Key risk indicators in practice · RiskAtoms Academy

By the end you will be able to

1Choose indicators for a key risk, and tell leading, current and lagging ones apart.
2Calibrate amber and red thresholds at percentiles of a quiet history, and explain the trade-off between early warning and false alarms.
3Measure whether a KRI led a loss, and by how many days.
4Escalate a KRI breach to the right forum, and say what a warning can and cannot do.

Why it matters

RiskAtoms Bank's phishing test click rate went red in January 2025. On 2 April criminals used phished mailboxes to redirect client payments, and the bank lost £5.1m. Its platform availability went red in August; on 14 October the payments platform went down for 31 hours. Two indicators warned, 61 and 44 days ahead. Complaints, by contrast, went red only after the outage. The difference between those indicators is what this lesson is about.

Core explanation

Choosing, calibrating and acting on indicators

L2.4.06: Key risk indicators introduced KRIs with green, amber and red thresholds, and L3.3.17: Early warning, watchlists and workout showed early-warning indicators for borrowers. Operational risk uses the same idea for people, processes and systems. RiskAtoms Bank watches ten:

RiskAtoms Bank's KRIs, thresholds and status in December 2025 (illustrative)
Indicator	Unit	Amber	Red	Dec 2025	First red	Key risks
Failed outbound payments	per 10,000 payments	≥ 15.0	≥ 25.0	6.9 Green	Oct 2025	R03, R13
Payments platform availability	% of service hours	< 99.90	< 99.50	99.94 Green	Aug 2025	R03
Operations staff turnover	% a year (rolling)	≥ 15.0	≥ 20.0	13.3 Green	never	R07, R16
Critical security patches overdue	count over 14 days	≥ 5	≥ 10	3 Green	Aug 2025	R01, R03
Phishing test click rate	% of staff tested	≥ 5.0	≥ 8.0	3.7 Green	Jan 2025	R01, R02, R12
Customer complaints	per 1,000 accounts a month	≥ 2.00	≥ 2.50	1.45 Green	Oct 2025	R09, R10
Reconciliation breaks open over 30 days	count	≥ 20	≥ 40	8 Green	never	R07, R14
Critical third-party SLA breaches	count in month	≥ 3	≥ 5	0 Green	never	R04, R05
Material models overdue for validation	% of material models	≥ 5.0	≥ 10.0	7.7 Amber	never	R15
Control actions past due	% of open actions	≥ 10.0	≥ 20.0	25.0 Red	Dec 2025	none

Choosing: lead, current or lag

A leading indicator measures a cause; a current one measures the exposure now; a lagging one counts the damage. The Institute of Operational Risk's guidance is blunt: truly leading indicators are rare, and a trend on its own does not make an indicator leading. A good KRI is linked to a named risk in the RCSA, measured reliably and cheaply, expressed as a rate where volumes change, and few enough that someone reads it.

Sort itLeading, current or lagging?

Six of the bank's indicators and one more. Classify each for the risk it is linked to.

Phishing test click rate (% of staff tested), for account compromise and payment fraud
Critical security patches overdue more than 14 days, for ransomware and failed changes
Operations staff turnover, for processing errors and internal fraud
Payments platform availability (% of service hours), for a major outage
Failed outbound payments per 10,000, for payment processing errors
Customer complaints per 1,000 accounts, for poor outcomes and conduct risk
Net operational losses booked this month

Calibrating: percentiles of a quiet history

Calibration sets where green ends. A common start is the past: put amber where the indicator is worse than most of a quiet period, and red where the risk would leave appetite. The IOR suggests collecting at least six months of data, preferably a year, before setting the first thresholds. For the book's KRIs the calibration window is January to October 2024, ten months before any of the leading indicators left green. A percentile (M-C09: Quantiles) of that window says how unusual a reading is. Set amber at the 90th percentile and, by construction, about one quiet month in ten would have been amber: a false alarm. Set it higher and the alarms stop, but the warning comes later.

Percentiles of January to October 2024 against the book's amber thresholds
Indicator	Worst quiet month	90th percentile	Book's amber
Failed outbound payments	11.3	10.85	15.0
Payments platform availability	99.92	99.938	99.90
Operations staff turnover	13.7	13.43	15.0
Critical security patches overdue	3	3.0	5
Phishing test click rate	4.2	4.11	5.0
Customer complaints	1.73	1.631	2.00
Reconciliation breaks open over 30 days	15	15.0	20
Critical third-party SLA breaches	2	2.0	3
Material models overdue for validation	4.1	4.01	5.0
Control actions past due	9.6	9.06	10.0

Every book threshold sits beyond the worst quiet month: the bank chose few false alarms. The calibration notes say how: amber near the 90th or 95th percentile of a longer history for phishing and failed payments, the agreed service level for availability, the patch policy for patches. Whole-number counts are awkward: overdue patches had a value of 3 in five of the ten quiet months, so an amber at the 90th percentile, 3, would have raised 5 false alarms.

