A key risk indicator (KRI) is a measurable quantity that changes before or as a risk materializes, monitored against thresholds that trigger a defined response when crossed. The definition has four parts, and most “KRI programs” fail at least two of them: the quantity must be measurable from data the organization actually has; it must relate to a specific risk in the register rather than to general performance; it must have thresholds that mean something; and crossing a threshold must cause something to happen. A spreadsheet of 140 monthly metrics with no thresholds, reviewed by a committee that notes them, is a dashboard, which has its uses, but it is not an early warning system, and when the risk materializes nobody will have been warned.
This guide explains how to build the system rather than the dashboard. It covers what a KRI is and how it differs from a key performance indicator and a key control indicator, the selection criteria that turn a metric wishlist into a short list of indicators, leading versus lagging indicators and why a program needs both, how to calibrate thresholds from historical data and from the organization’s risk appetite, the escalation wiring that makes a breach an event with an owner and a deadline, the lifecycle that reviews and retires indicators, a build sequence with the first twenty KRIs most organizations should start with, how internal audit tests the program, the failures that make dashboards decorative, and a worked example of a regional bank’s operational risk function rebuilding its program. It extends the site’s KRI reference table and non-financial indicators guide, which list indicators by risk type, into the design of the program that uses them.
In this guide
- KRI, KPI and KCI: the distinctions that matter
- Selection criteria: from wishlist to indicators
- Leading and lagging indicators
- Calibrating thresholds
- Escalation wiring: making a breach an event
- The KRI lifecycle
- The first twenty KRIs
- The build sequence
- Reporting: what the committee and the board see
- How internal audit tests a KRI program
- Failures that make dashboards decorative
- Template: the KRI definition card
- Worked example: Lakeshore Bancorp rebuilds 140 metrics into 38 indicators
- Questions about KRI programs
- Related guides
KRI, KPI and KCI: the distinctions that matter
| Indicator | Measures | Question it answers | Example | Owner |
|---|---|---|---|---|
| Key performance indicator (KPI) | Achievement of an objective | Are we succeeding? | On-time delivery 96 percent | Business management |
| Key risk indicator (KRI) | Exposure to, or early signs of, a specific risk | Is a risk building, before it hits? | Orders shipped from a single depot above 40 percent of volume (concentration risk) | Risk owner; risk function maintains |
| Key control indicator (KCI) | Whether a control is operating | Is the control working? | Percentage of vendor bank changes with completed call-back verification | Control owner; second line monitors |
| Loss or incident metric | Risk that has already materialized | What did it cost us? | Operational losses this quarter | Risk function |
The lines blur in practice, and the same number can serve two roles: a reconciliation backlog is a KCI for the reconciliation control and a KRI for the financial reporting risk. What matters is that each indicator in the program is tagged to the risk (or control) it monitors, because an indicator with no risk attached cannot have a meaningful threshold, and the risk taxonomy gives the categories the tagging uses. KPIs belong in management reporting; a KRI program that fills up with them has become a scorecard.
Selection criteria: from wishlist to indicators
| Criterion | Test | What fails it |
|---|---|---|
| Relevance | The indicator moves when the specific risk’s likelihood or exposure moves; the causal link can be stated in one sentence | Headcount as a KRI for “people risk” |
| Predictiveness | Historical data, or a credible argument, shows the indicator changes before losses or incidents | Loss totals (lagging only) with no leading companion |
| Measurability | Data exists, is produced routinely, has a defined source and calculation, and can be reproduced by someone else | “Staff morale”; indicators requiring a manual survey nobody runs |
| Controllability or actionability | Someone can do something when the indicator moves, even if only escalate | Macroeconomic indices with no response attached |
| Timeliness | Available at a frequency that leaves time to act (daily or weekly for fast risks; monthly for slow ones) | Quarterly indicators for a risk that materializes in days |
| Sensitivity and stability | Moves enough to signal, not so much that it signals constantly; thresholds can be set that separate normal from abnormal | Indicators that are red every month or never move |
| Cost | Producing it costs less than the warning is worth | Indicators needing a week of manual work each month |
| Ownership | One person is accountable for the data and one for the response | Indicators “owned by the risk committee” |
Applying the criteria to a wishlist is a scoring exercise: each candidate scored one to three on each criterion, with any zero on measurability or relevance disqualifying. A wishlist of 100 candidates typically yields 25 to 45 indicators, which is the right size for a mid-size organization’s enterprise-level program; business units carry their own operational indicators below it. Fewer, well-calibrated indicators that someone acts on beat a comprehensive set nobody reads, and the KPI guide makes the same argument for the audit function’s own metrics.
