A KRI, or key risk indicator (in Italian indicatore chiave di rischio), is a metric that signals how exposed the organisation is to a given risk at a given moment and, if well chosen, makes it possible to act before the event occurs. In its good practice guidance, the Institute of Operational Risk defines it as a metric that provides information on the level of exposure to an operational risk, noting that any data can be a metric: what makes the difference is choosing the indicators that are most relevant, simplest to use and most predictive.
Key risk indicators are one of the tools through which risk management moves from listing risks to monitoring them continuously: the register says which risks exist, the indicators say how they are moving.
Key risk indicators in 4 key points
They anticipate
They measure conditions that precede the event, such as delays, shortages and deviations, not the event once it has happened.
They have a threshold
It is the threshold that turns a measurement into something that calls for action.
Without a threshold it is data; with a threshold it is a signal
They have an owner
For each indicator, someone collects the data and someone decides what to do when the threshold is breached.
They are few
A good system uses a limited number of them, tied to the risks that really matter for the objectives.
KRIs: what they mean and what they are for
By KRI we mean an indicator that signals the level of exposure to a risk. Consider a company that depends on a handful of suppliers: in that case, the event to avoid is a supply disruption, yet the useful signal arrives earlier. Rising delivery delays, a deterioration in the supplier’s financial soundness, the share of purchasing concentrated on a single name. Each of these measures can be a KRI.
What key risk indicators are for
First
Spotting it early
Risk does not appear out of nowhere: it usually leaves measurable traces.
Second
Deciding on shared criteria
Thresholds and responsibilities agreed in advance prevent debate once the problem is already open.
Third
Reporting to senior leadership
A few well-chosen indicators allow the board and management to see whether exposure remains within what the company is prepared to accept, that is, within its risk appetite.
Characteristics of a good KRI
Not every metric makes a good key risk indicator. A useful indicator has the following characteristics:
The seven characteristics of an indicator that works
In italics, the question to test it against.
Linked to a risk
It measures exposure to a specific risk that affects the objectives
→Which risk in the register does it address?
Predictive
Changes before the event occurs
→Does it warn us in time to act?
Measurable
It is calculated with a clear formula and data source
→Who calculates it, and with what data?
Comparable
It is compared over time and across units or processes
→Do we always calculate it the same way?
With thresholds
Has values that indicate when to act
→At what value is action triggered?
Understandable
Anyone reading it immediately understands what it indicates
→Can a committee member interpret it without explanation?
With an owner
Has an owner for the data and one for the action
→Who must act if the threshold is breached?
An indicator that fails the test in the first row, the link to a risk, should be removed even if it is easy to calculate. This is the most common mistake: measuring what is available rather than what is needed.
The difference between KRIs and KPIs
At this point it is fair to ask what the difference is between KPIs and KRIs. KPIs (key performance indicators) measure results against objectives: in practice, how we are doing. KRIs measure the risk that those results will not be achieved, or that the price paid will be too high: how exposed we are. For KPIs, see our guide to business KPIs.
KPIs and KRIs compared
| KPI | KRI | |
|---|---|---|
| Measure | Results and performance | Risk exposure |
| Question | Are we reaching the target? | Are we at risk of missing it? |
| Time | Often after the fact | Ideally before the event |
| Threshold | Target to reach | Limit not to be exceeded |
| Example | Monthly revenue | Share of revenue from a single customer |
The same data can be read differently depending on its use. The absenteeism rate, for example, is a KPI for those managing staff; it becomes a KRI when a critical process depends on a few people and a prolonged absence would halt it. The most useful pairing is one in which each objective and its KPI is matched by the KRI that signals the risk of missing it: for the objective “on-time deliveries”, the KPI is the percentage of deliveries made on time, the KRI is dependence on a single carrier.
KRIs and KCIs
Alongside KRIs sit KCIs (key control indicators), which measure how effective controls are: for example, the percentage of controls carried out on schedule or of anomalies closed by the deadline. The distinction is conceptual, and in practice the two families are used together: the KRI tells you how exposed the process is, the KCI tells you whether the defences are working. If a KRI worsens while the KCIs are green, the problem may lie in the indicator or in a poorly chosen control.
Examples of KRIs by business area
The KRI examples below are illustrative: thresholds depend on each company’s sector, size and risk appetite, and must be defined internally.
Example indicators by area
For each area: the risk covered, a possible indicator and the signal to watch.
Finance
liquidity strain
Days of cash available against upcoming commitments.
SignalContinuous decline over several periods
Customers and sales
dependence on a few customers
Share of revenue from the top three customers.
SignalGrowth beyond the set limit
Suppliers
supply disruption
Percentage of late deliveries from critical suppliers.
SignalRise above the threshold
Production
plant downtime
Unplanned downtime hours as a share of the total.
SignalRising trend
People
loss of expertise
Turnover in key roles and positions left without a successor.
SignalDepartures concentrated in one function
IT and security
disruption or attack
Critical security patches not applied within the expected timeframe and failed backups.
SignalDelays building up
Compliance
penalties or non-compliance
Missed regulatory deadlines and open audit findings.
SignalFindings that remain open past the deadline
Reputation
loss of trust
Serious complaints or negative reviews on the rise.
SignalDeviation from the historical average
A risk indicator is always context-dependent: the same indicator can be essential for one company and irrelevant for another.
