4/12/2018 Key Risk Indicators, Scorecard, and Template | BSC Designer

Balanced Scorecard Software Free Trial Pricing Training Articles Support

search here … Go

Home › Articles › KRI › Key Risk Indicators, Scorecard, and Template

Key Risk Indicators, Scorecard, and Template

Last updated on August 31, 2016, first posted on September 30, 2014 by BSC Designer Team

k a d h f s 177 1 Total: 181

Properly designed risk framework supports risk discussion in your company. It combines indicators
that allow estimating risk probability, risk impact, and risk control actions. KRIs are not that different
from KPI; Risk Management frameworks are not that different from the Balanced Scorecard. Let’s start
the discussion about Key Risk Indicators best practices.

The idea of risk

What is risk and how can one measure and control it? Intuitively one understands that risk is
something regarding a danger/threat that might happen with a certain probability and result in some
type of negative outcomes. This perception is generally correct with one exception: risk doesn’t always
need to be a threat for a business, it might be an opportunity as well.

The older definition of risk in ISO was “a chance or probability of loss,” while the latest ISO
31000:2009 defines risk as “the effect of uncertainty on objectives.”

In other words, the modern definition of risk recognizes that risk is not only about threats, but about
opportunities as well.
This website uses cookies to improve your experience. We'll assume you're ok with this, but you can opt-out if you wish.
Read More

https://bscdesigner.com/key-risk-indicators-kris-and-risk-scorecards.htm 1/8
4/12/2018 Key Risk Indicators, Scorecard, and Template | BSC Designer

Losing your key employee might be a threat on the one hand, but on the other hand you might find a
new one that will bring to your company new skills and ideas. Everything depends upon the business
context (business objectives).

What are Key Risk Indicators?

As their name states, KRIs are indicators that are key for the risk management process.

“Key” word implies that there cannot be hundreds of KRIs; so if you have 100+ KRIs, then most
likely these are just risk metrics.

Most of the principles that we discussed for KPIs (Key Performance Indicators) apply to KRI:

They need to have a proper business context,

Their need to be measurable,
There have to be a person responsible for KRI,
There should be a buy in from the team, etc.

Having said that, I recommend checking out the article: Why most KPIs don’t work and what to do
about this. When reading, replace “KPI” with “KRI” and you can easily use all the same ideas and
recommendations.

For now, it is enough to define KRI as those risk metrics that are an important part of your risk
management portfolio. As it comes from the definition of the risk in ISO standard, the ultimate
decision of what is and is not a risk depends on a company’s objectives, so be careful when copying KRIs
from others.

The difference between KRI and KPI

In some literature KPIs and KRIs are strongly divided, the first are responsible for
business performance and the second are about risk. As an example of a typical KPI that is not a KRI
that is often used is “Net Profit.”

“Net profit is a KPI because it doesn’t tell us anything about the risk level or risk control!” –
often suggest authors.

The thing is that “Net profit” by itself doesn’t tell us either anything about performance or the way one
wants to increase it!

To make a use of “Net profit” we need to put it in a proper business context, add thresholds, baseline,
and target marks, and add some relevant action plan:

KPI: “Net profit”

Current level: $200 K
Baseline: $205 K
Target: $300 K
Stop light: red
This website uses cookies
Action to improve
plan: “We your experience.
failed because We'll
of the old assume
sales team!you're
Hire aok with
new this,team!”
sales but you can opt-out if you wish.
Read More

https://bscdesigner.com/key-risk-indicators-kris-and-risk-scorecards.htm 2/8
4/12/2018 Key Risk Indicators, Scorecard, and Template | BSC Designer

Have a look at this KPI! Doesn’t it look like a KRI now? For sure, we don’t have metrics for probability
and impact, but we can easily add them…

Another thought that supports the idea of the similar nature of KRIs and KPIs:

KPIs need to be aligned with the business strategy; and how one determined this strategy?
Didn’t we use SWOT (where T stands for “threats”) method to come up with hypothesis (risk
analysis) and possible solutions (risk control)?