Leading and lagging indicators
A lagging indicator measures the risk after it has materialized (losses, incidents, complaints, breaches found); a leading indicator measures a condition that precedes materialization (staff turnover in a control function, system changes without testing, vendor financial stress, overdue reconciliations, limit utilization approaching the limit). Programs need both: lagging indicators are reliable and confirm whether leading ones were right; leading indicators are the point of the exercise and are harder to find, because they require a causal theory of how the risk materializes. The practical method is to take each high-rated risk in the register, write its causal chain (the root cause guide’s “why” ladder in forward gear: what happens first, then next, then the loss), and look for a measurable quantity at each early link. For payment fraud through vendor bank account changes, the chain runs from an unverified change, to a payment against the new account, to the loss; the leading indicator is the proportion of bank changes without verification, measured weekly, and the lagging indicator is diverted payments. A program with no indicator earlier than the loss for any of its top ten risks has not yet built an early warning system.
Calibrating thresholds
| Method | How it works | Best for | Weakness |
|---|---|---|---|
| Appetite-derived | Red at the level the appetite statement or a limit defines as unacceptable; amber at a stated fraction (often 80 percent) of red | Indicators tied to limits: concentrations, capital, liquidity, open high findings | Needs an appetite statement precise enough to yield numbers |
| Statistical | Amber and red at percentiles of the indicator’s own history (for example the 80th and 95th) or at two and three standard deviations from a stable mean | Indicators with two or more years of data and stable processes | Normalizes a bad baseline; blind to regime change |
| Benchmark | Thresholds from peers, regulators or standards (regulatory ratios, industry loss rates) | Externally comparable indicators | Peer data may not fit the organization |
| Expert and scenario | Risk owners set the level at which they would act, tested against scenarios (“at what reconciliation backlog would month-end close be at risk?”) | New indicators with no history; operational indicators | Owners set thresholds they can meet |
| Trend | Thresholds on the rate of change rather than the level | Slow-moving indicators where direction matters (turnover, aging) | Noisy for small populations |
Three calibration rules apply whatever the method. Thresholds are set once, by the risk function with the owner, documented with their method and reviewed at the annual lifecycle step, not adjusted when breached. A threshold that is breached every month is wrong or the risk is out of appetite, and the program must say which. And the red threshold’s meaning is fixed across the program: red means a defined response is now required, not “worse than amber.” The risk matrix guide’s calibration discipline, including the inter-rater test, applies to thresholds set by expert judgment.
Escalation wiring: making a breach an event
| Status | Meaning | Required response | Owner | Deadline |
|---|---|---|---|---|
| Green | Within normal range | None; reported in the monthly pack | Data owner | Monthly |
| Amber | Approaching the unacceptable level, or adverse trend for two periods | Risk owner explains the cause and states whether action is needed; recorded against the indicator | Risk owner | Within 10 business days of the reading |
| Red | At or beyond the unacceptable level | Risk owner proposes an action plan or a risk acceptance; risk committee decides; the indicator stays red until the reading returns or the acceptance is approved | Risk owner; risk committee | Action plan within 10 business days; committee decision at next meeting or sooner |
| Red for two consecutive periods or breach of a board limit | Sustained exposure | Escalation to the board risk committee; the risk acceptance discipline applies if management proposes to accept | Chief risk officer | Next board committee meeting |
| Data unavailable | The indicator could not be produced | Treated as amber; data owner explains | Data owner | Within 5 business days |
The wiring is what separates a program from a dashboard, and it is tested by looking at the last twelve months of breaches and asking what happened after each. The breach log (indicator, date, status, cause, action, closure) is the program’s primary evidence; internal audit reads it before anything else, and a committee that wants to know whether its program works can read the same log in ten minutes.
