The number of key risk indicators (KRIs) companies employ will vary based on their size, sector and material risk profile. However, risk leaders agree with the guiding principle that to successfully embed KRIs, close collaboration with stakeholders is vital.
During a recent peer-to-peer collaboration, facilitated by Risk Leadership Network, practitioners highlighted a range of approaches they are taking to work with the business on the development of KRIs.
1. Survey senior management
The main purpose of KRIs is to enable an organisation to determine whether its principal/material risks are being managed within an acceptable level of appetite. This acceptable level is agreed at, and filters down from, the executive layer of the business.
So the first step is to prioritise risk areas that are the most important to the board and senior management, and focus your efforts on developing KRIs for these risks first.
|
Case study: One of our members explained how, at their company, the first and second line collaborated to actively survey the board and senior managers. They asked six to seven questions to find out what risk areas were a priority for leadership, before discussing these risks in a workshop to determine if the business was aligned (or not) on how to manage them. This directed the development of KRIs. |
2. Trial indicators to demonstrate the value
Risk leaders at smaller corporates, which typically have a less mature risk framework and fewer resources to focus on risk management, explained that less data is readily available to them for the purpose of developing KRIs.
Another key challenge for these practitioners is answering that all important "so what" question from business leaders, who may not understand the values KRIs can add.
An approach some of our members are taking, to sell the business on KRIs, is to select a few key risks and develop trial indicators for them. By starting small and assigning accountability for two or three KRIs per key risk, you can start to build a business case for a bigger register of KRIs, without overwhelming stakeholders in the process.
If indicators are going to work for the business they must be repeatable. This means:
- They can be reused — they are not a single-point-in-time measure
- They are always available to the business to track performance
KRIs are likely to be more useful if you can demonstrate to the board and senior management that they are changing, as this is what drives action and signals to the business that work needs to be done to bring a risk back within appetite.
The aim is not for all KRIs to be 'green' (within appetite). If they all remain static, KRIs will not drive change in the organisation and may even encourage inaction."
CRO
Risk Leadership Network member
4. Define clear thresholds the business understands
Having a broad spectrum of different risk appetite thresholds may confuse the business and be difficult to embed across the organisation. Instead, most organisations operate with a simple range of settings: low, medium and high.
Whatever settings you benchmark your KRIs against, it should be clear what would constitute a breach of appetite, both from the perspective of too much risk being taken and not enough risk.
These thresholds may also influence how often KRIs are reviewed with the board.
For instance, if there a risk that there is little or no appetite for (health and safety in heavy industries, for example), the board may need to be updated every quarter.
"High appetite" risks though, or risks that are discussed with the board through other channels (e.g., ESG), may only need to be reviewed every six months or annually.
|
Where does this insight come from? A number of Risk Leadership Network have raised setting KRIs and linking them to risk appetite as a key priority. We facilitated a series of meetings for members to share approaches, and learn from CROs/heads of risk who had successfully set and embedded appetite in their organisations. To find out more about how we work with our members, watch this short video or request to collaborate with peers on risk appetite. |
5. Achieve a balance of leading and lagging KRIs
There's a strong preference in our network for a balance of leading and lagging indicators, with a sustained focus on high-quality leading indicators.
Lagging indicators can be useful, to identify gaps or areas where the business is not performing well. But a greater focus on leading indicators will better equip the organisation to take a proactive approach towards risk management and mitigate risks with a low appetite before they can materialise.
Examples of leading indicators used by our members:Number of suppliers that have been risk assessed Number of phishing tests carried out amongst all employees Learning and development budget per employee These are just 3 of the 200+ KRIs that we've collected from peers to share with members of our network. To find out more about our KRI library, book a 15-minute exploratory call with us. |
What's next?
The prompt for developing leading indicators is to ask one simple question: "If something was about to go wrong, what are all the things I might be likely to see?". By brainstorming what these signals may be, a draft list of leading indicators can be developed and tested."
Head of risk
Risk Leadership Network member
Are you developing KRIs right now? Through targeted peer collaboration, we're supporting a number of our members with specific priorities surrounding KRIs and risk appetite. To get involved, please request to collaborate here or book an introductory call with our team.
Share this
How has risk appetite evolved in the past 3 years?
7 approaches to setting risk appetite for cyber security
