Key Risk Indicators serve a fundamentally different governance purpose from Key Performance Indicators. KPIs measure how well the security programme is currently performing. KRIs measure where risk is heading. The distinction matters because a programme that is performing well today may be accumulating the conditions for a significant incident tomorrow, and without KRIs, the governance function cannot see that trajectory until the performance metrics begin to deteriorate. By then, the window for preventive intervention has often closed.
A KRI is an early warning signal. It does not tell the board that something has gone wrong. It tells the board that the conditions for something going wrong are developing, and that action taken now can prevent the outcome that inaction will make more likely. An organisation that monitors its KRIs consistently and responds to threshold breaches before they become incidents is practising proactive risk management rather than reactive incident response. The financial and reputational difference between the two is substantial.
The Relationship Between KRIs and the Risk Assessment #
KRIs derive their value from their connection to identified risks. A KRI that is not tied to a specific risk the organisation has assessed and prioritised is measuring something, but not necessarily the right something. The design process should begin with the risk register and work outward: for each significant risk, ask what observable signal would indicate that the likelihood or the potential impact of that risk is increasing. The answer to that question is the KRI.
This connection also governs how KRIs should be updated. When the risk register changes because a new risk has been identified, a previously significant risk has been treated to acceptable levels, or an existing risk’s profile has materially changed, the KRI set should be reviewed for the same reasons. The organisation that migrated from on-premises infrastructure to a cloud platform and continued monitoring the same KRIs it used for the legacy environment is measuring the wrong risk signals with the misplaced confidence that measurement without review creates.
Designing Effective KRIs #
Keep reading with a free Eristotle account.
Every document across our Bodies of Knowledge is free to read once you are signed in. No payment, no tier.