The KRI lifecycle
Indicators are born, reviewed and retired. The annual review, aligned with the risk assessment cycle, asks of each indicator: did it move in the year, and did its movements correspond to anything (an indicator that was green all year while the risk produced three incidents has failed); is the risk it monitors still rated high enough to deserve enterprise-level monitoring; are the thresholds still right, given the year’s data and any appetite changes; is the data still produced at acceptable cost; and does anyone act on it. Indicators that fail are retired, with the date and reason recorded so that history can be read, and replaced where the risk still needs a signal. New indicators enter through the same selection scoring, usually when a risk is re-rated, an incident reveals a missing signal or a new business line arrives. A program whose indicator set has not changed in three years has stopped learning; one that changes half its indicators every year has not calibrated anything.
The first twenty KRIs
The indicators below suit most mid-size organizations as a starting set: each is measurable from systems most organizations have, tied to a common high-rated risk, and mostly leading. Thresholds are illustrative; each organization calibrates its own. Banks add the prudential indicators (limit utilizations, liquidity ratios, model performance) their frameworks require.
| # | Indicator | Risk monitored | Type | Source and frequency | Illustrative thresholds (amber / red) |
|---|---|---|---|---|---|
| 1 | Vendor bank account changes without completed verification, as a percentage of changes | Payment fraud | Leading | AP system; weekly | 5% / 10% |
| 2 | Open High and Critical audit findings past their due date | Control environment | Leading | Issue log; monthly | 2 / 5 |
| 3 | Account reconciliations not completed within the close deadline, and reconciling items older than 60 days above threshold | Financial reporting | Leading | Reconciliation tool; monthly | 5% / 10% of accounts |
| 4 | Manual journal entries above the materiality threshold posted without secondary approval | Financial reporting; fraud | Leading | GL; monthly | 1 / 3 |
| 5 | Users with privileged access outside the approved administrator list | Cyber; unauthorized access | Leading | Identity system; weekly | 1 / 3 |
| 6 | Leavers with active system access more than 24 hours after termination | Unauthorized access | Leading | HR and identity systems; weekly | 1 / 3 |
| 7 | Critical vulnerabilities open beyond the remediation standard | Cyber | Leading | Vulnerability scanner; weekly | 10 / 25 |
| 8 | Changes to production without an approved change record | Technology; availability | Leading | Change and deployment logs; weekly | 2% / 5% of changes |
| 9 | Backup jobs failed or not verified in the period for critical systems | Resilience; data loss | Leading | Backup system; daily | 1 / 3 systems |
| 10 | Days since last successful restore test of each critical system | Resilience | Leading | DR records; monthly | 270 / 365 days |
| 11 | Critical third parties without a current risk assessment or with an expired assurance report | Third-party | Leading | Vendor system; monthly | 5% / 10% |
| 12 | Spend with the largest supplier as a percentage of category spend (concentration) | Third-party concentration | Leading | AP; quarterly | 50% / 70% |
| 13 | Voluntary turnover in control functions (finance, risk, compliance, IT security) over the trailing twelve months | People; control capacity | Leading | HR; monthly | 15% / 25% |
| 14 | Key roles with no trained deputy | Key person | Leading | HR and succession records; quarterly | 2 / 5 |
| 15 | Customer complaints per 10,000 transactions, and complaints open beyond the response standard | Conduct; service | Mixed | Complaints system; monthly | Trend-based; 10% / 20% late |
| 16 | Regulatory deadlines due in 90 days without an assigned owner and plan | Compliance | Leading | Regulatory calendar; monthly | 1 / 2 |
| 17 | Hotline reports alleging management involvement, and investigations open beyond 60 days | Fraud; culture | Mixed | Case system; monthly | Any / 2 open late |
| 18 | Revenue from the largest customer as a percentage of total | Strategic concentration | Leading | Billing; quarterly | 20% / 30% |
| 19 | Operational losses and near misses in the period against the annual budget for losses | Operational risk, all types | Lagging | Loss database; monthly | 75% / 100% of budget year to date |
| 20 | Incidents rated major or above in the period, and repeat incidents with the same root cause | Operational; resilience | Lagging | Incident system; monthly | 1 / 2 major; any repeat |
The build sequence
