Skip to main content
Governance Authority
Category: Enterprise Risk Management

Key Risk Indicator

Also known as: KRI, Key Risk Indicators, KRIs
Simply put

A Key Risk Indicator (KRI) is a measurable metric that an organization tracks to spot signs of rising risk before a problem materializes. It acts as an early-warning signal, helping the organization identify and monitor potential threats. KRIs are one tool within a broader risk management program rather than a complete measure of risk on their own.

Formal definition

A Key Risk Indicator is a quantifiable metric used to identify, measure, and monitor an organization's exposure to specific risks, typically designed to provide an early signal of increasing risk exposure across areas of the enterprise. In practice, KRIs are selected to serve as predictors of potentially unfavorable events and are often used in operational and enterprise risk management contexts to support timely escalation and response. The scope, thresholds, and design of KRIs generally depend on the organization's risk profile, its risk appetite and tolerance, and the judgment of the risk function; ownership of monitoring and response typically sits with management, while boards and risk committees generally exercise oversight. This entry is educational and does not prescribe a universal set of indicators or methodology.

Why it matters

Key Risk Indicators matter because risk management is most effective when an organization can act before a threat materializes rather than after. KRIs are designed to provide an early signal of increasing risk exposure across various areas of the enterprise, giving management the opportunity to escalate concerns and respond while there is still time to influence the outcome. Without such forward-looking metrics, an organization may rely too heavily on lagging information that only confirms harm after it has already occurred.

KRIs also help translate an abstract risk profile into something concrete and monitorable. By selecting indicators tied to specific risks and setting thresholds informed by the organization's risk appetite and tolerance, a risk function can support consistent, evidence-based conversations about whether exposure is trending in an unfavorable direction. This supports timely escalation and response, and it gives boards and risk committees a clearer basis for their oversight of how management is handling risk.

It is important not to overstate what KRIs deliver. They are one tool within a broader risk management program, not a complete measure of an organization's risk on their own. A poorly chosen indicator can create false confidence or generate noise, and the value of any KRI depends on the judgment applied in selecting it, calibrating its thresholds, and acting on what it shows. KRIs inform decisions; they do not replace them.

Who it's relevant to

Chief Risk Officers and Risk Functions
Risk functions typically design, select, and calibrate KRIs to fit the organization's risk profile, appetite, and tolerance. They exercise the judgment involved in choosing indicators that genuinely serve as early signals and in setting thresholds that trigger meaningful escalation.
Management and Operational Owners
Ownership of monitoring and response generally sits with management. Operational and business owners track the indicators relevant to their areas, investigate movements, and initiate escalation and response when exposure appears to be rising.
Boards and Risk Committees
Boards and their risk committees generally exercise oversight rather than operational monitoring. KRIs give them a clearer, evidence-based basis for challenging management on whether risk exposure is trending unfavorably and whether responses are timely and adequate.
Internal Audit and Assurance Functions
Assurance functions may consider whether KRIs are well designed and whether management is acting on them, providing independent perspective on the effectiveness of the monitoring process. This is distinct from the risk function's ownership of the indicators themselves.

Inside KRI

Metric Definition
A clearly specified, typically quantifiable measure selected because it correlates with, or provides early warning of, changes in a particular risk exposure. The definition should state what is being measured, the data source, and the calculation method to ensure consistency over time.
Threshold and Escalation Levels
Predefined trigger points (often tiered, such as green/amber/red) that indicate when an indicator has moved into a range warranting attention, review, or escalation. Thresholds are generally calibrated to an organization's risk appetite and risk tolerance rather than set arbitrarily.
Leading vs. Lagging Orientation
KRIs are intended to be predictive or forward-looking (leading), signaling a rising probability or impact of a risk before it materializes. This is a distinguishing feature from key performance indicators, which more often measure past outcomes, though in practice the two can overlap.
Risk Linkage
An explicit mapping of each indicator to a specific risk or risk category within the risk register or taxonomy, so that movement in the metric can be interpreted in terms of a defined exposure rather than in isolation.
Ownership and Monitoring Cadence
Assignment of accountability for tracking and reporting the indicator, typically to first-line management that owns the underlying process, together with a defined frequency of measurement and reporting appropriate to how quickly the risk can change.
Reporting and Governance Context
The pathway by which indicator results reach relevant committees, senior management, and the board or its risk/audit committee for oversight. The indicator supports informed discussion but does not, on its own, discharge oversight responsibilities.

Common questions

Answers to the questions practitioners most commonly ask about KRI.

