Key Risk Indicator Examples: KRI Tables by Risk Type, With Thresholds and Owners

A key risk indicator (KRI) is a metric that moves before a risk crystallises, read against thresholds that say when someone has to act. A usable one has five parts: the metric, its green, amber and red thresholds, the system it comes from, the person who answers for it, and how often it refreshes. An indicator missing any of the five is a dashboard decoration. This page is a reference library of KRI examples built on that pattern: thirteen tables covering credit, liquidity, interest rate, market, operational, technology and cyber, fraud and financial crime, compliance and conduct, people and culture, third-party, reputation and ESG, and model risk, each with illustrative thresholds to calibrate, followed by a breadth list across sixteen risk categories, a guide to setting thresholds, the tests internal audit applies to a KRI program, and a worked audit at an illustrative nine-billion-dollar bank.

It absorbs the former guide to non-financial risk indicators (people, culture, conduct, third parties, reputation and ESG now have tables of their own) and pairs with the KRI program design guide, which covers selection, governance and escalation. The thresholds are starting points drawn from banking and corporate practice, not standards; the calibration section explains how to set your own.

In this guide

• What makes a KRI usable: the five fields and the KPI distinction
• Credit risk KRIs
• Liquidity risk KRIs
• Interest rate risk KRIs
• Market risk KRIs
• Operational risk KRIs
• Technology and cyber risk KRIs
• Fraud and financial crime KRIs
• Compliance and conduct risk KRIs
• People and culture KRIs
• Third-party and supply chain KRIs
• Reputation, ESG and climate KRIs
• Model and data risk KRIs
• The breadth list: indicators by risk category
• Setting thresholds: five calibration methods
• How internal audit tests a KRI program
• Worked example: Lakeshore Bancorp’s KRI library audit
• Frequently asked questions
• Related guides

What makes a KRI usable: the five fields and the KPI distinction

The discipline behind every table below comes from COSO’s enterprise risk management framework and the guidance on developing key risk indicators that COSO published with the North Carolina State University ERM Initiative: a good indicator is leading rather than lagging where a leading measure exists, traces to a root cause of the risk rather than to its consequence, and connects to a stated risk appetite, which is what the threshold columns force the owner to write down. Three related terms are run together in most risk reports, and the first thing an auditor does with a KRI inventory is sort them.

Term	What it measures	Example	Who uses it
Key performance indicator (KPI)	Achievement of an objective, after the fact	Loan growth 8 per cent against a 10 per cent plan	Management, for performance
Key risk indicator (KRI)	The build-up of exposure to a risk, ahead of the loss	Policy exceptions on new originations at 9 per cent of approvals	Risk committees, for early warning
Key control indicator (KCI)	Whether a control is operating	Reconciliations completed within three days: 94 per cent	Control owners and the second line
Loss or event metric	What already happened	Operational losses year to date	Capital and lessons learned; lagging by definition

A KRI library has a recognisable shape when it works. Each indicator carries the five fields; thresholds are tied to appetite statements and regulatory floors; the source system is named so the number can be reproduced; the owner is a person, not a department; and the refresh cadence matches how fast the risk moves (daily for liquidity, quarterly for culture). The risk register guide shows where the indicators attach to risks, and the auditing ERM guide covers the program they sit inside.

Credit risk KRIs

Credit indicators are the most mature family because the data is transactional and the regulatory floors are explicit. The pattern to watch is migration: early delinquency and watchlist downgrades move a year or more before charge-offs, and policy exceptions on new business move before either. The credit risk guide covers the measurement behind each row.

Indicator	Green	Amber	Red	Source system	Owner · refresh
Non-performing loans to total loans	Below 1.5%	1.5–3%	Above 3%	Loan servicing system	Chief credit officer · monthly
30–89 day past-due ratio (early delinquency)	Below 1%	1–2%	Above 2%	Loan servicing system	Portfolio manager · monthly
Net watchlist migration (downgrades less upgrades) in the quarter	Below 2% of the rated book	2–5%	Above 5%	Credit MIS	Head of credit risk · quarterly
Policy exceptions on new originations	Below 5% of approvals	5–10%	Above 10%	Loan origination system	Credit administration · monthly
Top-20 borrower exposure to Tier 1 capital	Below 80%	80–120%	Above 120%	Credit data warehouse	Chief risk officer · quarterly
Commercial real estate loans to total capital (supervisory screen 300%)	Below 250%	250–300%	Above 300%	Credit data warehouse	Chief credit officer · quarterly
Allowance coverage of non-performing loans	Above 120%	80–120%	Below 80%	Allowance model	Controller · quarterly
Annual reviews overdue on exposures above the review threshold	0	1–5% of required reviews	Above 5%	Credit workflow system	Credit administration · monthly

