Skip to main content
Policy Authority
Category: Risk Reporting and Indicators

Risk Indicator

Also known as: Key Risk Indicator, KRI
Simply put

A risk indicator is a metric used to measure or signal how risky a particular activity or situation is for an organization. When such indicators are prioritized as especially significant predictors of potentially unfavorable events, they are commonly referred to as key risk indicators (KRIs).

Formal definition

A risk indicator is a metric used to measure risk, and in practice the term most often appears as a key risk indicator (KRI): a measure used in management to indicate the level of risk associated with an activity and to serve as a predictor of events that could adversely affect the organization against its objectives. KRIs are commonly applied in enterprise and operational risk management contexts to monitor risk exposure over time. This entry addresses the concept and function of risk indicators; it does not prescribe specific thresholds, calculation methods, tooling, or implementation approaches, which vary by organization, framework, and sector.

Why it matters

Risk indicators give organizations a structured, quantitative way to observe how their exposure to potentially unfavorable events changes over time, rather than relying on periodic qualitative judgment alone. When elevated to key risk indicators (KRIs), these metrics are treated as especially significant predictors of events that could adversely affect the organization against its objectives. This forward-looking function is what distinguishes a well-chosen risk indicator from a purely retrospective performance measure: the intent is to signal rising exposure before an adverse event materializes.

In enterprise and operational risk management, risk indicators support monitoring and escalation by making risk exposure visible to management and, where appropriate, to governance bodies. Because the value of a KRI depends on how well it actually predicts the events it is meant to signal, the selection and interpretation of indicators typically involves judgment about what constitutes a meaningful change in exposure. A risk indicator does not, on its own, control or reduce risk; it informs decisions about whether further assessment or treatment is warranted.

It is worth noting the limits of the concept. Risk indicators reflect what an organization chooses and is able to measure, and their usefulness varies by activity, framework, and sector. This entry addresses the function of risk indicators and does not prescribe specific thresholds, calculation methods, tooling, or implementation approaches, all of which vary by organization.

Who it's relevant to

Risk Managers
Those responsible for identifying, assessing, and monitoring risk use risk indicators, and particularly KRIs, to track how exposure changes over time and to prioritize which activities warrant closer attention. In enterprise and operational risk management, KRIs support ongoing monitoring rather than one-time assessment.
Governance and Executive Leadership
Boards and senior management may rely on aggregated risk indicators to understand the organization's risk exposure against its objectives and to inform decisions about whether further action is needed. Their interest is typically in the significance and reliability of a KRI as a predictor, not in its calculation detail.
Operational Risk and Business Line Owners
Operational KRIs are commonly used to monitor risk associated with specific activities and processes. Business line owners may use them to observe emerging exposure within their own area of responsibility.
Internal Auditors and Assurance Functions
Assurance functions may examine how management selects, monitors, and responds to risk indicators as part of evaluating the risk management process. This is an assurance activity distinct from the management activity of defining and acting on the indicators themselves.

Inside Risk Indicator

Metric or Measure
A defined data point or quantitative value that provides insight into a source of risk or a change in risk exposure. Risk indicators are typically expressed as measurable variables that can be tracked over time.
Threshold or Trigger Level
A predefined value or range that, when breached, signals a change in risk status and may prompt escalation or management action. Thresholds are commonly aligned with an organization's stated risk appetite and risk tolerance.
Leading or Lagging Orientation
An indication of whether the metric is predictive of emerging risk (leading) or reflective of risk events that have already occurred (lagging). Both types serve different purposes within a monitoring program.
Data Source and Ownership
The origin of the underlying data and the party responsible for collecting, validating, and reporting it. Clear ownership supports data quality and accountability, typically residing with first line functions while second line functions may set the framework.
Reporting Frequency and Cadence
The interval at which the indicator is measured and reported, which may vary by the volatility of the underlying risk and the needs of the receiving audience.
Key Risk Indicator (KRI) Designation
A subset of risk indicators deemed sufficiently significant to warrant focused monitoring. Not all risk indicators rise to the level of a KRI; the distinction generally reflects materiality relative to objectives.

Common questions

Answers to the questions practitioners most commonly ask about Risk Indicator.

