A key risk indicator is a measurable signal associated with changes in exposure. A useful KRI provides enough warning for someone to act, has a reliable data source, and is linked to a threshold, owner, and response.
Leading and lagging indicators
Leading indicators show conditions that may increase future risk, such as vacancies, deferred maintenance, supplier concentration, or control exceptions. Lagging indicators show outcomes that occurred, such as incidents, losses, downtime, or complaints.
Design criteria
- Relevant to a specific risk and objective
- Timely enough to influence action
- Based on reliable data
- Clearly and consistently calculated
- Assigned to an owner
- Linked to warning and escalation thresholds
- Reviewed when conditions change
Set thresholds deliberately
Thresholds may reflect appetite, historical variation, capacity, contractual requirements, or a decision deadline. Avoid choosing boundaries merely because a dashboard needs colours.
Prevent overload
A long list of metrics can hide the few signals that matter. Start with causes, control assumptions, and early warning signs. Keep supporting operational metrics outside the executive KRI set where appropriate.
KRI record
| Element | Question |
|---|---|
| Definition | What exactly is measured? |
| Data source | Where does the value come from? |
| Frequency | How often is it refreshed? |
| Thresholds | What counts as warning or breach? |
| Owner | Who reviews and acts? |
| Response | What happens at each level? |
| Limitations | What does it fail to show? |
Start with the risk pathway
An indicator is useful when it relates to a cause, control, exposure, or consequence. A rising backlog may indicate capacity pressure; increasing exceptions may show control deterioration; supplier lead-time variability may signal disruption risk. Measures selected only because data is easy to collect can create dashboards with little decision value.
Set thresholds and actions together
Green, amber, and red bands should not be decorative. Define the measurement period, data owner, calculation, direction of concern, warning threshold, critical threshold, reporting frequency, and required response. Thresholds may need adjustment as more evidence becomes available.
Indicator quality checks
- Is the measure timely enough to support action?
- Can the data be reproduced and explained?
- Could behaviour be distorted to improve the number?
- Does a breach lead to a named decision or investigation?
- Are leading and lagging measures used in balance?