Liquidity risk KRIs

Liquidity indicators have to refresh faster than any other family: the 2023 bank failures showed deposits leaving at a pace measured in hours, which is why the deposit-mix rows below are daily or weekly and why survival horizon sits beside the regulatory ratios. The liquidity risk guide explains each metric, the stress testing guide the horizon measures, and the liquidity audit program the tests.

Indicator	Green	Amber	Red	Source system	Owner · refresh
Liquidity coverage ratio (regulatory floor 100% where it applies)	Above 115%	100–115%	Below 100%	Treasury or ALM system	Treasurer · daily
Net stable funding ratio	Above 110%	100–110%	Below 100%	ALM system	Treasurer · monthly
Survival horizon under the combined stress scenario	Above 90 days	30–90 days	Below 30 days	Liquidity stress model	ALCO · weekly
Uninsured deposits to total deposits	Below 30%	30–50%	Above 50%	Core banking	Treasurer · weekly
Top-10 depositor concentration	Below 10% of deposits	10–20%	Above 20%	Core banking	Treasury · monthly
Wholesale and brokered funding to total funding	Below 15%	15–25%	Above 25%	ALM system	Treasurer · monthly
Unencumbered high-quality liquid assets to 30-day stress outflows	Above 125%	100–125%	Below 100%	Treasury system	ALCO · weekly
Contingency funding capacity drawn (discount window, FHLB, repo)	0%	Below 10%	10% or more	Treasury system	ALCO · monthly
Collateral pledged and tested at the discount window and FHLB in the last quarter	Tested, capacity confirmed	Pledged, untested	Not pledged	Collateral management	Treasurer · quarterly

Interest rate risk KRIs

Interest rate risk indicators should cover both lenses (economic value and earnings), the assumptions that drive them, and the governance around limit breaches. The weakest programs report NII sensitivity only, which is the pattern the Federal Reserve’s review of Silicon Valley Bank described. The interest rate risk guide covers the measures, the Basel 2024 recalibration and the supervisory outlier tests behind the first two rows.

Indicator	Green	Amber	Red	Source system	Owner · refresh
EVE sensitivity in the worst of the six standard shocks, as a share of Tier 1 (EU outlier threshold 15%)	Below 10%	10–15%	Above 15%	ALM model	ALCO · monthly
NII sensitivity, 12 months, parallel 200bp shock, as a share of projected NII	Below 8%	8–12%	Above 12%	ALM model	ALCO · monthly
Limit utilisation across all board IRR limits	Below 75%	75–100%	Any breach	ALM model and limit log	Treasurer · monthly
Breaches outstanding past the policy cure period	0	1	2 or more	Limit log	ALCO · monthly
Realised deposit beta versus modelled beta, trailing 12 months	Within 5 points	5–10 points	Above 10 points	Deposit study and ALM model	ALM manager · quarterly
Key assumption changes since the last board approval (betas, decay, prepayment)	None without approval	Approved, backtested within 90 days	Unapproved or unbacktested	Model change log	ALM manager · quarterly
Unrealised losses on securities to tangible common equity	Below 15%	15–30%	Above 30%	Investment accounting	CFO · monthly
Model validation findings open on the ALM model	0 high	1 high with a dated plan	Any high past its date	Model inventory	Model risk management · quarterly

Market risk KRIs

Market risk indicators exist for institutions with trading books, investment portfolios or hedging programs. The rows combine limit utilisation, model performance (backtesting) and the valuation controls that caught or missed the losses in the market risk guide‘s history table.

