---
name: key-risk-indicators
description: Use when asked to define or choose a Key Risk Indicator (KRI) — an early-warning metric for organizational risk — as the risk-focused counterpart to key-performance-indicators's performance-focused metrics, typically used together for a full view of health.
---

# Key Risk Indicators (KRIs)

A Key Risk Indicator (KRI) is a metric that assesses the level of risk in
a process — giving an early warning of potential risk and helping
identify trends that could negatively affect the organization before
they become actual incidents. KRIs are typically specific to a given
organization or industry, and are monitored on an ongoing basis rather
than checked only periodically.

## What KRIs cover

Both financial and non-financial risk: operational, strategic,
regulatory, and reputational, among others — a KRI program limited to
only financial risk misses whole categories of exposure that can matter
just as much to an organization's health.

## Good KRIs are SMART

The same [[smart-criteria]] discipline applied to risk metrics
specifically:

- **Specific** — tailored to the actual organization/industry, measuring
  a risk genuinely relevant to it rather than a generic, borrowed metric.
- **Measurable** — easy to measure, giving a clear indication of risk
  level rather than a vague qualitative impression.
- **Actionable** — provides real insight into how the risk could be
  mitigated, so a rising indicator actually points toward a specific
  response.
- **Relevant** — aligned with the organization's overall objectives, so
  risk management supports rather than distracts from strategic goals.
- **Timely** — monitored on an ongoing basis, so early warning signs are
  caught and addressed while there's still time to act, not discovered
  after the fact.

## KRIs vs. KPIs

KRIs and [[key-performance-indicators]]'s KPIs are used together,
not instead of each other: KPIs measure performance against goals; KRIs
measure the level of risk to achieving those goals. Together they give a
more complete view of an organization's performance, risk, and overall
health than either alone — a strong KPI trend can mask a rising KRI that
predicts trouble ahead, which is exactly why both are tracked side by
side rather than one being treated as sufficient on its own.

## Common pitfalls

- **Tracking only lagging risk indicators** — a KRI's whole value is
  early warning; an indicator that only confirms a risk has already
  materialized has lost the "K" (key, early-warning) part of its purpose.
- **Generic, borrowed KRIs** — a risk indicator copied from another
  organization or industry without adapting it to actual context often
  fails the "Specific" and "Relevant" SMART criteria.
- **KRIs tracked with no owner or response plan** — an indicator that
  rises with nobody responsible for acting on it functions as a warning
  nobody's listening to.
- **No connection to KPIs** — tracking risk and performance in
  completely separate, unconnected processes misses the value of seeing
  both together.

## Learn more

- [[key-performance-indicators]] for the performance-focused counterpart KRIs are typically tracked alongside.
- [[smart-criteria]] for the goal-quality criteria KRIs should meet.
- [[risks-actions-issues-decisions]] for the project-level (rather than ongoing-organizational) risk-tracking counterpart.