Key Risk Indicators

A Key Risk Indicator (KRI) is a metric that assesses the level of risk in a process — giving an early warning of potential risk and helping identify trends that could negatively affect the organization before they become actual incidents. KRIs are typically specific to a given organization or industry, and are monitored on an ongoing basis rather than checked only periodically.

What KRIs cover

Both financial and non-financial risk: operational, strategic, regulatory, and reputational, among others — a KRI program limited to only financial risk misses whole categories of exposure that can matter just as much to an organization's health.

Good KRIs are SMART

The same Smart Criteria discipline applied to risk metrics specifically:

• Specific — tailored to the actual organization/industry, measuring a risk genuinely relevant to it rather than a generic, borrowed metric.
• Measurable — easy to measure, giving a clear indication of risk level rather than a vague qualitative impression.
• Actionable — provides real insight into how the risk could be mitigated, so a rising indicator actually points toward a specific response.
• Relevant — aligned with the organization's overall objectives, so risk management supports rather than distracts from strategic goals.
• Timely — monitored on an ongoing basis, so early warning signs are caught and addressed while there's still time to act, not discovered after the fact.

KRIs vs. KPIs

KRIs and Key Performance Indicators's KPIs are used together, not instead of each other: KPIs measure performance against goals; KRIs measure the level of risk to achieving those goals. Together they give a more complete view of an organization's performance, risk, and overall health than either alone — a strong KPI trend can mask a rising KRI that predicts trouble ahead, which is exactly why both are tracked side by side rather than one being treated as sufficient on its own.

Common pitfalls

• Tracking only lagging risk indicators — a KRI's whole value is early warning; an indicator that only confirms a risk has already materialized has lost the "K" (key, early-warning) part of its purpose.
• Generic, borrowed KRIs — a risk indicator copied from another organization or industry without adapting it to actual context often fails the "Specific" and "Relevant" SMART criteria.
• KRIs tracked with no owner or response plan — an indicator that rises with nobody responsible for acting on it functions as a warning nobody's listening to.
• No connection to KPIs — tracking risk and performance in completely separate, unconnected processes misses the value of seeing both together.

Learn more

• Key Performance Indicators for the performance-focused counterpart KRIs are typically tracked alongside.
• Smart Criteria for the goal-quality criteria KRIs should meet.
• Risks Actions Issues Decisions for the project-level (rather than ongoing-organizational) risk-tracking counterpart.