Indicator	Green	Amber	Red	Source system	Owner · refresh
Value-at-risk utilisation against the board limit	Below 70%	70–100%	Any breach	Risk engine	Head of market risk · daily
VaR backtesting exceptions in the trailing 250 days (Basel green zone up to 4)	0–4	5–9	10 or more	Risk engine	Head of market risk · monthly
Stress loss under the worst approved scenario to Tier 1	Below 5%	5–10%	Above 10%	Stress testing system	Risk committee · monthly
Desk limit breaches and time to resolution	0 open	Open, within 1 day	Open beyond 1 day	Limit monitoring	Head of market risk · daily
Independent price verification variances above tolerance, unresolved	0	1–5 positions	Above 5 or any Level 3 unresolved	IPV system	Product control · monthly
Stale prices in the end-of-day valuation (no price update within policy)	Below 0.5% of positions	0.5–2%	Above 2%	Valuation system	Product control · daily
Unexplained P&L (actual less risk-based) above threshold	0 days in the month	1–2 days	3 or more	P&L attribution	Product control · daily
Hedge effectiveness tests failed (hedge accounting programs)	0	1	2 or more	Hedge accounting system	Treasurer · quarterly

Operational risk KRIs

Operational risk indicators are the broadest family and the easiest to overbuild. The rows below are the ones that predict losses in most institutions: ageing reconciliation items, processing errors, change failures, resilience test results and the backlog of audit and regulatory issues. The RCSA guide shows how the indicators tie to the self-assessment.

Indicator	Green	Amber	Red	Source system	Owner · refresh
Operational losses year to date against the annual loss budget, pace	Below 50%	50–100%	Above 100%	Loss event system	Head of operational risk · monthly
Unreconciled items aged over 30 days, by value	None material	Non-material aged items	Material items aged	Reconciliation tool	Controller · monthly
Processing error rate in high-volume operations (payments, servicing)	Below 0.1%	0.1–0.3%	Above 0.3%	Quality control sampling	Operations head · monthly
Failed or rolled-back changes to production	Below 3% of changes	3–7%	Above 7%	Change management system	CIO · monthly
Critical system availability	99.9% or above	99.5–99.9%	Below 99.5%	ITSM and monitoring	CIO · monthly
Business services with recovery tests overdue	0	1–2	3 or more, or any critical service	Resilience program	COO · quarterly
Overdue high-risk audit issues	0	1–2	3 or more	Issue tracking system	Chief audit executive · monthly
Regulatory findings (MRAs and equivalents) past their committed date	0	1	2 or more	Regulatory issue log	Chief risk officer · monthly
Near-miss events reported against losses (a reporting-culture measure)	Above 3 to 1	1 to 3 to 1	Below 1 to 1	Loss event system	Head of operational risk · quarterly

Technology and cyber risk KRIs

Cyber indicators are leading where they measure exposure (unpatched critical vulnerabilities, privileged access without multi-factor authentication) and lagging where they count incidents. Both are needed; the mistake is to report only the incident count, which is low until the week it is not.

Indicator	Green	Amber	Red	Source system	Owner · refresh
Critical vulnerabilities open past the remediation SLA (15 days is common)	0	1–10	Above 10, or any internet-facing	Vulnerability scanner	CISO · weekly
Privileged accounts without multi-factor authentication	0	Any with a dated remediation plan	Any without a plan	Identity and access management	CISO · monthly
Phishing simulation failure rate	Below 5%	5–10%	Above 10%	Security awareness platform	CISO · quarterly
Mean time to detect security incidents	Below 24 hours	24–72 hours	Above 72 hours	SIEM	SOC manager · quarterly
End-of-life systems in production	0	Isolated, with compensating controls	Any internet-facing	Configuration management database	CIO · quarterly
User access reviews overdue for critical applications	0	1–2 applications	3 or more	IAM or GRC system	Application owners · quarterly
Backup restoration tests failed or overdue for critical systems	0	1	2 or more	Backup system	CIO · quarterly
Third parties with access to production data lacking a current security assessment	0	1–3	Above 3	Vendor risk system	CISO · quarterly

Fraud and financial crime KRIs

Fraud and anti-money-laundering indicators measure three things: losses against appetite, the backlog in detection (alerts unworked, due diligence overdue) and the integrity of the reporting channel. The fraud risk management guide and the BSA/AML testing guide cover the programs behind the rows.

