A risk register can tell an organisation what its risks looked like at the time of the last assessment. It cannot, by itself, show whether the conditions surrounding those risks have changed since then.
Customer complaints may be increasing. A critical supplier may be missing more service targets. Staff absence may be placing additional pressure on an important process. Control failures may be accumulating while the risk’s formal score remains unchanged.
Key Risk Indicators, commonly called KRIs, help organisations recognise these changes before they become serious incidents, control failures or missed objectives.
However, effective risk monitoring requires more than adding several red, amber and green metrics to a dashboard. A useful KRI must be connected to a defined risk, an organisational objective, an agreed threshold, a responsible owner and a clear response.
This guide explains what Key Risk Indicators are, how KRIs differ from KPIs, how to choose meaningful indicators and what should happen when a threshold is breached.
What is a Key Risk Indicator?
A Key Risk Indicator is a measure used to monitor a change in risk exposure or in the conditions that could affect an organisation’s objectives.
A KRI may provide an early warning that:
The likelihood of a risk is increasing
The possible consequences are becoming more serious
A control may not be operating as expected
Exposure is approaching or exceeding the organisation’s risk appetite
A risk treatment is not producing the intended result
Management action or escalation may be required
The Institute of Operational Risk describes KRIs as tools that help business managers, senior management and boards monitor the level of risk-taking within an activity or organisation. COSO has similarly published guidance on developing KRIs to strengthen enterprise risk management.
KRIs therefore sit between risk assessment and management action. Their purpose is not simply to describe performance; it is to provide information that helps someone decide whether the organisation’s exposure remains acceptable.
Why are Key Risk Indicators important?
Risk assessments are inevitably based on the information available at a particular point in time. Even when they are reviewed regularly, the organisation’s internal and external environment continues changing between formal review dates.
ISO 31000 describes risk management as a process that includes identifying, analysing, evaluating, treating, monitoring and communicating risk. It also emphasises monitoring, review and continual improvement rather than treating risk assessment as a one-time exercise.
The HM Treasury Orange Book takes this further for public-sector organisations. It calls for integrated and informative risk monitoring, timely reporting and agreed triggers that allow significant matters to be escalated rapidly. It also says that dashboards should compare results against key performance and risk indicators, show trends and support early warning.
Without meaningful monitoring, organisations can experience a dangerous gap between the risk recorded in the register and the exposure developing in practice.
A risk may still be displayed as green even though:
Related incidents are increasing
Control-testing results are deteriorating
Remedial actions are overdue
Supplier performance is weakening
Complaints reveal a recurring failure
Staff capacity is falling below a safe level
Regulatory obligations are approaching without sufficient preparation
The risk register may be accurate according to its last review date, but it is no longer decision-ready.
KRI versus KPI: what is the difference?
Key Risk Indicators and Key Performance Indicators are closely related, but they answer different questions.
A KPI asks:
Are we achieving the result we intended?
A KRI asks:
Is changing exposure threatening our ability to achieve that result?
Consider an organisation with an objective to respond to customer enquiries within a defined period.
A KPI might measure the percentage of enquiries answered on time.
Related KRIs could monitor:
Staff vacancy levels
Unplanned absence
The volume of unresolved cases
System downtime
Increasing complaint rates
Dependence on a single service provider
The KPI reports whether the target is currently being achieved. The KRIs help management understand whether the organisation’s ability to continue achieving it is under pressure.
Some measures may operate as both performance and risk indicators, depending on how they are used. The label matters less than the decision the measure is intended to support.
Leading and lagging Key Risk Indicators
One important distinction is between leading and lagging indicators.
Leading KRIs
Leading indicators identify changing conditions that could result in a future event.
Examples include:
Rising staff turnover in a critical team
An increase in overdue control reviews
Declining supplier service performance
Growth in unpatched critical vulnerabilities
Increasing processing volumes without additional capacity
A higher proportion of mandatory training approaching expiry
These indicators are valuable because they can create time for intervention.
Lagging KRIs
Lagging indicators measure events or consequences that have already occurred.
Examples include:
Number of data breaches
Financial losses caused by incidents
Missed regulatory deadlines
Customer complaints received
Failed recovery tests
Repeat audit findings
Health and safety incidents
Lagging indicators remain important. They provide evidence about whether risks have crystallised and whether existing controls are effective. But an organisation relying only on lagging measures may discover problems after the opportunity for prevention has passed.