Is a risk indicator the same as a key performance indicator (KPI)?
No. A risk indicator is intended to provide insight into the level, direction, or emergence of risk exposure relative to objectives, whereas a KPI measures the achievement of performance goals. Although a single metric can sometimes serve both purposes, the two are conceptually distinct: one signals uncertainty or the potential for adverse outcomes, while the other signals progress toward intended results. Treating every performance metric as a risk indicator can obscure this distinction and dilute the value of risk monitoring.
Does a risk indicator measure the risk itself?
Not directly. A risk indicator is typically a proxy or observable metric associated with a risk, not a direct measurement of the risk's likelihood or impact. Because indicators are proxies, they may correlate imperfectly with the underlying exposure and can lag, lead, or coincide with changes in risk. Interpreting an indicator as an exact measure of risk can lead to misplaced confidence; indicators inform judgment rather than replace assessment.
How are thresholds for a risk indicator commonly set?
Thresholds are commonly established with reference to the organization's risk appetite and risk tolerance, and may be informed by historical data, expert judgment, and the sensitivity required to prompt timely action. Many organizations define tiered thresholds (for example, escalating levels) to distinguish routine variation from conditions warranting attention. Threshold-setting is a management activity and typically involves calibration over time; specific values depend on context and are outside the scope of this entry.
Who is typically responsible for defining and monitoring risk indicators?
Responsibilities often align with a lines-of-defense structure. In many organizations, the operational functions that own the risk (commonly described as the first line) monitor indicators as part of day-to-day management, while risk management functions (commonly the second line) may design frameworks, aggregate indicators, and review escalation. Assurance functions such as internal audit generally evaluate the design and effectiveness of indicator processes rather than owning them, preserving their independence.
How frequently should risk indicators be reviewed?
Review frequency commonly reflects the volatility of the underlying risk, the speed at which conditions can change, and reporting or governance cycles. Some indicators are monitored continuously or in near real time, while others may be reviewed periodically. The set of indicators itself may also be revisited to confirm continued relevance as objectives, exposures, and the operating environment evolve. Appropriate frequency varies by context.
How can an organization tell whether its risk indicators remain useful?
Usefulness is commonly assessed by whether an indicator continues to correspond to the risk it is intended to signal, whether it provides sufficiently timely warning to enable action, and whether it prompts appropriate escalation or response. Indicators that no longer correlate with the underlying exposure, that are not acted upon, or that generate frequent uninformative alerts may warrant recalibration or retirement. Periodic validation supports continued relevance; specific validation methods and tooling are outside the scope of this entry.

Common misconceptions

A risk indicator is the same as a key performance indicator (KPI).
Although both are metrics, a KPI typically measures progress toward objectives or operational performance, whereas a risk indicator is intended to signal exposure to, or changes in, a source of risk. A single metric may sometimes serve both purposes, but the intended use and interpretation differ, and conflating them can obscure risk visibility.
A breached risk indicator threshold means a risk event has occurred or is certain to occur.
A threshold breach is a signal that warrants attention and possible investigation, not confirmation of an event or outcome. Indicators, particularly leading ones, are intended to prompt inquiry; they do not guarantee that a loss has materialized or will materialize.
More risk indicators always produce better risk monitoring.
An excessive number of indicators can dilute focus and generate noise. Effectiveness commonly depends on selecting a relevant set of indicators tied to material risks and objectives rather than on volume alone.

Best practices

Link each risk indicator to a specific, identified risk and to the objectives it may affect, so its purpose and interpretation remain clear.
Define thresholds with reference to the organization's stated risk appetite and risk tolerance, and document the escalation actions expected when a threshold is breached.
Distinguish leading indicators from lagging indicators when designing the set, and seek a balance appropriate to the risk being monitored.
Assign clear ownership for data collection, validation, and reporting, keeping first line accountability for the data distinct from any second line oversight of the framework.
Review indicators periodically to confirm they remain relevant, retiring those that no longer inform decisions and calibrating thresholds as conditions change.
Guard against indicator proliferation by prioritizing a focused set tied to material risks, and reserve key risk indicator status for those most significant to objectives.
a promotional banner asking how ready are you for PCI DSS 4.0? With a call-to-action to get the checklist now.