Well, I’m exaggerating, but I personally don’t see any fundamental difference. I am ready to argue
about this in the comments. For sure, KRIs are more “risk-oriented,” but if one needs, a KRI can be
converted into a KPI and vice-versa.

Mapping risks to KRI. Defining Key Risk Indicators.

Here comes an interesting part. Let’s talk about Risk Management. Managing risks is about managing
the chain of:

Detecting/predicting threats/opportunities
Estimating the chance that they will happen (their probability)
Controlling the impact/outcomes

Normally, we cannot map all these aspects of the risk in one KRI, so we will normally need 3 indicators:

Indicator that would measure probability

Indicator that would measure the impact
Indicator that would measure action plan

For example, for such KRI as “Poor mentoring of employees” we would have:

Time spend on mentoring per week, hours. This indicator estimates risk probability, the less
This website uses cookies to improve your experience. We'll assume you're ok with this, but you can opt-out if you wish.
hours one spends mentoring others, and the more likely the company will face this risk.
Read More

https://bscdesigner.com/key-risk-indicators-kris-and-risk-scorecards.htm 3/8
4/12/2018 Key Risk Indicators, Scorecard, and Template | BSC Designer

Employee engagement index, %. This indicator helps to understand the impact of poor
communication. Less mentoring means less engagement from the part of employees.
Action plan: improve mentoring procedures; relevant indicator might be something like
“Leadership training passed, hours.” We need to teach managers a proper leadership paradigm
that would include mentoring.

Which of those indicators is a KRI? I’d say that the pair of “probability” and “impact” indicators form
the KRI. While the action plan indicator relates to the risk control procedures.

Template for a KRI Accept

Here is a template that one can use for a Key Risk Indicator.

Risk Template:

Risk Indicators Risk Control Plan Action

Indicator

Risk Probability Indicator: Action 1: Indicator 1:

Identification: ________ _________ _________
______________ Impact Indicator: Action 2: Indicator 2:
_________ _________ _________

Example discussed above will look like:

Risk Indicators Risk Control Plan Action Indicator

Risk Probability Indicator: Action 1: Indicator 1:

Identification: Time spend on mentoring Improve mentoring Leadership training
“Poor mentoring of per week, hours procedures passed, hours.
employees” Impact Indicator:
Employee engagement
index, %
This website uses cookies to improve your experience. We'll assume you're ok with this, but you can opt-out if you wish.
Read More
Leading/lagging KPIs vs. probability/impact KRIs
https://bscdesigner.com/key-risk-indicators-kris-and-risk-scorecards.htm 4/8
4/12/2018 Key Risk Indicators, Scorecard, and Template | BSC Designer

When mapping business strategy we always suggest making sure that there are:

Leading indicators aligned with business objectives,

Lagging indicators aligned with business objectives, and an
Action plan.

Compare this to the “probability,” “impact,” and “control plan” and you will see what I mean.

Properly described strategy looks very similar to the properly done risk and control assessment.

How do risks appear on the map? Reporting culture.

As business objectives are projections of properly defined strategy, risks are projections of a properly
done risk analysis.

The basic step is to start with a classical risk assessment, drawing root-cause diagrams,
brainstorming possible problems and getting a list of the risks as a result.
The most important step is to implement in your company a proper reporting culture.
Employees should not only report about evident problems that already happened, but also
about situations where they were lucky enough to avoid the problem, but it could have
happened. Such reports will allow you to identify risks that you might have not thought about
before.

Establish a culture similar to one in NASA: if the problem appeared once, they conducted a careful
research about possible reasons why it happened; even if it did not repeat.

Covert separate pieces of information about Key

Performance Indicators into new skills and actionable
knowledge. Join "KPIs Training and Certification" by BSC
Designer to learn our time-proven KPI system and get a
lifetime access to the KPI training knowledge base.