A balanced KRI framework will normally use both. Leading indicators support anticipation; lagging indicators support learning, validation and corrective action.
Examples of Key Risk Indicators
The appropriate KRI will depend on the organisation’s objectives, activities, risk appetite and operating environment.
| Risk area | Example KRI | Possible management response |
|---|---|---|
| Third-party failure | Increasing missed supplier service levels | Review the supplier, controls and continuity arrangements |
| Cybersecurity | Growth in unresolved critical vulnerabilities | Escalate remediation and reassess cyber exposure |
| Compliance | Increase in overdue regulatory actions | Escalate ownership and review available resources |
| Workforce capacity | Vacancy or absence rate in a critical function | Review service resilience and contingency arrangements |
| Customer service | Rising complaint frequency or repeat complaints | Investigate possible process or control weaknesses |
| Financial risk | Variance from cash-flow or liquidity thresholds | Review forecasts, controls and contingency plans |
| Business continuity | Failed recovery exercises or untested plans | Create corrective actions and schedule retesting |
| Internal audit | Repeated or overdue high-priority findings | Reassess control effectiveness and management accountability |
| Data protection | Increase in overdue DPIA reviews | Review changes in processing activities and privacy controls |
| Health and safety | Rise in near misses or unresolved corrective actions | Investigate causes and review preventive controls |
These examples are starting points, not universal metrics. A KRI becomes useful only when the organisation understands why the measure matters and how it relates to a specific risk.
How to select an effective KRI
A large volume of data does not automatically create better risk intelligence. Poorly chosen KRIs can make dashboards busier without improving decisions.
An effective KRI should meet several tests.
1. It is connected to a defined risk
Every KRI should identify the exposure it is intended to monitor.
If no one can explain which risk would change because the indicator moved, the measure may be operational data rather than a meaningful risk indicator.
2. It relates to an organisational objective
Risk is the effect of uncertainty on objectives. Monitoring becomes more valuable when the organisation can see not only that an indicator has changed, but which strategic, operational or service objective may be affected.
The relationship should be clear:
Objective → Risk → KRI → Management response
3. It can be measured consistently
The organisation should define:
The source of the information
How the indicator is calculated
How frequently it is updated
Who owns the data
Any limitations affecting its reliability
Changing the calculation or source without explanation can create misleading trends.
4. It provides sufficient warning
The most useful KRIs allow time for an appropriate response.
For example, measuring the number of critical employees who have already left is less predictive than monitoring turnover intentions, recruitment times and vacancies in essential roles.
5. It has an accountable owner
Someone must be responsible for reviewing the indicator, explaining changes and initiating the agreed response.
Ownership of the metric may be different from ownership of the underlying risk. Both responsibilities should be visible.
6. It leads to a decision or action
A KRI without a response process is merely a number.
Before adopting an indicator, ask:
What would we do differently if this measure breached its threshold?
If there is no meaningful answer, reconsider whether the indicator belongs on the risk dashboard.
How to set KRI thresholds
Thresholds convert measurements into decision points.
A common approach uses three levels:
Green: Exposure remains within the accepted range
Amber: Exposure is approaching the agreed limit and requires attention
Red: Exposure has exceeded tolerance and requires escalation or intervention
However, colour alone is insufficient. The organisation should document:
The basis for each threshold
Its relationship with risk appetite and tolerance
The person responsible for monitoring it
The escalation route
The response required at each level
Whether the threshold applies to a single result or a continuing trend
When the threshold was last reviewed
Thresholds should not be selected simply because they produce an attractive distribution of red, amber and green results. They should reflect the point at which exposure becomes significant enough to require a different decision.
The Orange Book expects boards to consider whether decisions are being taken within risk appetite and whether changes are required to strategy, resources, policies or controls. It also identifies early-warning indicators as part of risk-treatment planning and monitoring.
What should happen when a KRI turns red?
A red indicator should not automatically change a risk score without review. Nor should it remain on a dashboard without an accountable response.
A proportionate workflow could include:
Validate the result. Confirm that the data is complete, current and calculated correctly.
Notify the appropriate owner. Alert the KRI owner, risk owner and other responsible parties.
Understand the cause. Determine whether the change is temporary, systemic or connected to another event.
Review the associated risk. Consider whether likelihood, impact, velocity or proximity has changed.
Examine relevant controls. Establish whether controls are operating effectively or require additional testing.
