What are Key Risk Indicators (KRIs) and how are they used in risk management?

• A. KRIs are the top risks in a registry with no action.
• B. KRIs are metrics signaling increasing risk exposure; they trigger actions when thresholds are breached.
• C. KRIs are major incidents logged after they happen.
• D. KRIs are financial performance indicators.

Answer: (B)

KRIs are metrics that signal rising risk exposure and are tied to action when thresholds are breached. They serve as early warning indicators that help you detect increases in risk before problems fully materialize. By tracking KRIs against predefined limits aligned with your risk appetite, you can trigger escalation, adjust controls, or implement remediation while there’s time to respond.

Think of KRIs as the safety checks on your risk environment. Examples include the percentage of critical controls not tested on time, the concentration of exposure to a single counterparty, or the rate of policy exceptions. When these indicators move toward or past their thresholds, the governance process kicks in to address the underlying risk.

Why the other descriptions don’t fit: KRIs are not just a registry of top risks with no action; they are operational signals that prompt targeted response. They aren’t records of incidents after they happen, which would describe post-event logging rather than proactive monitoring. And they aren’t simply financial performance measures; those are performance indicators (KPIs) focused on outcomes, whereas KRIs focus on risk levels and triggers.