A key risk indicator (KRI) is a metric that warns you a risk is becoming more likely or more severe, early enough to act before it turns into a loss. A risk register tells you which risks matter; KRIs tell you which of them are moving. Without them, most organisations only discover a risk has grown when the incident report arrives.
This guide explains how KRIs differ from KPIs, gives examples across common risk types, and shows how to set thresholds that trigger a decision.
KRIs, KPIs and KCIs: what is the difference?
The three are often mixed up, and many "KRI" lists are really KPIs with a new label.
| Indicator | Question it answers | Example |
|---|---|---|
| Key performance indicator (KPI) | Are we hitting our objectives? | Monthly online revenue |
| Key risk indicator (KRI) | Is a risk to those objectives rising? | Share of revenue from the top five customers |
| Key control indicator (KCI) | Is a control still working? | Percentage of supplier contracts reviewed on time |
The same data can serve more than one purpose. What makes a metric a KRI is that it is linked to a specific risk in the register and has a threshold that tells someone to act.
Leading and lagging indicators
Lagging indicators record what has already happened: losses, incidents, complaints. They are easy to collect and useful for checking whether controls worked, but they arrive too late to prevent the event.
Leading indicators move before the event: overdue patches, staff turnover in critical roles, rising dependence on one supplier. A useful set of KRIs leans towards leading indicators, with a few lagging ones to confirm the picture.
Key risk indicator examples
These are illustrations, not a standard list. The right KRIs depend on your objectives, your principal risks and the data you can collect reliably.
| Risk | Example KRI | Why it gives early warning |
|---|---|---|
| Liquidity | Weeks of cash runway at forecast spend | Falls before payments are missed |
| Customer concentration | Share of revenue from the top five customers | Rises before one lost contract becomes a crisis |
| Supplier dependency | Share of critical spend with single-source suppliers | Shows exposure before a supplier fails |
| Credit | Share of receivables more than 90 days overdue | Moves before bad debts are written off |
| People | Critical roles vacant for more than 60 days | Signals capacity gaps before delivery slips |
| Cyber security | Critical vulnerabilities unpatched after 30 days | Measures open doors before a breach |
| IT resilience | Days since the last successful restore test | Shows whether recovery will actually work |
| Compliance | Regulatory actions past their due date | Rises before a regulator notices |
| Projects | Milestones slipped by more than two weeks | Warns of cost and benefit shortfalls |
| Health and safety | Near-miss reports per month | A sudden fall can mean under-reporting, not safety |
The last row is a reminder that the direction of "good" is not always obvious. Decide in advance how each movement should be read.
How to set KRI thresholds
A KRI without a threshold is just a number on a dashboard. Thresholds connect the indicator to your risk appetite and tell people what to do.
- Start from the appetite statement. If the board has said it has a low appetite for revenue disruption, the thresholds for payment and systems KRIs should be tight.
- Use three bands. Green means within appetite. Amber means the risk owner must act and record what they did. Red means escalate to the named committee or executive.
- Write the definition down. State the formula, the data source, how often it is measured and who reports it. Two teams calculating "overdue" differently will produce two different risks.
- Check the history. Look at the last 12 to 24 months of data where you have it. A threshold that would have been breached every month is noise; one that would never have triggered is decoration.
- Review thresholds at least yearly, and whenever appetite, strategy or the business model changes.
A worked example
Take a fictional online retailer whose risk register includes "loss of our main payment provider for more than 24 hours". The board's appetite for revenue disruption is low.
| KRI | Green | Amber (owner acts) | Red (escalate) |
|---|---|---|---|
| Provider uptime, rolling 30 days | 99.9% or above | 99.5% to 99.9% | Below 99.5% |
| Payment incidents in the last quarter | 0 to 1 | 2 to 3 | 4 or more |
| Days since the last switch-over test to the back-up provider | Under 90 | 90 to 120 | Over 120 |
The first two are lagging but show the provider's reliability trend. The third is leading: it measures whether the main recovery control would work today. If it turns red, the Head of Finance reports it to the risk committee with a date for the next test. The figures are for illustration; real thresholds should come from your own data and appetite.
Reporting KRIs to the board
Boards do not need every metric. For each principal risk, show two to four KRIs with their current band, the trend since the last report and a short comment from the owner on what is being done. Put red and worsening amber indicators first. Link each one back to the entry in the risk register so the discussion stays on the risk, not the metric.
Common mistakes
- Too many indicators. Fifty KRIs means none are watched. Start with the principal risks.
- Relabelled KPIs. Revenue is a performance measure. The risk is what could stop it, so measure that.
- No owner. Every KRI needs a named person who acts on amber.
- Unreliable data. If the number takes a week of spreadsheets to produce, it will be late or wrong.
- Thresholds that never change. A threshold set three years ago may no longer reflect appetite.
Designing KRIs and escalation routes is part of the compliance monitoring module on LSBUK's enterprise risk management course, alongside risk registers, appetite and board reporting.
Frequently asked questions
What is a key risk indicator?
A key risk indicator is a metric linked to a specific risk that shows whether the risk is becoming more likely or more severe. It has defined thresholds so that a change triggers action by the risk owner or escalation to leadership.
What is the difference between a KRI and a KPI?
A KPI measures progress towards an objective, such as revenue or customer satisfaction. A KRI measures a risk that could stop you reaching that objective, such as dependence on a few large customers. The same data can feed both, but a KRI is always tied to a risk and a threshold.
How many KRIs should an organisation have?
There is no fixed number. A practical approach is two to four KRIs for each principal risk, prioritising leading indicators that can be measured reliably and often enough to act on.
Who should own a key risk indicator?
The owner of the related risk should usually own the KRI, because they are the person expected to act when it moves into amber. The risk function can design and collect the data, but the decision belongs to the risk owner.