Review related incidents and findings. Identify whether the KRI is supported by other evidence.
Create or update actions. Assign responsibility, deadlines and expected outcomes.
Escalate where required. Follow the agreed reporting route when exposure exceeds tolerance.
Monitor the response. Confirm whether the action reduces exposure rather than merely being marked complete.
Retain the evidence. Preserve the decision, rationale, approval and outcome for future assurance.
The value comes from this connected response, not from the red indicator itself.
Common KRI mistakes
Monitoring too many indicators
A dashboard containing dozens of measures for every risk can conceal rather than reveal important information.
Focus on indicators that materially improve oversight and decision-making.
Selecting what is easy to measure
Available data is not necessarily useful data. Organisations often select measures because the information already exists, even when it has little predictive relationship with the risk.
Confusing performance with exposure
A missed performance target may be important, but it does not automatically explain how risk is changing. The organisation should establish why the result is a risk signal.
Using only lagging indicators
Incident and loss information supports learning, but it may arrive too late to prevent the event. Include measures that reveal changing conditions before a risk crystallises.
Treating every threshold breach identically
Responses should be proportionate to the importance, velocity and possible consequences of the risk.
Failing to review the indicators
A KRI that was useful two years ago may no longer represent the organisation’s present activities, controls or external environment.
Separating KRIs from the wider risk process
When indicators sit in a standalone spreadsheet or dashboard, risk owners may see the warning without the controls, incidents, actions and evidence needed to respond.
From risk monitoring to connected risk management
The practical challenge is not simply collecting risk data. It is connecting each signal to the part of the organisation that must interpret and act on it.
Simply Business described the value of giving owners the information and prompts needed to manage their risks:
“The tracker and email notification is really useful to help risk owners monitor and manage their risks by self serving.”
Its case study explains how the organisation brought risk registers, assessments and its controls library together, with the ability to link risks and incidents and create customised management information.
This illustrates the difference between isolated reporting and connected risk management. A KRI is more valuable when users can move directly from the warning to:
The affected risk
The objective potentially threatened
The relevant controls
Related incidents and complaints
Previous assessments
Current actions
Supporting evidence
The accountable owner
Reporting must remain understandable as well as comprehensive. As ICAEW said of Symbiant:
“Its simplicity and ease of use aligned with its flexibility and extensive reporting capabilities make it a very useful tool.”
Managing Key Risk Indicators with Symbiant GRC Software
Symbiant’s Key Risk Indicators module helps organisations record, monitor and report the measures associated with their risks.
Within the wider Symbiant platform, KRIs can form part of a connected management process involving:
Business objectives
Risk registers
Risk owners
Risk appetite and thresholds
Controls and policies
Incidents
Audit findings
Corrective actions
Reports and dashboards
Rather than viewing an indicator as an isolated result, teams can examine the wider context surrounding the risk and determine what needs to happen next.
Symbiant is modular, allowing organisations to begin with the capabilities they need and expand their connected risk and assurance environment over time.
Key Risk Indicator checklist
Before introducing or approving a KRI, ask:
Which risk does the indicator monitor?
Which objective could be affected?
Is it leading, lagging or both?
What is the source of the data?
How frequently will it be updated?
Who owns the indicator?
Who owns the associated risk?
What are the green, amber and red thresholds?
How do those thresholds relate to risk appetite?
What action follows each threshold?
Who must be notified?
When should the issue be escalated?
Which controls should be reviewed?
How will the response be documented?
When will the KRI itself be reviewed?
If these questions cannot be answered, the organisation may have a metric, but it does not yet have an effective Key Risk Indicator.
Conclusion
Key Risk Indicators help organisations move from periodic risk assessment to active risk monitoring.
The aim is not to create more dashboards. It is to recognise meaningful changes early enough to protect objectives, review controls and take accountable action.
The most effective KRI frameworks connect each indicator to a defined risk, an agreed threshold, a responsible owner and an established response. They combine leading and lagging measures, make trends visible and retain the evidence supporting management decisions.
A risk score shows what the organisation currently believes about its exposure.
A connected KRI shows when that belief may need to change.
Monitor changing risk before it becomes an incident
Connect Key Risk Indicators with your objectives, risks, controls, incidents and actions using Symbiant’s flexible Risk Management Software.
Explore Symbiant’s Key Risk Indicators software or book a demonstration.