Indicator	Green	Amber	Red	Source system	Owner · refresh
Confirmed fraud losses year to date against the loss appetite, pace	Below 50%	50–100%	Above 100%	Fraud case system	Head of fraud · monthly
Fraud alerts unworked beyond 5 days	Below 2% of alerts	2–5%	Above 5%	Transaction monitoring	Fraud operations · weekly
Card and payment chargeback rate	Below 0.5%	0.5–0.9%	Above 0.9%	Payments platform	Payments risk · monthly
AML alert backlog beyond the investigation SLA	0	Below 5% of open alerts	5% or more	AML monitoring system	BSA officer · weekly
Suspicious activity reports filed late	0	1–2 in the quarter	3 or more	Case management system	BSA officer · quarterly
High-risk customers with overdue enhanced due diligence	0	Below 2%	2% or more	Customer due diligence system	BSA officer · monthly
Sanctions screening list updates applied late	0	1	2 or more	Screening system	Sanctions officer · monthly
Whistleblower investigations open beyond 60 days	0	1–2	3 or more	Case management system	General counsel or ethics officer · quarterly

Compliance and conduct risk KRIs

Compliance indicators should show the level of the risk, not the activity of the function: training completion is an input, the share of issues found by examiners rather than by the program is an outcome. Conduct indicators look for the incentives and behaviours that precede customer harm. The compliance risk guide and the conduct risk guide develop both.

Indicator	Green	Amber	Red	Source system	Owner · refresh
High residual risk cells in the compliance risk assessment with overdue action plans	0	1–2	3 or more	Compliance risk assessment	Chief compliance officer · quarterly
Share of compliance issues identified by examiners or auditors rather than by the program	Below 15%	15–30%	Above 30%	Issue log	Chief compliance officer · quarterly
Regulatory changes past their effective date without validated implementation	0	1	2 or more	Regulatory change log	Compliance · monthly
Complaints per 1,000 accounts, by product, with allegation categories	Within product baseline	Up 25% on baseline	Up 50% or any discrimination allegation untriaged	Complaint system	Compliance · monthly
Repeat compliance issues (same root cause as a closed issue)	0	1	2 or more	Issue log	Chief compliance officer · quarterly
Sales incentive clawbacks and cancelled-within-30-days products as a share of sales	Below 2%	2–5%	Above 5%	Sales and incentive systems	Head of conduct risk · monthly
Employees in high-risk roles below the comprehension threshold on role-based training	Below 5%	5–10%	Above 10%	Learning system	Compliance · quarterly
Open regulatory matters with a missed milestone	0	1	2 or more	Regulatory issue log	Chief risk officer · monthly

People and culture KRIs

People indicators are the non-financial family most often missing from risk reports, and the one that explains many operational and conduct losses after the fact: turnover in a control function, a hotline that goes quiet, investigations that do not close. The organizational behavior topical requirement sets what the Standards now expect internal audit to assess in this area.

Indicator	Green	Amber	Red	Source system	Owner · refresh
Turnover in critical control roles (finance, risk, compliance, information security), rolling 12 months	Below 10%	10–20%	Above 20%	HR information system	Chief people officer · quarterly
Vacancies in control functions open beyond 90 days	0	1–2	3 or more	HR information system	Chief people officer · monthly
Engagement survey score in control functions versus the enterprise	At or above enterprise	Up to 5 points below	More than 5 points below	Survey platform	Chief people officer · annual or pulse
Ethics hotline reports per 100 employees (very low and very high both warrant attention)	Within 0.5–2	Below 0.5 or 2–3	Below 0.2 or above 3	Hotline system	Ethics officer · quarterly
Substantiation rate of hotline reports	15–40%	Below 15% or above 40%	Below 5% or above 60%	Case management system	Ethics officer · quarterly
Investigations open beyond 60 days	0	1–2	3 or more	Case management system	General counsel · monthly
Retaliation complaints following a report	0	1	2 or more	Case management system	General counsel · quarterly
Exit interviews citing pressure to bypass controls or ethical concerns	0	1–2 in the quarter	3 or more, or any in a control function	HR information system	Chief people officer · quarterly
Mandatory training overdue in high-risk roles	0	Below 5%	5% or more	Learning system	Compliance · monthly

Third-party and supply chain KRIs

Third-party indicators track the risk that an outsourced or supplied service fails, and the gap between the inventory and the oversight. The third-party risk management guide and the Third-Party Topical Requirement cover the program; the rows below are the ones that move first.

