How do you design effective Key Risk Indicators (KRIs) and what distinguishes a good KRI from a bad one?

Key Risk Indicators (KRIs) are quantitative metrics that provide early warning signals of increasing risk exposure or weakening controls. They sit between risk identification and loss events — ideally flagging problems before they materialize into actual losses.

KRI vs KPI Distinction:

A Key Performance Indicator (KPI) measures whether you're achieving business objectives. A KRI measures whether you're approaching risk thresholds. Sometimes the same metric serves both purposes — high revenue growth (KPI) might correlate with increased operational strain (KRI).

Properties of Effective KRIs:

1. Leading, Not Lagging — A good KRI predicts future risk events rather than just counting past losses. Employee turnover in the compliance department (leading) is more useful than the number of regulatory fines received (lagging).

1. Quantifiable and Measurable — 'Employee morale seems low' is not a KRI. 'Unplanned staff turnover rate in risk-sensitive roles exceeded 15%' is a KRI.

1. Linked to Specific Risks — Each KRI should map to one or more identified risks in the risk register. A generic 'customer complaints' metric is less useful than 'complaints related to unauthorized transactions.'

1. Threshold-Based — KRIs need green/amber/red thresholds that trigger escalation. Without defined thresholds, the metric is informational but not actionable.

1. Timely — Available frequently enough to serve as an early warning. A KRI that's only updated annually won't catch fast-developing risks.

Examples of Good vs Poor KRIs:

KRI Monitoring Framework:

• Green — Within normal range, monitored routinely
• Amber — Approaching threshold, increased monitoring frequency, management notification
• Red — Threshold breached, immediate escalation to senior management, remediation plan required

Common Mistakes in KRI Design:

• Selecting too many KRIs (50+ creates monitoring fatigue)
• Choosing only lagging indicators (counting losses after they occur)
• Setting static thresholds that don't adjust for business growth or seasonality
• Monitoring KRIs in isolation rather than looking for correlated signals across multiple indicators

Exam Focus: FRM I may test whether you can identify a leading vs lagging indicator, or select the most appropriate KRI for a given risk scenario.

Build your operational risk toolkit with our FRM practice questions.