Key risk indicator

A Key Risk Indicator, also known as a KRI, is a measure used in management to indicate how risky an activity is. It differs from a Key Performance Indicator (KPI) in that the latter is meant as a measure of how well something is being done while the former is an indicator of the possibility of future adverse impact. KRI give us an early warning to identify potential event that may harm continuity of the activity/project.

KRIs are a mainstay of Operational Risk analysis.

Definitions

According to OECD

A risk indicator is an indicator that estimates the potential for some form of resource degradation using mathematical formulas or models.

Risk management

Security risk management

According to Risk IT framework by ISACA,. Key risk indicators are metrics capable of showing that the organization is subjetc or has a high probability of being subject to a risk that exceed the defined risk appetite.

Organizations have different sizes and environment. So every enterprise should choose its own KRI, taking into account the following steps:

• Consider the different stakeholders of the organization
• Make a balanced seclection of risk indicators, covering performance indicators, lead indicators and trends
• Ensure that the selected indicators drill down to the root cause of the events
• Choose high relevant and highprobability of predicting important risks:
  • High business impact
  • Easy to measure
  • With high correlation with the risk
  • Sensitivity

The constant measure of KRI can bring the following benefits to the organization:

• Provide an early warning: an proactive action can take place
• Provide a backward looking view on risk events, so lesson can be learned by the past
• Provide an indication that the risk appetite and tolerance are reached

See also

• [COSO]]
• Enterprise risk management
• ISACA
• ISO 31000
• Operational risk
• Performance indicator
• Risk appetite
• Risk IT