Did it lead? Measuring the warning

A KRI earns its place if it warns early enough to act. The lead time is counted from the last day of the first amber or red month, when the value is reported, to the day of the loss:

Phishing test click rate · first amber Nov 2024, first red Jan 2025, 61 days before the business email compromise fraud

Jan 2024Jan 2025Dec 2025

Outlined: Apr 2025, the business email compromise fraud

Critical security patches overdue · first amber May 2025, first red Aug 2025, 44 days before the payments outage

Jan 2024Jan 2025Dec 2025

Outlined: Oct 2025, the payments outage

Payments platform availability · first amber Jul 2025, first red Aug 2025, 44 days before the payments outage

Jan 2024Jan 2025Dec 2025

Outlined: Oct 2025, the payments outage

Failed outbound payments · first amber Aug 2025, first red Oct 2025, in or after the month of the payments outage

Jan 2024Jan 2025Dec 2025

Outlined: Oct 2025, the payments outage

Customer complaints · first amber Oct 2025, first red Oct 2025, in or after the month of the payments outage

Jan 2024Jan 2025Dec 2025

Outlined: Oct 2025, the payments outage

Three indicators led: phishing clicks by 61 days from red (123 from amber), availability by 44 days (75 from amber), overdue patches by 136 days from amber. All three were green for the whole of the first ten months. Failed payments turned amber in August but red only when the outage hit, and complaints turned red only afterwards. Hover over a month to see its value.

Escalating

A threshold is only useful if it triggers something. Each status has an owner and a deadline, and escalation moves a breach up as it worsens or lasts. The IOR's guidance distinguishes a touch trigger, escalated at once, from a repetitive-touch trigger, escalated if the breach persists into the next report. RiskAtoms Bank's ladder (illustrative):

ExploreThe bank's escalation ladder

Click a status to see who hears about it and what they must do.

Green

Monitors; no report beyond the monthly pack.

In the two years, 3 indicators stayed red for two months or more and so reached the board risk committee: payments platform availability, critical security patches overdue, phishing test click rate.

Illustrative dataRiskAtoms Bank plc's operational risk book

The same £67bn bank as Modules 3.5 and 3.6, at 31 December 2025, in pounds: ten years of internal loss events of £10,000 or more (2016–2025), an RCSA of 17 key risks and 29 controls, ten key risk indicators over 24 months, seven workshop scenarios and five important business services. Every event, person, supplier and figure is made up for teaching; none is any bank's data. The same book runs through every lesson in Module 3.7, so the figures agree.

The KRI values, thresholds and calibration notes are the book's; some months are set by hand to tell the story. The escalation ladder is an illustrative extra.

The formal version

The status rule is the one from L2.4.06: Key risk indicators: green below amber $A$ , amber from $A$ , red from $R$ , with the inequalities reversed when lower is worse. Calibration uses a quantile of the window's $n$ values, sorted $x_{(1)} \le \cdots \le x_{(n)}$ , by linear interpolation (M-C09: Quantiles):

\begin{aligned} h &= 1 + (n-1)\,p \\ Q_p &= x_{(\lfloor h \rfloor)} + \bigl(h - \lfloor h \rfloor\bigr)\bigl(x_{(\lfloor h \rfloor + 1)} - x_{(\lfloor h \rfloor)}\bigr) \\ A &= \begin{cases} Q_p & \text{higher is worse} \\ Q_{1-p} & \text{lower is worse} \end{cases} \end{aligned}

For the phishing click rate, n = 10 and p = 0.9:

\begin{aligned} h &= 1 + 9 \times 0.9 = 9.1 \\ Q_{0.9} &= x_{(9)} + 0.1\,\bigl(x_{(10)} - x_{(9)}\bigr) = 4.1 + 0.1 \times (4.2 - 4.1) = 4.11\% \end{aligned}

The share of quiet months above $Q_p$ is close to $1 - p$ , so the false-alarm rate is chosen when $p$ is. The lead time is counted in days from the reporting date of the first red month, $t_{\text{red}}$ , to the loss:

\Delta = t_{\text{loss}} - t_{\text{red}} = \text{2 Apr 2025} - \text{31 Jan 2025} = 61\ \text{days}

Try it

Pick an indicator, set amber at a percentile of the quiet months and choose a red level. Can you find a setting for the phishing KRI that warns earlier than the book's, and how many false alarms does it cost? What happens to overdue patches at the 90th percentile?

