Key risk indicator
KRIAlso called risk indicator
A key risk indicator is a metric that signals a change in a firm's exposure to a risk before a loss occurs. Examples include system downtime, staff turnover or overdue alert reviews. Each KRI has thresholds, and a breach triggers escalation. KRIs link a firm's risk appetite to day-to-day monitoring.
How it works
A risk team picks metrics that move ahead of losses. A financial crime unit might track the backlog of unreviewed alerts. Each KRI gets green, amber and red thresholds set in line with risk appetite. Data feeds update it monthly or daily. An amber reading prompts the owner to act, while red goes to a risk committee.
KRIs differ from key performance indicators, which measure how well something is done rather than how risky it is. Supervisors expect banks to use them alongside self-assessments and loss data. The Basel Committee's 2021 principles set expectations for how banks monitor operational risk. Good KRIs give boards early warning.
The rules
Sets the Basel Committee's principles for how banks govern, identify, assess, monitor and control operational risk.
Banks under Basel Committee standardsCommon questions
What is the difference between a KRI and a KPI?
A key performance indicator measures how well a process performs against a goal. A key risk indicator measures exposure to a risk. The same metric can serve both, but a KRI has thresholds tied to risk appetite and escalation.
What makes a good KRI?
A good KRI is measurable, available on time and moves before losses occur. It has an owner and clear thresholds. It links to a specific risk in the register so a breach leads to a defined action.
How many KRIs should a firm track?
There is no set number. Firms aim for a focused set covering their material risks, since too many indicators dilute attention. Boards typically see a short list of top-level KRIs, with detail held at business unit level.
How do KRIs relate to the RCSA?
The RCSA rates risks and controls periodically. KRIs monitor them between assessments. A KRI breach can prompt a fresh look at a risk rating, and RCSA findings can identify new indicators to track.