Thresholds and alert levels
The threshold turns a number into a decision. The most common practice is a three-level system, often represented with traffic-light colours.
Thresholds, read as a traffic light
Green
Exposure within the accepted level.
→Monitoring continues.
Yellow
Warning threshold breached.
→The owner analyses the cause and prepares actions.
Red
Limit exceeded.
→Escalation to the designated decision level and an action plan with a deadline.
The three levels must be defined in advance, together with who acts at each one: a traffic light with no assigned owners only signals; it does not make anyone act.
Three rules for setting thresholds:
- Start from risk appetite. Thresholds translate into numbers what the company has decided to tolerate. Without a risk appetite statement, thresholds become arbitrary.
- Use historical data, where it exists. A threshold set too low triggers constant alarms that nobody takes seriously; one set too high never triggers at all.
- Decide the action in advance. For each threshold, write down who is alerted, within what timeframe and what decision is expected.
How to build key risk indicators in seven steps
- Start from the objectives. Which results matter most and what could prevent them.
- Identify the priority risks. Start from the risk matrix or the risk register, selecting those with the highest likelihood and impact.
- Look for the signals. For each risk, identify which conditions precede it and can be observed.
- Define the indicator. Name, formula, unit of measurement, frequency, data source.
- Set the thresholds. Green, amber and red, approved by the risk owner.
- Assign responsibilities. Who collects the data, who validates it, who decides the action.
- Report and review. The indicators feed into periodic reporting to the committee; at least once a year, check whether they are still the right ones.
For each indicator, it is worth completing a short sheet with these fields: related risk, definition and formula, data source, frequency, thresholds, data owner, action owner, report recipients. It is the document that makes the KRI verifiable and that is checked during an audit.
The Bliss view
For us, key risk indicators go well beyond mere reporting
This is a governance tool, worth only as much as the decision that accompanies it. Working on risk indicators means connecting objectives, risks and responsibilities, and giving senior leadership a few reliable signals instead of many numbers.
This is the difference between a system that describes risks and one that helps govern them.
The Bliss perspective
KRIs and risk management: where they fit
Key risk indicators are one component of risk management, which the ISO 31000:2018 standard (international guidelines on risk management, applicable to any organisation) describes as a process. They are used to track risks that have already been identified and assessed over time: once a risk has been identified and assessed, you need a way to follow how it evolves. This is why indicators connect to risk appetite, which sets the limits from which thresholds are derived; to the risk register, which records the associated KRIs and the owner for each risk; to the risk matrix, which helps decide which risks warrant an indicator; to the internal control system, which provides the controls measured by KCIs; and to enterprise risk management (ERM), within whose framework indicators feed reporting to senior leadership, as explained in the guide to enterprise risk management.
The most common mistakes
- Too many indicators. Ten indicators read every month are worth more than a hundred that nobody looks at. Start with the principal risks.
- KRIs without a risk. Metrics chosen because they are easy to calculate, not because they are linked to a risk.
- Indicators that arrive late. If the KRI triggers after the event has occurred, it is a loss indicator, not an alarm.
- Thresholds without action. A red that does not lead to a decision makes the system merely decorative.
- Manual collection and inconsistent data. Separate spreadsheets for each function produce figures that cannot be compared; single definitions and sources need to be set.
- Unassigned responsibilities. An indicator without an owner remains just a number in a report.
- No review. Risks change: indicators that are not reviewed lose their meaning.
Request a conversation
Choosing the few indicators that really matter
The hard part is not building a dashboard: it is deciding which risks deserve a threshold, at what value action is triggered and who is accountable when it is. If you are reworking your indicator system, or you have too many indicators and nobody looks at them, we would be glad to talk.
Domande frequenti
What does KRI mean?
KRI stands for key risk indicator (in Italian, indicatore chiave di rischio): a metric that signals the level of exposure to a risk.
What is meant by KRI?
An indicator, with a threshold and an owner, that gives early warning that a risk is rising and allows a decision on whether to intervene.
What are risk indicators for?
They are used to monitor exposure to the principal risks, to trigger action when thresholds are exceeded and to report the position to senior leadership in a way that is comparable over time.
What is the difference between KPIs and KRIs?
KPIs measure performance against objectives; KRIs measure the risk of not achieving them. The former look at results, the latter at exposure.
What are KPIs and KRIs?
They are two complementary families of indicators. KPIs (key performance indicators) tell us how we are doing; KRIs (key risk indicators) tell us how likely we are to fall short.
What does KCI mean?
KCI stands for key control indicator: an indicator that measures whether controls are working.
What are risk indicators?
They depend on the risk. Examples: revenue concentration among top customers, delays from critical suppliers, production stoppages, turnover in key roles, unapplied security patches, open audit findings.
What are the characteristics of a good risk indicator?
Link to a risk, predictive power, measurability, comparability, thresholds, clarity and an owner.
How many key risk indicators are needed?
Few: typically the main risks, with one or two indicators each. The right number is the one the committee can read and follow.
Who sets the thresholds for key risk indicators?
Whoever is accountable for the risk, with approval from the relevant level of governance (management or committee), in line with risk appetite.
How often are risk indicators updated?
It depends on the risk: monthly or more often for fast-moving risks, quarterly for the others. The frequency should be recorded on the indicator sheet.
Is dedicated software needed?
Not to get started. What matters is a clear definition, a single data source and an owner; tools automate collection once the indicators have grown in number.