| Step | Work | Output | Typical effort |
|---|---|---|---|
| 1. Start from the register | Take the top 15 to 20 risks by residual rating; write each causal chain | Causal chains with candidate signals | Two workshops |
| 2. Build the wishlist | Candidates from the chains, from existing management reports and from the reference table | 60 to 120 candidates | One week |
| 3. Score and select | Apply the eight criteria; disqualify unmeasurable and irrelevant candidates | 25 to 45 indicators, at least one leading per top risk | One workshop |
| 4. Define | A definition card per indicator (template below): calculation, source, owner, frequency | Definition cards | Two to three weeks with data owners |
| 5. Baseline | Pull 12 to 24 months of history where it exists; examine distributions | Historical series | Two weeks |
| 6. Calibrate | Set amber and red by the methods above; document the method per indicator | Thresholds | One workshop plus follow-up |
| 7. Wire escalation | Agree the response table with the risk committee; set up the breach log | Escalation procedure | One committee meeting |
| 8. Pilot | Run three cycles; fix data problems; test whether breaches produce responses | Working program | One quarter |
| 9. Report | Monthly pack to the risk committee; quarterly summary to the board | Reporting | Ongoing |
| 10. Review | Annual lifecycle review with the risk assessment | Retirements and additions | Annual |
Two further design points shorten the path. Aggregation: indicators are not added or averaged into a composite score, because a composite hides the one red that matters; the pack shows each indicator and a count of statuses. And ownership of the program as a whole: the risk function maintains the definitions, produces or collects the readings, computes the statuses and runs the breach log, while the risk owners own the responses; a program in which the business units produce their own readings and set their own statuses is a self-assessment, not an early warning system, and the RCSA already serves that purpose.
Reporting: what the committee and the board see
The risk committee sees the full set monthly: each indicator’s current reading, status, trend over twelve periods, the threshold and, for amber and red, the owner’s explanation and action. The board or its risk committee sees a quarterly summary: the indicators in red or sustained amber, what changed, the breach log’s open items, and the indicators retired or added, with the full set available as an appendix. Two presentation rules keep the pack honest: status is computed from the thresholds, never set by hand, and a data-unavailable indicator shows as amber with the reason rather than disappearing. The audit committee calendar places the risk profile and indicators in the third-quarter meeting for committees that also oversee risk, and the presentation template shows how internal audit’s own dashboard sits beside them.
How internal audit tests a KRI program
| Test | Procedure | Finding it produces |
|---|---|---|
| Coverage | Map indicators to the top 20 register risks; identify risks with no indicator or only lagging ones | Early warning absent for named high risks |
| Definition and reproducibility | Re-perform five indicators from source data using the definition card | Indicators that cannot be reproduced; calculations that drifted |
| Threshold basis | Review the documented method for each threshold; test statistical ones against the data; check for thresholds moved after breaches | Thresholds without basis; thresholds adjusted to avoid red |
| Escalation | Take every red and sustained amber in twelve months from the breach log; trace to the owner’s response and the committee’s decision | Breaches with no response; responses without closure |
| Back-test | Take the year’s incidents and losses; check whether the relevant indicators moved beforehand | Indicators that did not warn; missing indicators |
| Data integrity | Check source extracts, manual adjustments and the completeness of the populations (the IPE tests) | Manually edited readings; incomplete populations |
| Lifecycle | Review the annual review’s evidence; count indicators unchanged for three years and those green all year while the risk produced incidents | Dead indicators; a program that stopped learning |
| Reporting honesty | Compare the board summary with the full set and the breach log | Reds omitted; status set by hand |
The tests sit inside the operational risk framework audit as its KRI component, or run as a standalone engagement of 150 to 250 hours where the program is large. Internal audit also uses the program: red and sustained amber indicators are an input to the annual risk assessment and a trigger for in-year plan changes.