More about KPI Training

How to use risk assessment and control model

The risk assessment model that was described above is nothing new, but you need it just as you need a
strategy map in business performance management. Specific numbers might be tricky and won’t give
you a specific information. Why have this model then?

As strategy map helps to discuss strategy, risk assessment model/scorecard needs to be a base
for further discussions related to the risk identification and control.

In this way you will implement risk control into the company’s DNA. It’s much better than regular
formal reporting of KRIs that has nothing to do with real problems.
This website uses cookies to improve your experience. We'll assume you're ok with this, but you can opt-out if you wish.
The list of the most popular KRIs Read More

https://bscdesigner.com/key-risk-indicators-kris-and-risk-scorecards.htm 5/8
4/12/2018 Key Risk Indicators, Scorecard, and Template | BSC Designer

We have the list of 89 KRIs delivered both in .BSC (BSC Designer) and Excel formats. Don’t take
these risk indicators as must-have for your business. As with KPIs, KRIs need to be aligned with
business context, if not, then you will be evaluating and trying to manage risk that will never occur in
your business.

KPIs in BSC Designer

In BSC Designer you can easily manager your KRIs. It can be a simple risk indicator with probability
and impact properties:

In this case BSC Designer can visualize necessary data on the risk chart:

or generate an HTML report:

This website uses cookies to improve your experience. We'll assume you're ok with this, but you can opt-out if you wish.
Read More

https://bscdesigner.com/key-risk-indicators-kris-and-risk-scorecards.htm 6/8
4/12/2018 Key Risk Indicators, Scorecard, and Template | BSC Designer

The main benefit is that indicators can be aligned with objectives on the strategy map.

Key take-aways
Risk is not just a threat, it is a business opportunity as well;
Put KRIs into proper business context;
KPI and KRI are not that different:

KRI need to be aligned with risk management strategy;

Make sure you control leading (probability) and lagging (impact) risk indicators;

Implement proper reporting culture;

Use risk scorecard as a base for the risk discussions;

Related Articles

Risk Assessment 89 KPIs in Risk Key Risk Indicators,

Guide License Assessment Guide Scorecard, and
Template

k a d h f s 177 1 Total: 181

This website uses cookies to improve your experience. We'll assume you're ok with this, but you can opt-out if you wish.
Posted in KRI Read More

https://bscdesigner.com/key-risk-indicators-kris-and-risk-scorecards.htm 7/8
4/12/2018 Key Risk Indicators, Scorecard, and Template | BSC Designer

0 Comments BSC Designer 

1 Login

Sort by Best
 Recommend 3 ⤤ Share

Start the discussion…

LOG IN WITH
OR SIGN UP WITH DISQUS ?

Name

Be the first to comment.

ALSO ON BSC DESIGNER

Balanced Scorecard and KPI Software – Questions & Answers about the
BSC Designer Balanced Scorecard
2 comments • 3 years ago 4 comments • 3 years ago
Aleksey Savkin — Hi Atul,I think for the Aleksey Savkin — Probably this checklist
general information about strategy will be helpful for your task:
definition, description, and execution it http://www.bscdesigner.com/...

Online Training: Building Balanced
Scorecard Step by Step
15 comments • 3 years ago
Aleksey Savkin — The materials of the
training are for the trainee and the
distribution/sublicense rights are not
Guide for Tracking Marketing KPIs and
Measuring Profitability
1 comment • 2 years ago
Aleksey Savkin — Here is a good example
of how AllSaints, UK fashion retailer with
stores across 16 different countries

✉ Subscribe d Add Disqus to your siteAdd DisqusAdd 🔒 Privacy

BSC Designer Contact Us Partners About Us Privacy and

Terms of Use Sitemap

© 2018 Balanced Scorecard Software – ↑ Back to Top

BSC Designer

This website uses cookies to improve your experience. We'll assume you're ok with this, but you can opt-out if you wish.
Read More

https://bscdesigner.com/key-risk-indicators-kris-and-risk-scorecards.htm 8/8