Which of the following provides an early signal of increasing risk exposures for an organization?

Key Risk Indicators (KRIs) are metrics designed to be leading indicators, providing an early warning that a risk is emerging or that an organization's exposure to a given risk is increasing. Unlike Key Performance Indicators (KPIs), which are typically backward-looking (lag indicators) and measure historical performance against objectives, KRIs are forward-looking. They are predictive and signal a higher probability of a future risk event occurring, allowing management to take proactive measures before the risk materializes into a loss or incident.

A. Key performance indicators (KPIs) are lag indicators that measure historical performance against targets, not early warnings of increasing risk.
B. Risk management policies and procedures are static governance documents that define rules; they are not dynamic indicators of risk exposure.
D. Capability maturity model integration (CMMI) is a framework for assessing and improving process maturity, not for providing real-time risk signals.

1. ISACA, "Risk IT Framework, 2nd Edition," 2020, Page 43, Section 3.4.2 "Collect Risk Data," states, "Key risk indicators (KRIs) are leading indicators that allow for proactive management of risk."

2. ISACA, "Cybersecurity Audit Certificate Study Guide, 2nd Edition," 2022, Chapter 2, Section: "Risk Identification," explains that KRIs are used to signal increasing risk exposures and are a critical component of the risk identification process.

3. Fraser, J., & Simkins, B. J. (Eds.). (2010). Enterprise Risk Management: Today's Leading Research and Best Practices for Tomorrow's Executives. John Wiley & Sons. Chapter 11 discusses the design and implementation of KRIs as early warning systems.