Key risk indicators · RiskAtoms Academy

By the end you will be able to

1Choose key risk indicators (KRIs) with amber and red thresholds that give early warning.
2Tell a leading indicator from a lagging one, and a KRI from a KPI and a KCI.
3Set thresholds that balance early warning against false alarms, and link them to risk appetite.
4Calculate a KRI as a percentage and describe its change in percentage points.

Why it matters

In October 2026 a failed software change took Larkfield's card and app payments down for five hours. Looking back, the warning signs had been in its own data for most of a year. Nobody was measuring the right thing.

Core explanation

Numbers that warn you before the loss

Monitoring is the step that keeps the cycle turning (L2.4.01: The risk management cycle). Its main tool is the key risk indicator (KRI): a number, measured every week or month, that tells a risk owner whether a risk on the register (L2.4.04: Risk registers) is growing. Each one gets thresholds: green is normal, amber is early warning, red means act now and escalate.

Three kinds of indicator. They are easy to confuse:

Indicator	Answers	Larkfield example
KRI	Is the risk getting bigger?	Failed changes to the payments platform (%)
KCI	Is a control working?	Daily reconciliations completed on time (%)
KPI	Is the business hitting its goals?	Payments processed per day

Lead, not lag. A leading indicator measures a cause, so it moves before the loss: staff turnover, failed changes, overdue security patches. Lagging indicators count the damage: losses, downtime, complaints. They matter for learning, but by the time they move it is too late to warn. Most firms need both; the skill is finding a leading one for each top risk.

Sort itLeading or lagging?

Each is a candidate KRI for one of Larkfield's risks.

Staff turnover in payments operations (R7)
Number of payments sent to the wrong account last month (R7)
Critical security patches overdue (R3)
Complaints upheld about the payment protection add-on (R5)
Unsecured loans 30+ days in arrears (R4)

What makes a good KRI. It is linked to a named risk on the register and to the firm's risk appetite (L2.3.05: Risk appetite frameworks). It leads. It comes from reliable data that is cheap to collect. It is a rate where the volume changes (failures per 100 changes, not failures), so growth in the business does not look like growth in risk. And there are few of them: a board cannot watch 200. Larkfield has one per register risk:

Risk	KRI
R1 Payments platform outage	Failed or rolled-back changes to the payments platform (%)
R2 Card and app fraud	Fraud losses per €1m of card and app payments
R3 Cyber attack and data breach	Critical security patches overdue
R4 Consumer loan losses above plan	Unsecured loans 30+ days in arrears (%)
R5 Mis-selling of payment protection	Complaints per 1,000 add-on sales
R6 Cloud provider failure	Provider service-level breaches a month
R7 Manual payment errors	Payments repaired by hand (%)
R8 Regulatory reporting error	Supervisory returns resubmitted

Setting thresholds

Thresholds are a trade-off. Set them tight and the indicator turns amber every other month: false alarms, and people stop listening. Set them loose and it turns red the week of the loss. A practical start is to put amber just above the normal range of the past (here, the highest value in the quiet year) and red where the risk would leave appetite. Red thresholds are often tied directly to appetite and limits, so that a red KRI triggers the escalation route in L2.3.06: Limits and escalation.

The formal version

Most KRIs are percentages (M-A01: Percentages). For Larkfield's payments platform in month $t$ :

\text{KRI}_t = \frac{\text{failed or rolled-back changes}_t}{\text{all changes}_t} \times 100\%

With an amber threshold $A$ and a red threshold $R$ ( $A < R$ ), the status each month is:

\text{status}_t = \begin{cases} \text{green} & \text{KRI}_t < A \\ \text{amber} & A \le \text{KRI}_t < R \\ \text{red} & \text{KRI}_t \ge R \end{cases}

To compare two months, give the change in percentage points (the plain difference), and say so if you give the relative change instead:

\Delta = \text{KRI}_{t} - \text{KRI}_{t-1} \;\text{(pp)}, \qquad \text{relative change} = \frac{\text{KRI}_{t}}{\text{KRI}_{t-1}} - 1

Shown in full: these are percentages and comparisons you already know.

Try it

Here are 24 months of Larkfield's data before the outage. The thresholds start too loose. Tune them so that amber comes at least six months and red at least three months before the outage, with no false alarms in the quiet first year. Then switch to the lagging indicator and try again.

Try itTune a KRI to catch the outage early

Indicator

Failed or rolled-back changes to the payments platform (% of changes), November 2024 to October 2026. Illustrative data. The shaded first year had no build-up, so any alert there is a false alarm.

amber 9.0% red 12.0%

Amber threshold9.0%

Red threshold12.0%

First amberJul 26, 3 months before

First redOct 26, the outage month

False alarms in the quiet year0

Too late: aim for amber at least 6 months and red at least 3 months before the outage, with no false alarms.

