after a committee meeting.
How MPG Supports KRI Management
MPG provides KRI definition with configurable thresholds, automated data collection, real-time monitoring, threshold-based alerts, and escalation workflows. KRIs are connected to the risk register, so when a KRI breaches its threshold, the linked risk is automatically flagged for review. KRI trends are displayed on dashboards for management and board reporting.
Key Takeaways
- KRIs provide early warning of changing risk levels, enabling proactive management
- Effective KRIs are measurable, relevant, predictive, actionable, and timely
- KRIs measure risk; KPIs measure performance — both are needed
- Each KRI needs defined thresholds (green/amber/red) and predefined responses
Frequently Asked Questions
How many KRIs should an organization have?
There's no fixed number, but typically 15-30 KRIs covering all material risk categories. Too few KRIs miss important signals; too many create alert fatigue. Focus on KRIs that are truly predictive and actionable. MPG helps prioritize KRIs by linking them to the most significant risks in your register.
What data sources are used for KRIs?
KRI data can come from internal systems (incident logs, audit findings, assessment results, performance metrics) and external sources (security ratings, financial databases, news feeds, regulatory alerts). MPG integrates data from across its modules to provide comprehensive KRI monitoring.