A key risk indicator (KRI) is PRIMARILY used for which of the following purposes?

A Key Risk Indicator (KRI) is a forward-looking metric designed to provide an early warning of increasing risk exposure in a specific area. Its primary purpose is to signal a rising probability of a future adverse event before it occurs, allowing management to take proactive measures. KRIs are leading indicators that help predict the likelihood of a risk materializing and impacting business objectives, distinguishing them from Key Performance Indicators (KPIs), which are lagging indicators that measure past performance.

A. Optimizing risk management is a broader goal that KRIs contribute to, but their specific, primary function is predictive signaling, not the entire optimization process.
C. While KRIs are often presented on dashboards for reporting, the dashboard is merely the communication tool; the fundamental purpose of the KRI itself is prediction.

1. ISACA, The Risk IT Framework, 2nd Edition, 2020. In the glossary (page 90), a KRI is defined as a "Metric capable of showing that the enterprise is subject to or has a high probability of being subject to a risk that exceeds the defined risk appetite." This highlights its predictive nature.

2. ISACA, COBIT 2019 Framework: Governance and Management Objectives, 2018. In the description of process APO12 Managed Risk, it notes the importance of identifying KRIs to "provide an early warning of a potential risk event" (page 119).