Failures that make dashboards decorative
| Failure | How it shows | Fix |
|---|---|---|
| Too many indicators | 140 metrics; the committee notes them in four minutes | Score against the criteria; 25 to 45 at enterprise level |
| KPIs in disguise | Revenue, margin and headcount on the risk dashboard | Tag every indicator to a register risk or remove it |
| All lagging | Losses, incidents and complaints; nothing that precedes them | Causal chains for the top risks; one leading indicator each |
| Thresholds by feel | No documented method; thresholds moved when breached | Appetite-derived or statistical calibration; change control on thresholds |
| No wiring | Reds reported, nothing happens, no breach log | The response table; the log; committee decisions recorded |
| Hand-set status | Owners mark their indicators green | Status computed from readings; no manual override |
| Data debt | Half the indicators produced by manual spreadsheet work; late or missing readings | Automate the top indicators; treat unavailable as amber |
| No lifecycle | Same indicators for years regardless of the risk profile | Annual review with retirements |
Template: the KRI definition card
KRI: [Vendor bank account changes without completed verification]. ID: [KRI-07]. Risk monitored: [3.5.2 External fraud: payment diversion], register entry [R-14], residual rating [High]. Type: [Leading]. Definition and calculation: Number of vendor master bank account changes in the period for which the independent call-back verification field is blank or dated after the first payment, divided by all bank account changes in the period, expressed as a percentage. Data source: [AP vendor change log, table and fields; payment table]. Frequency: [Weekly, Monday for the prior week]. Data owner: [AP manager]. Risk owner: [Controller]. Thresholds and method: Amber 5 percent, red 10 percent; appetite-derived from the payment fraud appetite statement (no unverified change should precede a payment) with amber at an operational tolerance agreed by the controller; reviewed [date]. Response: Amber: AP manager explains and confirms retrospective verification within 10 business days. Red: controller presents the cause and action to the risk committee; payments to affected vendors held pending verification. History: [Introduced after the FY27 AP audit finding; 24 months of back-filled data; two amber readings, no red]. Last review: [date]. Status: [Active].
Worked example: Lakeshore Bancorp rebuilds 140 metrics into 38 indicators
Lakeshore Bancorp, the $9 billion regional bank used in examples across this site, has an operational risk function of six reporting to the chief risk officer. Its KRI program, inherited from a 2019 consulting engagement, carried 140 indicators reported monthly in a 60-page pack: 91 of them were performance metrics or volumes with no risk attached, 112 had no thresholds, the 28 with thresholds had been set by the business units at levels they always met, and the pack had never produced an escalation. The operational risk framework audit rated the KRI component a High finding on exactly those facts, and the function rebuilt the program over two quarters using the sequence above, with internal audit as challenger.
| Element | Before | After |
|---|---|---|
| Indicators | 140; 91 performance metrics | 38 at enterprise level, each tagged to one of the top 22 register risks; 22 leading, 10 lagging, 6 control indicators |
| Coverage of top risks | 9 of 22 top risks had any indicator; 3 had a leading one | 22 of 22 with at least one leading indicator |
| Thresholds | 28 indicators with thresholds, set by business units | 38 with documented thresholds: 14 appetite-derived (limits and the appetite statement), 17 statistical from 24 months of data, 7 expert-set and flagged for recalibration after a year |
| Escalation | None in five years | Response table approved by the risk committee; breach log live; 11 amber and 3 red readings in the first two quarters, each with a recorded response |
| Notable early warnings | Deposit assumption sensitivity indicator (a new leading indicator from the deposit beta work) went amber two months before the model risk audit’s High finding; the third-party assurance-expiry indicator went red and surfaced the inventory gap later cited in the examination | |
| Data | About 60 percent of readings produced by manual spreadsheet work; typical delivery 15 business days after period end | 29 of 38 automated from source systems; delivery 5 business days; 9 manual indicators flagged for automation |
| Pack | 60 pages | 6 pages monthly for the risk committee; one page quarterly for the board risk committee with the breach log |
| Lifecycle | No review since 2019 | First annual review retired 4 indicators that never moved and added 3 after the resilience program’s mapping |
Internal audit’s follow-up review a year later re-performed six indicators (all reproduced), traced all fourteen breaches to responses (two had closed late and were raised as a Medium finding on the escalation deadline), and back-tested the year’s seven major incidents, finding that four had been preceded by an amber or red reading on a related indicator and three had not, which produced the next year’s additions. The function’s own observation was that the program became useful at the moment it became small: thirty-eight indicators the committee argued about replaced 140 it had never read.
