Key control indicator
KCIAlso called control effectiveness indicator, control indicator
A key control indicator is a metric that shows whether a control is designed and working as intended. Where a key risk indicator tracks exposure to a risk, a key control indicator tracks the health of the control meant to reduce it. A worsening reading signals that residual risk is rising.
How it works
Each KCI is tied to a specific control and the risk that control addresses. Common examples are the share of reconciliations completed on time, the number of overdue user access reviews, the backlog of unreviewed monitoring alerts and the percentage of staff who have completed mandatory training. Each metric gets green, amber and red thresholds set from the firm's risk appetite.
Control owners report KCIs on a fixed cycle, usually monthly, and amber or red readings trigger investigation and remediation. Risk teams read KCIs next to the related key risk indicators and the results of risk and control self-assessments, so a control that looks effective on paper but keeps breaching its indicator gets retested.
The rules
Expect banks to identify, assess and monitor operational risk and the performance of controls, using tools such as risk indicators, control self-assessments and control monitoring and assurance.
Banks, through national supervisorsCommon questions
What is the difference between a KRI and a KCI?
A key risk indicator measures exposure to a risk, such as the number of failed trades. A key control indicator measures whether a control against that risk is working, such as the share of trades reconciled on time. Firms track both side by side.
What are examples of key control indicators?
Examples include reconciliations completed on time, overdue access reviews, unreviewed monitoring alerts, open audit findings past their due date and completion of mandatory training.
Who owns key control indicators?
The first line of defence owns the controls and usually reports the indicators. The second line sets the framework and challenges the readings, and internal audit tests that the indicators are accurate.
