Key Risk Indicators

Comment below for the full white paper

Topics include
Effect Indicators
Risk & Controls
indicators.
Using indicators.
Setting thresholds &
limits.
Risk indicator best
practice.
Reporting risk
indicators.
Triggers for escalation.
Reporting to different
audiences.
 Key Risk Indicators
A risk indicator acts as a proxy for risk exposure. A
change in the value of a risk indicator signals
a change in probability and or impact.

Causal Indicators Effect Indicators

Number and type of causes The direct financial cost of operational

identified in loss event or near miss loss events (asset write downs,
data collection provisions for liability claims)

Staff turnover The indirect costs of operational loss

(as a % of staff) events (lost market share, goodwill
payments to customers, fines, etc)

Staff morale Duration of staff absence due to

(collected from surveys) health & safety incidents

Number of attempted IT hacking Number and duration of disruptions

attacks to operational processes and systems

Number of overdue Audit actions Number of negative social media

posts following a loss event
 Key Risk Indicators
‘Leading’ indicators provide management with
sufficient lead time to correct the situation before
operational risk events happen.

Leading Indicators Lagging Indicators

Pay gap and job satisfaction Staff turnover as a measure of

metrics to capture the causes staff morale
of staff resignations

Metrics on Customer complaints

product/service quality
control

Frequency of policy and Losses from breaches

procedure breaches

Frequency of Cost of machine/vehicle

machine/vehicle servicing breakdowns
 Key Risk Indicators
A breach of an indicator i a signal of potential threats ahead.
Getting the indicator back into the amber or green does not
necessarily mean that these threats have been averted.

Red The value of this indicator is far too high/low

suggesting that the organisation may be exposed to
significant risk.
Immediate action is required on the part of
management to manage the risk(s) in question

The value of this indicator is higher/lower than

Amber
normal suggesting that the organisation may be
exposed to a potentially significant level of risk.
Management attention is required to determine
whether action needs to be taken soon.

The value of the indicator is within normal

Green
parameters, suggesting that the organisation is not
exposed to significant risk.
No action is required – the indicator and its
associated risks are under adequate control.
 Key Risk Indicators
Different audiences within an organisation will
require different reports on risk indicators.

High level risk reports to support governance and strategic

Board decisions. Need to be kept simple and short, common to use
heat maps and short KRI reports

Senior More detailed, to support allocation of resources and

Divisional escalation, but still relatively high level. Likely to focus
Management on broad categories of risk (Fraud, OHS, etc)

Business More detailed still. Will cover a range of indicators

Unit related to all categories of operational risk events.

Individual Teams Strong functional and performance focus.

A detailed range of metrics will be
and Support
monitored to ensure efficient and
Functions
reliable operations and systems.
 Key Risk Indicators
Reporting should be linked to the timeliness of decision-making and
different frequency will be required to suit specific audiences.

Benefits Suitable For Drawbacks

Potential risk or Dealing with routine

Daily control issues issues (e.g. a call
Too frequent to
Local allow detailed
identified centre or IT
Management analysis
immediately function)

May not capture

Weekly Track common
the full extent of
Local issues on a regular As above
an ongoing issue
Management basis
or concern

Monthly Aligns with monthly Monitoring

May not be
Local & Senior management operational
sufficiently timely
Managemet committees performance

Aligns with quarterly

Quarterly reporting and
Monitoring threats Lacks sufficient
Snr Management to organisation detail
many audit/risk
& Board objectives Not timely
committees

Yearly Concurrent with year Monitoring threats Lacks sufficient

Snr Management end financial results to organisation detail
& Board and reports objectives Not timely
 Key Risk Indicators
Features of a sound KRI /
indicator reporting process
Where possible operational risk
indicator reports should be developed
in conjunction with the
intended audience to ensure
maximum comprehension and
usability.
Short – Avoid detailed reports
with large numbers of indicators.
Effect
Simple – No Indicators
jargon terms
complex mathematical formulae.
Timeliness – Promptly so that
they can be acted upon.
Accuracy – Inaccurate metrics
are a false picture of exposure.
Trending – Make clear the
historical trends of indicators
Clear escalation procedures –
know when to escalate areas of
concern.
Compliance – With any
regulations, where appropriate.