What is a Critical Risk Indicator (KRI) used for?

• A. Signal rising risk levels and prompt management action before issues materialize
• B. Define risk appetite for the organization
• C. Track regulatory violations after they occur
• D. Replace the need for a risk assessment

Answer: (A)

KRIs are leading indicators that serve as early warning signals of rising risk, enabling management to act before issues materialize. By monitoring specific metrics and thresholds, the organization can spot drift in risk conditions and trigger timely controls or mitigations, reducing potential losses or exposures. This proactive monitoring complements ongoing risk assessments, giving a continuous view of how risk is evolving.

They’re not about setting risk appetite—that policy defines how much risk the company is willing to accept, not when to intervene. They’re not used to track regulatory violations after the fact—that’s more about compliance monitoring and post‑event analysis. And they don’t replace risk assessments; KRIs provide real‑time visibility that enhances, rather than substitutes for, the structured evaluation of risks.