Key Risk Indicators; What Are They and How Should They Be Used
For many people, risk management is set of practices to make sure that a company’s compliance risks are monitored and that they have controls in place to take care of them. However, with the changing business practice, this idea is slowly changing. Nowadays, risk management has an important place in determining the short and medium-term strategies of companies and it is becoming possible to determine a risk-based strategy for well… everything.
As a business phenomenon gains a strategic context, numerical metrics come to the fore as well. When we are talking measurable metrics in risk management, we are talking about key risk indicators. In this blog, we will try to explain what KRI’s really are and why building an effective KRI is important for companies.
Let’s start with a simple definition: KRI’s are indicators or metrics that are used to measure risks that the business exposed to. Think of KRI’s as an early warning system to the stakeholders and enable them to take preventive actions on the risks. KRI’s are always quantifiable and measurable. So, it should be cleary stated that, opinions should not be included in KRI’s.
KRI’s or KPI’s. What is the difference ?
As almost everyone knows, KPI’s (key performance indicators) are crucial metrics of companies to track their performance. KRI’s sometimes serve the same purpose so we can say that KRI’s and KPI’s are closely linked. But in general, how can you differentiate KPI’s and KRI’s ? Actually, you don’t have to. Performance, risks and strategies are very close concepts so it is not possible to discuss one without another. Still, just to set the boundaries you can use the below approach;
- KPI’s answer the question: ‘’How are we doing against our goals’’. When you think about that question, metrics comes to mind like revenue, profitability or purchase cycle time.
- While KRI’s answers: “What might prevent us from achieving our goals?”. As you can see, these are similar but relatively different concepts. When you think about this question, probably different question pop up in your mind like, customer return rates, absenteeism rates or number of late deliveries.
But it all depends on context. There is no way to think a metric is definetely a KRI or a KPI. Risks and performance are properly aligned so the best approach we should suggest is leave this distinction and use all your metrics depending on the context. Here’s a good starting point to position KPI’s or KRI’s depending on the context
How to design effective KRI’s ?
Data is always good. But it only provides great opportunities for companies when you use it wisely. Designing effective KRI’s should always start with well-defined strategies and goals. After that, you should identify the key risks in achieving your goals and design KRI’s that can track those risks, act as an early warning system, thereby creating an alert when the company is at risk of not achieving its goals. This should be the first principle of KRI’s.
Secondly, KRI’s should be tracked with datasets that share the same fundamental attributes.
- Measurable: Metrics should be quantifiable. The data can be number, count, quantity, percentage, amount etc.
- Predictable: Metrics should provide early warning signals for risks.
- Comparable: Metrics should be tracked over time and can be comparable between different business units or locations of a company.
- Informational: Metrics should measure the status of a risk and give some insight for all stakeholders of the risk.
Thirdly, there should be balance between leading and lagging KRI’s.
- Leading KRI’s used to predict the future outcomes depeding on the data like frequency of risk assessments, EH&S training hours, numbers of audit per year etc.
- Lagging KRI’s used to measure past data to give a hint for future like number of cyber attacks, total cost of scrapped materials or number of accidents.
As you can see, when you talk about lagging KRI’s; most probably you are talking about KPI’s. KRI’s are key data that enables you to make inferences with data. When you consider customer return rates in the context of the risk of decrease in customer satisfaction, this metric immediately turns into a KRI. As I mentioned before, KRI’s, KPI’s or KCI’s (Key Control Indicators) are transitive phenomenons so they may have different messages depending on the context.
Last but not least, using the right number of KRI’s is also very important for risk professionals to not lost in data. Of course there is no correct number of risks for a company, but using 2–3 KRI’s per risk seems managable through the time that risks are valid. Therefore, it is important to define right KRI’s since you only have limited options.
Conclusion
To wrap up the issue, key risk indicators are crucial parts of strategic risk management and it is getting more and more intertwined with performance management. Building an effective KRI library is one of the most important steps for getting a proactive approach in risk management. Effectively designed KRI’s should act as an enabler to drive decisive action to manage risks, improve financial performance and provide the right level of board assurance that risks are under control.
And when we look from technological perspective, if building the right KRI strategy is risk professionals business, then tracking, visualizing and creating early watch alerts with the fluctuations in data is a digital business. So, if you want to gain a holistic vision of key risk indicators, business, risk and digital transformation professionals must collaborate. Otherwise, all you may have tons of KRI’s with zero automation or highly automated alerts that nobody look at it.
