What are key risk indicators (KRIs) associated with?

Key Risk Indicators (KRIs) are metrics used to provide an early warning of increasing risk exposure in a specific area. According to the OCEG GRC Capability Model, risk is defined as "the effect of uncertainty on objectives." KRIs are specifically designed to be forward-looking, monitoring the underlying drivers and conditions that could lead to a risk event materializing. Therefore, they are directly associated with tracking the potential for the negative or unfavorable effects of uncertainty to impact an organization's ability to achieve its strategic, operational, and compliance objectives. They serve as a proactive tool in risk management.

A. The rate of return on investment and capital allocation: These are Key Performance Indicators (KPIs) that measure financial success and outcomes, not leading indicators of potential risk.

B. The quality of products and services offered to customers: These are typically measured by Key Quality Indicators (KQIs) or KPIs (e.g., customer satisfaction), which reflect past or current performance.

C. The level of innovation and technological advancement: These are strategic KPIs that measure progress toward innovation goals, rather than monitoring the uncertainty or threats that could impede those goals.

1. OCEG. (2021). GRC Capability Model (The Red Book), Version 3.5.

Page 12, Section 2.1: Defines Risk as "the effect of uncertainty on objectives." This establishes the foundational concept that KRIs monitor.

Page 88, Section 4.3.3.3: Explains that "Key risk indicators (KRIs) are forward-looking metrics designed to identify potential threats... They are often used as an early warning system to alert management to changes in the risk profile." This directly links KRIs to monitoring the potential for negative effects (threats) arising from uncertainty.

2. Steinberg, R. M. (2020). Governance, Risk Management, and Compliance: It Can't Happen to Us–Avoiding Corporate Disaster While Driving Success. John Wiley & Sons.

Chapter 10, "Measuring GRC Performance and Effectiveness": This chapter distinguishes between KPIs, which measure performance against objectives, and KRIs, which "provide an early warning of an impending risk event." This supports the idea that KRIs are tied to the uncertainty affecting objectives, not the performance outcomes themselves.