Key Risk Indicator (KRI)

KRIs exist to buy leaders time: they signal that a risk is rising while something can still be done about it. Where financial results tell you what already happened, a KRI is designed to move before the loss. The dependent decision is escalation — a defined threshold turns a drifting trend into a mandatory action by a named manager. Without indicators, risk reports describe the past in ever finer detail.

KRIs are defined by risk owners together with the risk function, reviewed monthly, and reported alongside the risks they track in the register and the risk dashboard. Each needs a threshold and a consequence: "share of orders delayed by the key supplier above 15% in a month — escalate to the head of procurement; above 25% — activate the alternative supplier". Three to five indicators per major risk are enough; thirty produce noise. The set is pruned yearly — an indicator that has never changed a decision is a candidate for deletion.

The classic failure is KRIs that measure the past — incident counts, last quarter's losses — dressed up as early warning. Lagging data confirms the damage; it does not prevent it. Designing genuinely leading indicators, and wiring them to escalation, is covered in module M2 "From enterprise risk management to business resilience" of the ERGP programme.