Worked example

Reading the failed-change KRI

After the outage, the COO asks what the KRI would have shown with the thresholds the risk owner has now set: amber at 5%, red at 8%. Work out each step first.

Month by month

Step 1 of 5

1
Why these thresholds
In the quiet first year the KRI never went above 4.4%, so amber at 5% sits just above normal. Red at 8% matches the level at which the owner judges an outage likely enough to breach Larkfield's appetite for disruption.

Regulatory lens

The Basel Committee's Principles for the Sound Management of Operational Risk (revised 2021) list key risk and performance indicators among the monitoring tools banks should use, with thresholds or limits tied to risk appetite and clear escalation when they are breached. The Financial Stability Board's Principles for an Effective Risk Appetite Framework (2013) expect appetite to be turned into measurable limits that are monitored.

UK operational resilience rules, in force since March 2022, add a twist: firms must set impact tolerances for how long each important business service can be disrupted, which make natural red thresholds. More in Level 3: Core Risk Disciplines.

Sparks

Spark300 near misses, 29 minor injuries, 1 major

In 1931 the safety engineer Herbert Heinrich argued that serious workplace accidents sit on top of a pyramid of minor ones and near misses, in a ratio of about 1 to 29 to 300. His numbers are debated, but the idea behind leading indicators is his: count the small failures, and you see the big one coming.

SparkWhen a measure becomes a target

The economist Charles Goodhart observed in 1975 that a statistical regularity tends to break down once it is used for control. It is usually quoted, after the anthropologist Marilyn Strathern, as “when a measure becomes a target, it ceases to be a good measure”. Pay staff to keep a KRI green, and they may find ways to keep it green that do nothing for the risk.

Key takeaways

A KRI is a regular number that shows whether a register risk is growing; a KCI tracks a control, a KPI tracks performance.
Leading indicators measure causes and warn in time; lagging ones count losses after the event.
Amber is early warning for the owner; red triggers escalation and is usually tied to risk appetite.
Thresholds trade early warning against false alarms: start amber just above the normal range.
Use rates rather than counts, and give changes in percentage points unless you say otherwise.

Reaction

Check what stuck

Question 1 · objective 4

In a month, 9 of 75 changes to a system failed or were rolled back. What is the KRI, as a percentage?

%

Question 2 · objective 4

The month before, it was 4 failures in 80 changes (5%). By how many percentage points did the KRI rise?

pp

Question 3 · objective 2

Which is a leading indicator for the risk of a payments outage?

AMinutes of downtime last monthBCustomer complaints about failed paymentsCShare of software changes that failed testing or were rolled backDCompensation paid to customers

Question 4 · objective 3

A KRI moves from green to amber. What should happen?

ANothing until it is redBThe risk owner looks into it and acts, and it is reported at the next regular meetingCThe board meets at onceDThe threshold is raised so it turns green again

Question 5 · objective 3

On Larkfield's data, with amber at 5% and red at 8%, how many months before the outage did the KRI first turn red?

months

Glossary

KRI: Key risk indicator: a number, measured regularly, that shows whether a risk is growing or shrinking.
KCI: Key control indicator: a number that shows whether a control is working, such as the share of checks done on time.
KPI: Key performance indicator: a number that shows how well the business is doing against its goals.
Leading indicator: An indicator that moves before the loss happens, so there is time to act.
Lagging indicator: An indicator that moves after the loss has happened. Useful for learning, too late for warning.
Threshold: A level of an indicator that triggers a response: amber for early warning, red for escalation.
Percentage points: Percentage points: the plain difference between two percentages. From 5% to 12% is 7 percentage points.

Deep Dives & Origins

Deep Dives

Chapelle, A., Operational Risk Management: Best Practices in the Financial Services Industry, Wiley, 2019, chapter on risk indicators. Intermediate.
Institute of Operational Risk, Key Risk Indicators, sound practice guidance paper. Intermediate.

Origins

Basel Committee on Banking Supervision, Revisions to the Principles for the Sound Management of Operational Risk, BIS, March 2021.
Financial Stability Board, Principles for an Effective Risk Appetite Framework, November 2013.
Heinrich, H. W., Industrial Accident Prevention: A Scientific Approach, McGraw-Hill, 1931.
Goodhart, C. A. E., “Problems of Monetary Management: The U.K. Experience”, 1975; Strathern, M., “‘Improving ratings’: audit in the British University system”, European Review, 1997.

Watch this lesson

Video version

Prefer to watch? The same lesson as a 10-minute video will sit here, made from this page's script.