Questions about KRI programs
What is the difference between a KRI and a KPI?
A KPI measures achievement of an objective; a KRI measures exposure to, or early signs of, a specific risk, against thresholds that trigger a response. The same number can serve both roles, but a KRI must be tagged to a register risk and have thresholds with a defined response.
How many KRIs should an organization have?
Twenty-five to forty-five at enterprise level for a mid-size organization, with at least one leading indicator for each top risk; business units carry their own operational indicators below. More than that and the committee stops reading.
How do I set KRI thresholds?
From the risk appetite or a limit where one exists, from the indicator’s own history (percentiles or standard deviations) where there is enough data, from benchmarks where comparable, and by expert judgment tested against scenarios where nothing else is available; document the method and do not move thresholds when breached.
What makes a KRI leading rather than lagging?
A leading indicator measures a condition that precedes the risk materializing, found by writing the risk’s causal chain and measuring an early link; a lagging indicator measures the risk after it has materialized. Programs need both, and the leading ones are the point.
What should happen when a KRI turns red?
A defined response within a deadline: the risk owner proposes an action plan or a risk acceptance, the risk committee decides, the breach is logged, and the indicator stays red until the reading returns or the acceptance is approved. Sustained red goes to the board committee.
How often should KRIs be reviewed?
Annually, with the risk assessment: each indicator is tested for whether it moved, whether its movements meant anything, whether its risk still warrants monitoring and whether its thresholds still fit. Indicators that fail are retired and replaced.
How does internal audit test a KRI program?
Coverage of the top risks, reproducibility of a sample of indicators from source data, the basis for thresholds, the escalation of every breach in the year, a back-test against the year’s incidents, data integrity, the lifecycle review and the honesty of board reporting.
Related guides
- Comprehensive table of key risk indicators — indicators by risk type, the wishlist source.
- Top non-financial risk indicators — operational, people and technology indicators.
- The risk register — the risks the indicators monitor.
- Risk appetite statements — the source of appetite-derived thresholds.
- Risk taxonomy — the categories indicators are tagged to.
- Risk assessment matrix — calibration discipline for expert-set thresholds.
- Risk acceptance by management — the sustained-red decision.
- How to audit operational risk management — the framework audit the KRI test sits in.
- How to run an RCSA — the self-assessment indicators feed and draw on.
- Root cause analysis — the causal chains behind leading indicators.
- IPE testing — the data integrity tests.
- Deposit beta modeling — the assumption indicator that warned early.
- Internal audit KPIs and metrics — the same discipline for the audit function.
- The annual internal audit risk assessment — using indicators in planning.
- Audit committee presentation template — reporting alongside the risk pack.
- Continuous auditing vs continuous monitoring — where automated indicators sit.
- Operational Risk Framework: Taxonomy, Tools, Governance — taxonomy, loss data, RCSAs, KRIs, scenarios and governance.
- Board Risk Reporting: The Quarterly Risk Pack Directors Read — what belongs in the quarterly risk pack and how to assure it.
- Continuous Monitoring on a Small Budget: 5 to 10 Indicators — five to ten indicators, Power Query or SQL jobs, thresholds and triage, with no platform.
Leave a Reply