Indicator	Green	Amber	Red	Source system	Owner · refresh
Critical third parties without a current risk assessment	0	1–2	3 or more	Vendor risk system	Head of third-party risk · quarterly
Critical third parties with SLA breaches in the quarter	Below 5%	5–15%	Above 15%	Contract management	Business owners · quarterly
Critical services dependent on a single supplier with no tested exit plan	0	1–2	3 or more	Vendor inventory	COO · annual
Fourth parties identified for critical services	100% identified	80–99%	Below 80%	Vendor risk system	Head of third-party risk · annual
Third-party incidents affecting the organisation (outages, breaches) in the quarter	0	1	2 or more	Incident system	COO · quarterly
Suppliers with deteriorating financial health scores	Below 5% of critical	5–10%	Above 10%	Financial monitoring service	Procurement · quarterly
On-time delivery and defect rate for critical suppliers (manufacturing and retail)	Within contract	Below contract in one period	Below contract in two periods	ERP	Supply chain head · monthly
Contracts for critical services expiring within 6 months without a renewal decision	0	1–2	3 or more	Contract management	Procurement · monthly

Reputation, ESG and climate KRIs

Reputation indicators are the hardest to make leading, because reputation is lost when a failure elsewhere becomes public; the usable ones measure the inputs (complaints, sentiment, incidents) rather than the outcome. ESG and climate indicators have become compliance obligations in several jurisdictions, with assured disclosures under the EU’s sustainability reporting directive, ISSB-based standards and California’s climate disclosure laws, which is why disclosure data quality has its own row. The ESG auditing guide covers the assurance program and the reputation risk introduction the category itself.

Indicator	Green	Amber	Red	Source system	Owner · refresh
Negative media and social mentions, weekly volume versus baseline	Within baseline	Up 50%	Up 100% or any viral incident	Media monitoring	Head of communications · weekly
Customer complaints escalated to a regulator or ombudsman	Within baseline	Up 25%	Up 50%	Complaint system	Compliance · monthly
Net promoter or customer satisfaction score, trend	Stable or rising	Down one period	Down two periods	Survey platform	Chief customer officer · quarterly
Environmental incidents and regulatory notices	0	1 minor	Any reportable	EHS system	Head of EHS · monthly
Scope 1 and 2 emissions against the published reduction pathway	On pathway	Up to 10% behind	More than 10% behind	Sustainability data platform	Chief sustainability officer · quarterly
Sustainability disclosure data points without a documented source and control	0	Below 5%	5% or more	Disclosure controls inventory	Controller · quarterly
Sites or assets in high physical climate risk zones without an adaptation plan	0	Below 10% of critical sites	10% or more	Physical risk assessment	COO · annual
Supplier ESG assessments overdue for high-risk categories	0	Below 10%	10% or more	Vendor risk system	Procurement · quarterly

Model and data risk KRIs

Model indicators measure the inventory, the validation backlog and performance in use; data indicators measure the quality of the inputs every other table depends on. With AI systems now in credit, marketing and servicing, the inventory row should include them. The model risk audit guide and the AI governance audit guide cover the frameworks.

Indicator	Green	Amber	Red	Source system	Owner · refresh
Tier 1 models (and AI systems) with validation overdue	0	1	2 or more	Model inventory	Head of model risk · quarterly
High-severity validation findings open past their due date	0	1–2	3 or more	Model inventory	Head of model risk · quarterly
Models in production with ongoing-monitoring breaches unresolved	0	1	2 or more	Monitoring reports	Model owners · monthly
Models in use not on the inventory (found by audit or by the second line)	0	1	2 or more	Audit and validation findings	Head of model risk · annual
Critical data elements failing quality rules	Below 1%	1–3%	Above 3%	Data quality platform	Chief data officer · monthly
Regulatory reports resubmitted or corrected in the year	0	1	2 or more	Regulatory reporting log	Controller · quarterly
Manual adjustments to model outputs or reports as a share of items	Below 2%	2–5%	Above 5%	Reporting system	Report owners · quarterly
AI systems in customer-facing decisions without a bias and performance review in 12 months	0	1	2 or more	AI inventory	Head of model risk · quarterly

The breadth list: indicators by risk category

For completeness beyond the thirteen tables, the list below spans sixteen risk categories with the indicators most commonly monitored in each. It is a checklist for building a risk universe or challenging whether a category has been left unmeasured, not a set of thresholds; the risk taxonomy guide shows how the categories fit together and the OCC risk categories guide how a bank supervisor groups them.

