Key Risk Indicators: Examples and How to Choose Them

Most organisations can list their top risks: a cyber attack, losing a major customer, a key supplier failing, a regulatory breach. Far fewer can say, at any given moment, whether those risks are getting more or less likely. Risk registers are usually reviewed quarterly at best, and the ratings change slowly, often only after something has gone wrong.

Key risk indicators, or KRIs, fill that gap. They are measures that signal when a risk is increasing, so you can act before it turns into an incident. This article explains what makes a good KRI, gives practical examples, and sets out a simple method for choosing and using them.

What is a key risk indicator?

A key risk indicator is a metric that gives early warning of a change in the likelihood or impact of a risk. Good KRIs are:

• Leading, not lagging. They change before the risk materialises, not after.
• Linked to a specific risk. Each one exists because it tells you something about a particular risk on your register.
• Measurable and regular. They can be tracked reliably, monthly or more often.
• Paired with thresholds. There is an agreed level at which the indicator triggers attention or action.

KRIs versus KPIs

Key performance indicators measure how well you are achieving your goals: revenue growth, customer satisfaction, delivery times. Key risk indicators measure how exposed you are to things that could stop you achieving them.

Sometimes the same metric can serve both purposes. Staff turnover is a performance measure for HR, and a risk indicator for losing critical knowledge. The difference lies in how you use it: KPIs track progress towards a target, while KRIs watch for movement towards a danger zone.

Examples of key risk indicators

The right KRIs depend on your organisation's risks, but the following examples show the kind of measures that work well.

People and culture

• Voluntary turnover in critical roles over the last 12 months.
• Number of key roles without a ready successor.
• Overtime levels or unused leave in high-pressure teams, as an early sign of burnout.
• Results of engagement survey questions about speaking up.

Operations and service delivery

• Backlog of work against agreed service levels.
• Number of critical processes depending on a single person.
• Unplanned downtime of key systems.
• Repeat failures or complaints about the same issue.

Technology and cyber security

• Number of critical vulnerabilities open longer than the agreed fix time.
• Proportion of accounts without multi-factor authentication.
• Number of systems running on unsupported software.
• Time since the last successful restore test of critical backups.

Suppliers and third parties

• Proportion of critical services provided by a single supplier.
• Number of key suppliers overdue for a risk review.
• Supplier performance against service levels for critical contracts.

Financial

• Cash headroom against forecast requirements.
• Concentration of revenue in the largest customers.
• Ageing of receivables beyond agreed terms.

Compliance and conduct

• Number of overdue policy attestations or mandatory training completions.
• Open audit actions past their due date.
• Volume and themes of whistleblowing reports.

How to choose your KRIs

A long list of indicators is easy to produce and hard to use. Follow a simple process to keep the set focused.

1. Start from your top risks

Take your most significant risks, usually no more than ten to fifteen, and work on those first. KRIs for minor risks add noise without much value.

2. Ask what would change first

For each risk, ask: "If this risk were becoming more likely, what would we see first?" Think about causes and early symptoms, not the incident itself. For the risk of losing a major customer, the incident is the customer leaving; early signs might be falling usage, unresolved complaints or a change in their key contact.

3. Check the data exists

The best indicator in theory is useless if you cannot measure it reliably. Prefer measures you already collect. Where data is missing, decide whether it is worth the effort to start collecting it.

4. Set thresholds

Agree what level of the indicator is acceptable, what level needs attention, and what level needs escalation. A common approach is a simple traffic light:

• Green: within appetite, no action needed.
• Amber: approaching the limit; the risk owner investigates and decides whether to act.
• Red: outside appetite; escalate to the agreed level and take action.

Thresholds should reflect your risk appetite. If you have not yet defined one, our guide to writing a risk appetite statement explains how, and shows how appetite and indicators work together.

5. Assign owners and reporting

Each KRI needs an owner responsible for monitoring it and acting when thresholds are crossed. Decide how often it is reported, and to whom.

Using KRIs well

• Keep the set small. Two or three indicators per major risk is plenty. A board-level dashboard might show ten to twenty in total.
• Show trends. A single number tells you little; a trend over the past six or twelve months tells you whether things are getting better or worse.
• Review the indicators themselves. Once a year, ask whether each KRI actually gave useful warning. Replace the ones that never move or always lag behind events.
• Act on amber. The value of a KRI is in the time it gives you to respond. If amber signals are routinely ignored until they turn red, the system is not working.

Where KRIs fit in risk management maturity

Organisations at the earliest stage of risk management discover risks when they turn into incidents. As they mature, they introduce regular reviews, and then indicators that provide earlier warning. The most mature organisations monitor a focused set of leading indicators continuously and act on them as a matter of routine.

The Risk Management assessment includes questions on early warning indicators, alongside risk identification, assessment, treatment, culture and governance. It is a useful way to see whether better indicators would help most, or whether another part of your risk practice needs attention first.

Frequently asked questions

How many key risk indicators should we have?

Focus on quality rather than quantity. Two or three indicators for each of your top ten to fifteen risks usually gives a manageable set of twenty to forty, with the most important shown to senior leaders.

How often should KRIs be reviewed?

Most KRIs should be measured monthly. Fast-moving risks, such as security or operational risks, may need weekly or even daily monitoring.

Who should set KRI thresholds?

Risk owners usually propose thresholds, which should be consistent with the risk appetite approved by the board or senior leadership.