Are key risk indicators the same as key performance indicators?
No, though the two are often confused and sometimes drawn from overlapping data. A key performance indicator (KPI) generally measures progress toward an objective or the outcome of past activity, whereas a key risk indicator (KRI) is typically forward-looking and designed to signal changes in the level of risk exposure or the likelihood that a risk may materialize. A single metric can sometimes serve both purposes depending on how it is framed and used, but treating them as interchangeable can obscure whether you are monitoring performance or monitoring exposure. The distinction matters for accountability, because the two often inform different decisions and different audiences.
Does a KRI measure whether our controls are working?
Not directly, and conflating the two is a common error. A KRI is generally intended to signal movement in a risk exposure or its drivers, while the effectiveness of a control is assessed separately through control testing, which examines both design and operating effectiveness. Some metrics used as KRIs may draw on control-related data, and a deteriorating KRI can prompt a review of related controls, but a KRI is not a substitute for control assurance activities typically owned by management and evaluated by assurance functions. Understanding what a given indicator actually measures is essential before relying on it.
How do you set a threshold for a KRI?
Thresholds are generally set by reference to an organization's articulated risk appetite and tolerance, so that a breach signals that exposure is approaching or has exceeded an agreed level. In practice, thresholds are often informed by historical data, expert judgment, and the sensitivity required for the indicator to give useful lead time before a risk materializes. Many organizations use tiered thresholds, such as amber and red bands, to prompt escalating responses. Threshold-setting depends heavily on the specific risk, the entity's context, and the quality of available data, and it is typically revisited as conditions change. This is a matter of professional judgment rather than a fixed formula.
Who is responsible for monitoring and acting on KRIs?
Responsibilities generally follow the organization's governance and assurance structure. Under a common three-lines model, the business units that own the risk typically monitor operational KRIs and respond to breaches, while the risk management function often designs the KRI framework, aggregates indicators, and reports to management and the board. The board or a relevant committee generally exercises oversight of the risk profile that KRIs help illuminate, rather than performing day-to-day monitoring. The precise allocation depends on the entity's size, sector, and chosen operating model, and should be defined clearly so accountability is not ambiguous.
How many KRIs should an organization track?
There is no universally correct number, and the appropriate count depends on the size and complexity of the organization and the range of risks being managed. A practical consideration is that too many indicators can dilute attention and obscure the most significant exposures, while too few may leave material risks unmonitored. Many practitioners favor a focused set tied to the most significant risks in the risk register, with indicators selected because they are relevant, measurable, and capable of prompting a decision or action. Selecting and pruning the set is a matter of ongoing judgment rather than reaching a target figure.
How often should KRIs be reviewed and reported?
Reporting frequency generally reflects how quickly the underlying risk can change and how much lead time is needed to respond, so some indicators may be monitored in near real time while others are reviewed periodically. Separately from routine monitoring, the KRI framework itself is typically reviewed at intervals to confirm that indicators remain relevant, that thresholds still align with risk appetite, and that data quality is adequate. Escalation timelines for breaches are usually defined in advance. The appropriate cadence depends on the risk, the organization's reporting cycles, and governance expectations, and should be documented rather than left implicit.

Common misconceptions

A Key Risk Indicator and a Key Performance Indicator are the same thing.
While they can overlap and a single metric may serve both purposes, they generally have different orientations. A KRI is intended to signal changes in a risk exposure, often on a forward-looking basis, whereas a KPI typically measures performance against an objective. Treating them interchangeably can obscure whether a metric is being used to monitor risk or to assess results.
Monitoring KRIs means a risk is being controlled or mitigated.
A KRI is a monitoring and early-warning tool, not a control. Observing an indicator provides information about the state of a risk but does not by itself reduce likelihood or impact. Risk mitigation depends on the design and operating effectiveness of controls, which are distinct from the indicators used to watch the exposure.
KRIs are a regulatory requirement that must follow a prescribed form.
The use of KRIs is generally a matter of good risk management practice and is described in various frameworks rather than being a universal legal mandate. Whether, and in what form, indicators are required varies by jurisdiction, sector, and entity type; certain regulated industries may have specific expectations, but there is no single universally applicable prescribed format.

Best practices

Map each indicator explicitly to a defined risk in the risk register so that its movement can be interpreted against a known exposure rather than viewed in isolation.
Calibrate thresholds and escalation levels to the organization's stated risk appetite and risk tolerance, and document the rationale so they are not perceived as arbitrary.
Favor indicators with a genuine leading or predictive quality where feasible, and avoid presenting purely backward-looking performance measures as early-warning risk signals.
Assign clear ownership, typically to the first-line management that operates the underlying process, and set a monitoring frequency that matches how quickly the associated risk can change.
Establish a defined reporting pathway to the relevant management forum and, where appropriate, to the board or its risk or audit committee, while remembering that indicators inform oversight rather than replace it.
Review the relevance and calibration of indicators periodically, retiring metrics that no longer provide useful signal and adjusting thresholds as the risk environment and the organization's appetite evolve.