Risk category	Commonly monitored indicators
Financial and capital	Capital ratios against buffers and triggers, leverage, earnings at risk, value at risk, interest rate sensitivity, currency and commodity exposures, counterparty exposure, rating agency outlook
Credit	Delinquency and non-performing ratios, migration, policy exceptions, concentrations, allowance coverage, overdue reviews, covenant breaches
Liquidity	Coverage and funding ratios, survival horizon, deposit concentration and insured share, wholesale reliance, contingency capacity, collateral readiness
Market	Limit utilisation, backtesting exceptions, stress losses, valuation variances, stale prices, unexplained profit and loss
Operational	Losses and near misses, reconciliation ageing, error rates, change failures, availability, resilience test results, overdue issues
Technology and cyber	Vulnerabilities past SLA, privileged access without MFA, phishing failure, detection time, end-of-life systems, access reviews, backup tests
Fraud and financial crime	Losses against appetite, alert backlogs, chargebacks, late suspicious activity reports, overdue due diligence, screening currency
Compliance and conduct	High residual risk cells overdue, examiner-found share, changes past effective date, complaints per thousand, repeat issues, incentive clawbacks
Legal	Open litigation by exposure, contracts without legal review, unenforceable guarantees found, intellectual property disputes, regulatory enquiries
People and culture	Turnover in control roles, long-open vacancies, engagement gaps, hotline volume and substantiation, investigation ageing, retaliation complaints
Third-party and supply chain	Critical vendors unassessed, SLA breaches, single-source dependencies, fourth parties unknown, supplier financial health, delivery and defect rates
Reputation	Negative mentions, regulator-escalated complaints, satisfaction trends, executive and product controversies in the press
Environmental, social and climate	Incidents and notices, emissions against pathway, disclosure data controls, physical risk exposure, supplier ESG assessments, health and safety rates
Strategic	Market share trend, revenue concentration, strategic initiative milestones missed, acquisition integration measures, competitor and technology disruption signals
Model and data	Validations overdue, open high findings, monitoring breaches, uninventoried models, data quality failures, report resubmissions, manual adjustments
Business continuity and resilience	Recovery tests overdue, recovery time objectives missed in tests, critical services without impact tolerances, crisis exercises completed, insurance adequacy

Setting thresholds: five calibration methods

Every number in the tables above is a starting point. The durable part of the pattern is that each indicator has thresholds with a written rationale; the numbers themselves come from one of five sources, and a good KRI library records which.

Method	How it works	Best for	Weakness
Regulatory floor plus a buffer	Red at the regulatory minimum, amber at a management buffer above it, green beyond	Capital, liquidity ratios, supervisory screens (the 300 per cent CRE concentration screen, the EU 15 per cent EVE outlier test)	Only exists where a regulator has set a number
Risk appetite statement	The board’s appetite becomes red; amber is an early warning set at a fraction of the distance	Losses against budget, concentrations, earnings sensitivity	Appetite statements are often qualitative and have to be translated
Historical distribution	Amber at the 75th and red at the 90th percentile of the indicator’s own history, or at a defined number of standard deviations	Operational, complaint, error and volume metrics with several years of data	History may include a period that was itself too risky; recalibrate after structural change
Peer benchmark	Thresholds set where the organisation would move from the middle to the worst quartile of peers	Turnover, delinquency, availability, phishing failure	Peer data is lagged and definitions differ
Zero tolerance	Any occurrence is red	Breaches past cure period, late regulatory filings, privileged accounts without MFA, unapproved assumption changes	Overused, it makes every month red and the indicator is ignored

Two cautions before lifting any table into a risk report. Calibrate to the organisation’s size, complexity and stated appetite, and write the rationale down beside the threshold; a threshold with no rationale cannot be defended to an examiner or an audit committee. And test the thresholds against history: if an indicator would have been green through the organisation’s last loss event, it is measuring the wrong thing.

