4 essential KRI types in your risk map

KRIs (Key Risk Indicators) are, according to COSO, the metrics that give an early signal that risk exposure is rising. In the guide's analogy, KPIs show you where you are on the map and KRIs chart the route to your objectives.

This practical guide proposes four KRIs for your risk map, each with its indicator and threshold. It is for anyone managing risk who wants a dashboard that warns them before a deviation turns into a problem.

What's in the guide

1. What risk means todayWhy it has to be measured against a threshold and also seen as a chance to get ahead.
2. KPIs versus KRIsThe COSO definition and the difference between knowing where you are and anticipating what's coming.
3. Third-party riskThe percentage of suppliers with an optimal overall rating, with an alert if it falls below 80%. The Covid-19 crisis showed what it costs to ignore it.
4. Compliance riskThe monthly percentage of critical compliance risks above the target risk level, which should stay below 5%.
5. Operational riskThe percentage of controls with below-optimal effectiveness, with the alert threshold set below 10%.
6. Strategic riskThe percentage of strategic process risks with residual risk above target, also below 5%.

Standards cited in the guide

The guide relies on COSO to define KRIs and on ISO 37301 for compliance risk. It closes by bringing the four risk types into a single map in GlobalSuite®, so you can see how they affect each other.