4.1 Key Risk Indicators
Risk indicator is a measure used by an organization to determine the level of current risk for an activity. This helps the organization to monitor the risk level and receives an alert when a risk level approaches an unacceptable level.
Thus, the objective of key risk indicators is to flag the exception as and when it occurs. This provides an opportunity for the organization to respond to the risk before damage is done.
Examples of key risk indicators are:
Number of unauthorized software detected in audit.
Hours of system downtime
Number of systems without antivirus
Let us take one example of system downtime. Risk indicator can be set as follow:
Number of workstations vis-Ã -vis the count of employees can be considered as a key risk indicator for configuration management. High amount of excess inventory as compared to actual employees indicates poor configuration as the same is not mapped correctly with actual business requirements. Similarly, a high level of shortage of workstation also indicates poor configuration mapping.
Advantage of KRI
Following are the advantages of KRIs:
It helps to validate the risk appetite and risk tolerance level of the organization.
It helps to identify the risk in an objective way.
It helps in quantification of the risk
It helps in continuous risk monitoring
It helps in triggering risk mitigation action
It helps in monitoring and managing regulatory compliance
KRI Selection
Selection of the right kind of KRI is utmost important for the success of a risk management program.
Following are the some of the characteristics of a good metrics also termed as SMART:
Specific: KRI should be clear, concise and easily understandable
Measurable: KRI should be able to quantified and there should not be any subjectivity
Attainable: KRI should be something realistic
Relevant: KRI should be relevant to the goals and objective of the organization
Time: KRI should be achievable in a given time frame
Risk indicator should include and cover:
Lag indicators i.e. occurrence of risk events
Lead indicators i.e. preventive controls
Trends over a period of time
For the effectiveness of KRI, the organization must ensure that data used to measure the KRI is complete, correct and accurate.
KRI threshold should be aligned with risk appetite and risk tolerance of the organization. KRIs need to be evaluated on a regular basis to verify that each KRI remains properly related to the risk appetite and tolerance levels of the organization.
Design of Key Risk Indicator (KRI)
Following are some of the key aspect for design of KRI in order of their priority:
KRI should be linked to specific risk
KRI should be capable to predict a risk event
KRI should be complete and accurate
KRI should be easily measurable and comparable
Linking to a specific risk is the most important criterion when selecting a KRI.
To ensure the KRI are effective and linked to specific risk, a risk manager must understand the end-to-end operational flow of the business processes. This will help to understand various aspects of the business such as detailed processes, data flows, decision-making processes, risk appetite and tolerance. On the basis of this information, risk practitioners can design relevant and specific KRI along with measurement criteria.
Identification of Key Risk Indicators (KRI)
Key risk indicators are generally identified during the risk response stage (i.e. before the risk monitoring stage). During the risk response stage, controls for mitigation of the risks are selected and implemented. Once the controls are implemented, some KRI is to be identified and developed. These KRIs will help to determine the effectiveness of the control. If KRI is within the threshold, it indicates that controls are effective. In case KRI crosses the threshold, then additional controls may be required.
Responsibility of monitoring of Key Risk indicators (KRI)
KRI should be measured and monitored by an independent team to ensure unbiasedness. If the same is measured by line managers, the same should be reviewed by independent authority. It is equally important that his efforts are reviewed and validated by a senior official. Most effective method to validate the efforts of a line manager is to review the reported results by an independent person. This helps to determine the efficiency and effectiveness of line managers in monitoring the key risk indicators.
Reporting of KRI results
When KRI reaches its threshold, it should be first reported to the business process owner who owns the risk and determines the risk response. Process owners should evaluate the effectiveness of existing control and to determine whether additional controls are required.
Results of key risk indicators are to be placed to senior management at periodic intervals. KRIs are the most useful data for management to determine current state of risk.