How internal audit tests a KRI program

For internal auditors the tables cut both ways: they are a scoping aid for the annual risk assessment and they are test criteria for management’s own indicators. An audit of a KRI program is short and specific, and its findings tend to be the same ones.

Test	What the auditor does	Evidence	Typical finding
Five-field completeness	Takes the KRI inventory and checks every indicator for metric definition, thresholds, source, owner and refresh	KRI inventory	Thresholds missing on a third of indicators; owners named as departments
Coverage against the risk register	Maps indicators to the top risks in the risk register; looks for high-rated risks with no indicator and indicators with no risk	Register, inventory	Several top-ten risks have no leading indicator; culture and third-party risk unmeasured
Leading versus lagging mix	Classifies each indicator; a program that is all loss counts is not an early warning system	Inventory	Operational and conduct families entirely lagging
Threshold rationale	Asks for the basis of each threshold and whether the indicator would have been red before the last loss event	Calibration records, history	Thresholds set by consensus with no rationale; never recalibrated
Data lineage and reperformance	Rebuilds a sample of indicators from the named source system and compares to the reported figure	Source extracts, report	Reported figures manually adjusted; one indicator calculated differently from its definition
Breach response	Traces every amber and red reading in the year to the escalation, the decision and the action taken	Committee minutes, action logs	Reds reported for six months with no recorded decision
Reporting integrity	Checks that the board pack shows the same figures as the source, including history and threshold changes	Board packs, source reports	Thresholds relaxed mid-year without approval; history re-based
Program governance	Reviews ownership, annual refresh, retirement of stale indicators and addition of new ones after events	Program charter, change log	No indicator added or retired in three years

Findings are written against outcomes: “four of the ten highest-rated risks have no leading indicator” and “red readings on the critical-vulnerability indicator were reported for seven consecutive months without a recorded decision” are findings; “the KRI program could be enhanced” is not. The issue validation guide covers closure.

Worked example: Lakeshore Bancorp’s KRI library audit

Lakeshore Bancorp is the illustrative nine-billion-dollar public regional bank used across this site, with a twenty-two person internal audit function. Its FY27 plan included a 220-hour audit of the enterprise KRI library, which had 164 indicators reported quarterly to the board risk committee. The engagement applied the eight tests above.

Test	What the audit found	Rating
Five-field completeness	164 indicators; 51 had no thresholds (reported as trend lines), 38 named a department as owner, 22 had no documented source	High
Coverage	Of the twelve top risks in the register, four had no leading indicator: deposit flight, conduct in the mortgage sales force, third-party concentration in the core processor, and ALM model assumption risk	High
Leading versus lagging	71 per cent of indicators were lagging (loss and incident counts); the operational family was entirely lagging	Medium
Threshold rationale	No rationale recorded for 93 of 113 thresholds; the uninsured-deposit indicator (set at red above 60 per cent) would have been green throughout the first quarter of 2023 at a 58 per cent share	High
Reperformance	Twenty indicators rebuilt from source: seventeen agreed; the critical-vulnerability count excluded internet-facing systems managed by a vendor, and two liquidity ratios were taken from a spreadsheet rather than the ALM system	Medium
Breach response	Nine reds in the year; five had a recorded decision; the privileged-access indicator was red for seven consecutive months with no action logged	High
Reporting integrity	Thresholds on three indicators relaxed in Q2 by the risk function without committee approval	Medium
Governance	No indicator added or retired since FY24; no post-event review after a FY26 wire fraud loss	Medium

The engagement was rated Needs Improvement. Management’s actions: a rebuilt library of 90 indicators, each with the five fields and a recorded calibration method, adopted by the board risk committee in two quarters; new leading indicators for the four uncovered risks, including uninsured-deposit share at a 30/50 per cent threshold, mortgage sales clawback rate, core processor SLA and exit-plan status, and ALM assumption changes against approval; a rule that any red reading carries a recorded decision within the reporting cycle; threshold changes reserved to the committee; and an annual refresh with a post-event review step. Internal audit validated the actions under the issue validation standard by reperforming the rebuilt library two quarters later and tracing the next four reds to decisions.

