Risk Response and Reporting · Topic 8 of 9
Risk and Control Metrics (KRIs, KCIs, KPIs)
CRISC metrics: how KRIs, KCIs and KPIs differ, leading and lagging indicators, KRI selection criteria, thresholds, and refining metrics with owners.
- 5 min
- Includes a diagram
- KRI measures risk, KCI measures control effectiveness, KPI measures performance.
- Leading indicators warn before loss; lagging indicators confirm what happened.
- KRI selection criteria: impact, effort, reliability, sensitivity.
What it is
Metrics show whether risk and controls are moving in the right direction. Three kinds appear constantly on the exam:
- A key risk indicator (KRI) signals a change in the level of risk, ideally before an event happens.
- A key control indicator (KCI) shows whether a control is working as intended.
- A key performance indicator (KPI) measures how well a process or activity achieves its goals.
The practitioner defines, implements and refines KRIs, and works with control owners on KCIs and KPIs.
How it works
Comparing the three
| Metric | Measures | Example | Typical owner |
|---|---|---|---|
| KRI | Exposure or likelihood of a risk | Number of critical vulnerabilities older than 30 days on internet-facing systems | Risk owner, defined with the practitioner |
| KCI | Effectiveness of a control | Percentage of leavers whose access was removed within 1 day | Control owner |
| KPI | Performance of a process | Average time to resolve service desk tickets | Process owner |
The same number can serve different purposes depending on how it is used. Patching completion is a KPI for the patching process, but "unpatched critical systems" used against a threshold to signal exposure is a KRI.
Leading and lagging
| Type | Looks | Example |
|---|---|---|
| Leading | Forward; signals risk is rising before a loss | Rising number of failed logins, growing patch backlog |
| Lagging | Backward; shows what already happened | Number of security incidents last quarter |
Good KRI sets include leading indicators, because they give time to act. Lagging indicators are still useful to confirm trends and validate the leading ones.
Choosing KRIs
ISACA guidance suggests selecting KRIs on these criteria:
| Criterion | Question |
|---|---|
| Impact | Is it linked to a risk with significant business impact? |
| Effort | Is it practical to measure and report? |
| Reliability | Does it consistently indicate the risk? |
| Sensitivity | Does it change when the risk changes? |
A good KRI is also linked to a specific risk in the register, has an owner, a clear definition and data source, a frequency, and thresholds tied to tolerance. Too many KRIs dilute attention; a few strong ones per major risk work better.
Thresholds and escalation
Thresholds turn a metric into a trigger, for example green below 5, amber 5 to 10, red above 10. Each level has a defined action: amber may require the owner to investigate, red may require escalation to senior management. Thresholds come from risk tolerance and appetite, agreed with the risk owner.
Monitoring and analysis
The practitioner watches values, trends and correlations. A KRI may stay green while a related KCI shows a control failing, which suggests exposure is about to rise. Several KRIs worsening together may point to a common cause.
Refining metrics
Metrics should be reviewed regularly. Signs a metric needs refining:
- It never changes, even when risk clearly does.
- It triggers constantly, so people ignore it.
- The data behind it is unreliable or costly to collect.
- The risk it tracks has changed or been retired.
Refinement may adjust thresholds, change the data source, or replace the metric.
A worked example
A bank wants an early warning of account takeover fraud. The practitioner and the fraud risk owner consider "number of fraud losses per month" but reject it as a lagging indicator.
They choose a leading KRI: the daily rate of logins from new devices that fail step-up authentication, with thresholds based on a normal baseline. A KCI tracks the percentage of high-risk logins that are challenged with step-up authentication, owned by the digital channels team. Three months later the KRI rises sharply after a phishing campaign, and the bank adds controls before losses grow.
How the exam asks about this
- "Which is the BEST key risk indicator for data leakage?" A leading measure tied to exposure, such as the number of large outbound transfers to unapproved destinations.
- "What is the PRIMARY purpose of a KCI?" To show whether a control is operating effectively.
- "A KRI has stayed green for two years while related incidents rose. What should the practitioner do FIRST?" Review and refine the KRI and its thresholds.
What to remember for the exam
- KRI measures risk, KCI measures control effectiveness, KPI measures performance.
- Leading indicators warn before loss; lagging indicators confirm what happened.
- KRI selection criteria: impact, effort, reliability, sensitivity.
- Thresholds come from tolerance and have defined escalation actions.
- Refine metrics that never move, trigger constantly or use unreliable data.
Do not choose a KPI when the question asks for a KRI. "Tickets closed per day" tells you about efficiency, not about the level of risk.
Common mistakes
Picking only lagging indicators. They describe losses already suffered and give no warning.
Setting thresholds without the risk owner. Thresholds must reflect the owner's tolerance and appetite.
Never reviewing metrics. Business changes make old KRIs insensitive or irrelevant.
Check yourself
What is the difference between a KRI and a KCI?
A KRI signals changes in the level of a risk, while a KCI shows whether a specific control is working as intended.
Why are leading indicators preferred as KRIs?
They signal rising risk before a loss, giving time to act.
What are ISACA's four criteria for selecting KRIs?
Impact, effort to implement and measure, reliability and sensitivity.
Topic 8 of 9 in Risk Response and Reporting
Test yourself on Risk Response and Reporting
The full ISACA CRISC question bank has 1,000 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by ISACA. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.