Key Risk Indicators (KRIs): How to Define Them with Examples

A risk score tells you where a risk sits today. A key risk indicator tells you where it's heading. KRIs are the operational heartbeat of a risk management program — the metrics that turn a static risk register into a live system that signals when attention is needed.

What Makes a Good KRI

Not every metric is a KRI. A key risk indicator must have four properties:

1. Measurable — it can be expressed as a number, percentage, or frequency
2. Threshold-linked — it has a defined level that triggers a specific action
3. Owned — a named person is responsible for monitoring it and escalating when thresholds are breached
4. Timely — it can be measured frequently enough to provide actionable warning

A metric without a threshold is just a data point. A threshold without an owner is just a number. All four elements must be in place.

KRI Structure

Define each KRI with the following fields:

Field	Description	Example
Risk	The risk this KRI monitors	Unauthorized system access
KRI Name	Short descriptive name	Unpatched Critical Vulnerabilities
Metric	What is measured	Count of critical CVEs open > 30 days
Frequency	How often measured	Weekly
Green	Within appetite	≤ 5
Amber	Approaching tolerance	6–9
Red	Tolerance breached	≥ 10
Owner	Who monitors and escalates	Head of IT Security
Escalation	What happens at Red	Immediate report to CISO; patch sprint initiated

KRI Examples by Risk Category

Cybersecurity

KRI	Metric	Amber	Red	Type
Unpatched critical vulnerabilities	Count of critical CVEs open > 30 days	6–9	≥ 10	Leading
Privileged account review	Days since last PAM access review	75–89	≥ 90	Leading
Failed login attempts	Count per day across critical systems	500–999	≥ 1,000	Leading
Phishing click rate	% of employees clicking simulated phishing	8–14%	≥ 15%	Lagging
Security training completion	% of employees current on training	80–89%	< 80%	Leading
Mean time to detect (MTTD)	Avg hours from incident start to detection	24–47h	≥ 48h	Lagging
Third-party with elevated access	Count of vendors with admin/privileged access	5–9	≥ 10	Leading

Operational

KRI	Metric	Amber	Red	Type
Critical role vacancy	Days key roles are unfilled	30–59	≥ 60	Leading
Attrition in critical functions	% turnover in key roles (rolling 12 months)	15–24%	≥ 25%	Lagging
System uptime (critical systems)	% availability of Tier 1 systems	99.0–99.4%	< 99.0%	Lagging
Change failure rate	% of changes causing incidents	5–9%	≥ 10%	Lagging
Disaster recovery test	Days since last DR test	270–364	≥ 365	Leading
Overdue risk reviews	Count of risks past review date	3–9	≥ 10	Leading

Compliance

KRI	Metric	Amber	Red	Type
Open audit findings	Count of unresolved audit findings	3–9	≥ 10	Lagging
Overdue control tests	% of controls with overdue testing	10–19%	≥ 20%	Leading
Policy exception requests	Count open > 30 days	3–4	≥ 5	Leading
Access review completion	% of access reviews completed on schedule	80–89%	< 80%	Leading
Regulatory change backlog	Count of new regulations not yet assessed	2–4	≥ 5	Leading
Control effectiveness score	% of controls rated Effective or higher	70–79%	< 70%	Lagging

Financial and Third-Party

KRI	Metric	Amber	Red	Type
Concentration risk	Revenue % from single customer	20–29%	≥ 30%	Leading
Overdue vendor assessments	Count of Tier 1 vendors past assessment date	1–2	≥ 3	Leading
Vendor security score	Avg security rating of Tier 1 vendors	6–6.9 / 10	< 6 / 10	Leading
Budget variance	Actual vs. budget for risk program	10–19%	≥ 20%	Lagging
Insurance coverage gap	% of cyber exposure covered by policy	60–74%	< 60%	Leading

Setting Thresholds

Anchor to risk tolerance, not intuition

Thresholds should come from your risk appetite framework. If your documented tolerance is "no more than 10 critical vulnerabilities open past 30 days," your Red threshold is 10. Your Amber threshold is typically 70–80% of that — providing enough runway to investigate and remediate before breaching tolerance.

Use context to calibrate

The right threshold varies by organization. A fintech with strict regulatory requirements will set tighter thresholds than a startup without compliance mandates. A 15% phishing click rate might be Red for a financial institution but Amber for a pre-security-awareness-program stage company.

Adjust over time

Thresholds set at program launch are rarely perfect. Track how often each KRI triggers Amber and Red. If a KRI is always Green and never requires attention, either the metric isn't sensitive enough or the threshold is too loose. If a KRI is chronically Red, investigate whether the threshold reflects actual risk tolerance or needs to be recalibrated — and whether the underlying risk has been adequately addressed.

KRI Review Cadence

KRI Level	Review Frequency	Owner
Red	Immediately, then daily until resolved	Risk owner + senior leadership
Amber	Weekly	Risk owner
Green	Monthly	Risk owner
Full KRI set	Quarterly	Risk committee

Connecting KRIs to Risk Scores

KRIs and risk scores are complementary:

• Risk score reflects the current assessed level of a risk (inherent and residual)
• KRI tracks whether that level is stable or trending

A risk with a stable Medium score (8) but an Amber KRI (phishing click rate rising from 5% to 12%) should trigger a review of the residual risk score. The KRI is telling you the control effectiveness assumption behind that score may be changing.

The best-run risk programs automatically flag risks for reassessment when their KRIs breach Amber — treating KRI movement as evidence that the risk register may be out of date. For guidance on writing the appetite statements that KRI thresholds enforce, see How to Write a Risk Appetite Statement.

Starting Your KRI Program

If you don't have KRIs today:

1. Pick your top 10 risks — start with High and Critical only
2. Define 2 KRIs per risk — one leading, one lagging where possible
3. Set thresholds based on documented risk tolerance — not guesswork
4. Assign owners — the same person accountable for the risk is accountable for the KRI
5. Review for one quarter — see which metrics are measurable in practice, which thresholds need adjustment
6. Expand to medium risks in the following quarter

A small set of meaningful, actively monitored KRIs outperforms a large KRI library that no one looks at.