Frequently asked questions

What is a key risk indicator, with an example?

A key risk indicator is a metric that signals rising exposure to a risk before the loss arrives, read against thresholds that trigger action. Example: policy exceptions on new loan originations as a share of approvals, green below 5 per cent, amber 5 to 10, red above 10, sourced from the loan origination system, owned by the head of credit administration and refreshed monthly. The five fields (metric, thresholds, source, owner, refresh) are what make it usable.

What is the difference between a KRI and a KPI?

A KPI measures achievement of an objective after the fact (loan growth against plan); a KRI measures the build-up of exposure to a risk ahead of the loss (exceptions, concentrations, backlogs). The same number can serve as both in different reports, but a risk report built from KPIs tells the committee what happened, not what is coming. Key control indicators are a third type: they measure whether a control is operating.

How many KRIs should an organisation have?

Fewer than most have. A board-level set of twenty to forty, covering every top risk with at least one leading indicator, is typical for a mid-sized institution; business units and risk functions hold deeper sets below it. A library with 150 indicators and no thresholds is a reporting burden, not an early warning system, and the first thing an audit of the program usually recommends is retirement of indicators nobody acts on.

How should KRI thresholds be set?

From one of five sources, recorded beside the threshold: a regulatory floor plus a buffer, the board’s risk appetite statement, the indicator’s own historical distribution, a peer benchmark, or zero tolerance for events that should never occur. Test the result against history: an indicator that would have stayed green through the organisation’s last loss event is mis-calibrated. Changes to thresholds should need the same approval as the original.

What are examples of non-financial KRIs?

Turnover in critical control roles, vacancies open beyond 90 days, ethics hotline volume and substantiation rate, investigations open beyond 60 days, retaliation complaints, critical third parties without a current assessment, negative media volume against baseline, environmental incidents, emissions against the published pathway, and the share of sustainability disclosure data points without a documented control. The people, third-party and reputation tables above give thresholds for each.

Which KRIs matter most for a bank in 2026?

The ones the 2023 failures exposed: uninsured-deposit share, survival horizon under a combined stress, collateral tested at the discount window and FHLB, unrealised securities losses against tangible equity, EVE sensitivity as well as NII sensitivity, realised deposit beta against the modelled beta, and unapproved ALM assumption changes. Alongside them, the perennial credit and operational rows, and for institutions with fintech partners, the third-party rows.

How does internal audit use KRIs?

Twice over. As an input to its own risk assessment and audit plan: an amber or red indicator is a reason to move an audit forward. And as an object of audit: the program itself is tested for five-field completeness, coverage of the top risks, the leading-versus-lagging mix, threshold rationale, data lineage, breach response, reporting integrity and governance. The KRI program design guide covers the first use and the audit section above the second.

What should the board see?

A one-page set of the twenty to forty enterprise indicators with current reading, trend, threshold status and, for every amber and red, the decision taken and by whom. Not the full library, and not activity metrics presented as risk metrics. The board’s questions are whether the top risks are each measured by something leading, whether any red has gone unanswered, and whether thresholds have moved without its approval.

Related guides

• Designing a KRI Program — selection, thresholds, escalation and governance for the indicators in this library
• How to Audit the ERM Program — the program the KRI library sits inside, with maturity criteria
• The Risk Register — where each indicator attaches to a risk, with a worked example
• The Annual Internal Audit Risk Assessment — using indicators to drive the audit plan
• Liquidity Risk — the metrics behind the liquidity table, from loan-to-deposit ratio to survival horizon
• Interest Rate Risk — EVE, NII, the Basel 2024 recalibration and the outlier tests
• Credit Risk — migration, concentrations and allowance coverage
• Compliance Risk — the compliance management system the compliance indicators measure
• Conduct Risk — the behaviours the conduct indicators look for
• Third-Party Risk Management — the lifecycle program behind the third-party table
• Model Risk Audit — validation, inventory and ongoing monitoring
• Risk Management and ERM category — every guide on risk programs in one archive