Try itCalibrate a key risk indicator

Indicator

Amber at this percentile of January to October 202490th

Red from8.00

Jan 2024Jan 2025Dec 2025

Outlined: Apr 2025, the business email compromise fraud

Amber from4.110

False alarms in the 10 quiet months1

First amberJul 2024

First redJan 2025

Warning from first amber245 days

Warning from first red61 days

Amber months / red months4 / 3

Book's thresholds5.0 / 8.0 (0 false alarms)

Illustrative book. Warning is counted from the last day of the month the value is reported to the day the loss happened. A false alarm here is any amber or red month in January to October 2024, when nothing was building up. For platform availability lower is worse, so the 90th percentile in the bad direction is the 10% quantile. Book thresholds: amber about the 90th percentile of the last two years' tests; red at twice the target.

Worked example

Calibrating and judging the phishing KRI

At the start of 2024 the Chief Information Security Officer asks the second line to set thresholds for the phishing test click rate. Work each step before you open it.

From quiet history to a warning that was used, or not

Step 1 of 5

1
The window
Ten monthly tests, January to October 2024, sorted: 2.8, 2.8, 3.1, 3.2, 3.4, 3.4, 3.7, 3.7, 4.1, 4.2 (% of staff who clicked). Median about 3.4%; worst month 4.2%.

Regulatory lens

The 2021 Basel principles list metrics among the tools for identifying and assessing operational risk: simple indicators or more advanced exposure models that give early warning and are tracked against thresholds or limits (paragraph 35(e)), and they ask for regular monitoring and reporting of the risk profile at board, senior management and business levels (Principle 8). KRIs do not enter the standardised capital calculation, which uses business size and the loss history of L3.7.03: Loss data (M4.4: Counterparty, operational and large exposures), but supervisors expect them to link to the appetite (L3.7.02: The operational risk framework). Indicators for important business services return in L3.7.15: Operational resilience.

Spark Atoms

Spark AtomTruly leading indicators are rare

The Institute of Operational Risk's 2010 sound practice guidance on KRIs warns that truly leading indicators are rare, that many indicators are both lagging and current, and that trending on its own does not make an indicator leading. Its examples of leading ones are things like the average length of delays in executing activities and the number of limit breaches: signs that the controls are under strain before anything breaks.

Spark AtomHard-coded months

The book's three leading KRIs were written by hand to lead its two losses; the other months are seeded noise. Real indicators are rarely this tidy. A bank should test each KRI the way this lesson did: count its warnings, its false alarms and its misses against the loss data, and drop the ones that never warn.

Key takeaways

A KRI is linked to a key risk, measured reliably, and has thresholds that trigger action; leading indicators are the most useful and the rarest.
Calibrate amber at a percentile of a quiet history: at the 90th percentile about one quiet month in ten is a false alarm. For phishing that is 4.11%; the bank chose 5%.
Higher thresholds mean fewer false alarms and later warnings; red is usually set where the risk would leave appetite.
Measure a KRI by its lead time: phishing clicks warned 61 days before the fraud, platform availability 44 days before the outage; complaints only after.
Escalation turns a status into a decision; a warning reduces a loss only if someone acts on it in time.

Reaction

Check what stuck

Glossary

Key risk indicator: Key risk indicator (KRI): a number measured regularly, with thresholds, that shows whether a key risk is growing.
Leading indicator: Leading indicator: measures a cause, so it moves before the loss.
Current indicator: Current indicator: measures the exposure as it is now, such as how often a service is down this month.
Lagging indicator: Lagging indicator: measures the damage after it has happened, such as complaints or losses.
Calibration: Calibration: choosing an indicator's amber and red thresholds, from history, targets and appetite.
Calibration window: Calibration window: the past period whose values are used to set thresholds; ideally a quiet one.
False alarm: False alarm: an amber or red reading when nothing is building up. Too many and people stop listening.
Lead time: Lead time: the days between a KRI's warning and the loss it warned of.
Escalation: Escalation: passing a breach to a more senior forum, with a deadline, as the status gets worse.
Touch and repetitive-touch triggers: Touch and repetitive-touch triggers: a breach escalated as soon as it happens, or only if it persists into the next reporting period.

Deep Dives & Origins

Deep Dives

Institute of Operational Risk, Key Risk Indicators, Operational Risk Sound Practice Guidance, IOR, November 2010: choosing, calibrating and reviewing KRIs. Introductory.
Basel Committee on Banking Supervision, Revisions to the Principles for the Sound Management of Operational Risk, BIS, March 2021, paragraph 35(e) and Principle 8. Intermediate.

Origins

Institute of Operational Risk, Key Risk Indicators, Operational Risk Sound Practice Guidance, version 1, IOR, November 2010, sections 3 to 5.
Basel Committee on Banking Supervision, Revisions to the Principles for the Sound Management of Operational Risk, Bank for International Settlements, 31 March 2021.

Watch this lesson

Video version

Prefer to watch? The same lesson as a 12-minute video will sit here, made from this page's script.