Key Risk Indicators (KRIs): Examples and Thresholds

The quarterly risk report says the supply chain risk is amber. It said amber last quarter too. In between, a key supplier lost two of its three crews, overtime on site doubled and inspections slipped three weeks behind. Every one of those signals was measurable. None of them was on the report.

That gap, between the data an organisation already holds and the risk picture it reports, is the problem key risk indicators exist to close. Most organisations have a register, a rating scale and a review cycle. What they lack is a small set of measures that move before the risk does, each with a line that tells someone to act.

This guide covers what KRIs are, how they differ from KPIs, how to develop them, how to set thresholds from your risk appetite, examples for five sectors, and how to report them so the board sees what matters.

What Are Key Risk Indicators?

Key risk indicators (KRIs) are metrics that give early warning that exposure to a specific risk is rising, before the risk turns into a loss. Each one tracks a driver of a risk, is measured on a set frequency, and has thresholds tied to the organisation’s risk appetite that trigger a response.

The word that matters is early. A KRI earns its place by moving first. If it only changes once the damage is done, it is reporting history.

COSO’s 2010 thought paper on KRIs makes the same point: the closer an indicator sits to the root cause of a risk event, the more time management has to respond. Most organisations are not there yet. In the 2023 State of Risk Oversight report from the AICPA and NC State, only 28% of the 454 organisations surveyed described their KRIs as mostly or extensively robust.

KRI vs KPI: What Is the Difference?

KPIs and KRIs often sit on the same dashboard, which is why they get confused. A KPI measures progress towards an objective. A KRI measures rising exposure to something that could stop you reaching it. A third type, the key control indicator, tells you whether a control is working.

The same number can play more than one role. Inspections completed on schedule is a control indicator for the inspection regime and a risk indicator for the safety risk that regime manages. What matters is the question you are asking of it.

What Makes a Good KRI?

Good key risk indicators pass six tests.

• It is leading, so it moves before the risk event rather than after it.
• It is measurable, with a definition everyone calculates the same way.
• It has thresholds, set in advance and tied to appetite.
• It has owners: one person responsible for the data and one accountable for acting on it.
• It is worth collecting, because the insight outweighs the effort of gathering it.
• It traces back, so you can say which risk it watches and which objective that risk threatens.

Most weak KRIs fail the first test. Counts of incidents, complaints and audit findings are useful, but they record what has already happened. Ask what changes in the weeks before an incident, and measure that.

How to Develop Key Risk Indicators

Developing key risk indicators is less about inventing metrics than choosing the few that matter. Five steps get you there.

1. Start from the objective and the material risk

Begin with what you are trying to achieve, then the risks that genuinely threaten it. COSO suggests starting with the top 5 to 10 risks and asking each risk owner for one or two indicators per risk. That produces a set a leadership team can actually read.

2. Find the drivers worth measuring

For each risk, ask what causes it and what happens in the run-up to it. A bowtie analysis maps this well, with causes on one side of the risk event and consequences on the other. The causes are where leading indicators live. If project overruns are usually preceded by subcontractor resourcing problems, the indicator is resourcing, not the overrun.

3. Reuse what you already measure

You probably collect half of what you need already. Maintenance backlogs, vacancy rates, overdue actions and inspection completion rates sit in other systems. A performance measure that is drifting is often the first sign of a risk building, so look there before creating new data collection.

4. Set thresholds from your risk appetite

Every KRI needs three levels: green for normal, amber for watch and red for act. Set them from what the organisation is willing to accept, not from what the data happens to average. If the line between appetite and tolerance is still blurred in your organisation, start with how risk appetite differs from risk tolerance. The worked example below shows the whole process.

5. Assign owners, a data source and a frequency

Name the person who reports the indicator and the person who acts on it. Often they are different people. Agree where the data comes from, how it is calculated and how often it is measured. A daily operational KRI and a quarterly strategic one can sit in the same set, as long as everyone knows which is which. Record all of this in the monitoring section of your risk management plan, so the set survives a change of owner.

How to Set KRI Thresholds That Reflect Your Risk Appetite

Thresholds are where most KRI programmes go soft. Here is one worked through from start to finish. The figures are illustrative.

A mining company has a clear objective: every worker goes home safe. Its risk appetite statement says it has no appetite for fatalities and a low appetite for serious injury. The material risk is a worker being killed or seriously injured by a critical hazard, such as a vehicle interaction or a fall from height. The controls that prevent this are critical controls, and each one must be verified in the field on a schedule.

The KRI is the percentage of scheduled critical control verifications completed on time across all sites. It is a leading indicator. Verifications slip before controls fail, and controls fail before people are hurt.

Now set the levels. Look back over the last 12 months. Suppose completion normally runs at 96% or above, and the only two months it fell below 90% were during a major shutdown, when the site recorded its two most serious near misses of the year. The data is telling you where the line sits.

Illustrative thresholds from the worked example above.

Three things make this work. Each level has a response agreed in advance, so nobody debates what amber means on the day. The red line sits where the history says harm becomes more likely, not at a round number. And the thresholds are reviewed after three reporting cycles, because the first set is always a hypothesis.

Key Risk Indicators Examples by Sector

The method holds across sectors. What changes is the risk that matters most and the data that warns of it. These examples are illustrative starting points, not benchmarks, so calibrate every threshold to your own history and appetite.

KRIs for construction

Late critical-path activities show up weeks before a missed handover date. Separate portfolio risks, such as contractor capacity across the whole programme, from project risks, and give each its own indicator.

KRIs for government

Casework drifting towards its statutory deadline is visible long before the deadline is missed. Pair it with the vacancy rate in the team doing the work, which usually moves first.

KRIs for infrastructure and utilities

A growing maintenance backlog on critical assets comes before the failure, not after it. Because these assets last for decades, watch the trend over several years, not just this quarter.

KRIs for mining and resources

Samples creeping towards licence limits give you time to act before a breach has to be reported. Where you operate in more than one jurisdiction, set thresholds against each licence, not a single company average.

KRIs for transport

Rostered shifts that breach fatigue limits are a leading signal for some of the most serious incidents on rail and road. Any breach deserves a look, which is why green is set at zero.

How to Report KRIs: Dashboards and Board Reporting

Boards do not need every KRI. COSO’s guidance is that senior management and the board should be kept updated on the indicators linked to the organisation’s top risk exposures, while risk owners work with the full set. A good KRI dashboard for the board shows three things for each top risk: the current level against its thresholds, the trend over recent periods and what is being done about anything amber or red.

Report against decision cycles, not just the calendar. If the board approves the capital programme in March, the KRIs on delivery risk need to land before that meeting, not after it. For more on what a strong board pack contains, see what directors actually need to see in a risk report.

This is where spreadsheets struggle. A KRI tracked in one workbook, its risk in another and the actions in a third will be out of date by the time it reaches the board. Risk management software that links KRIs to business objectives keeps the indicator, its thresholds, the risk, its controls and the open actions in one place, with configurable dashboards, notifications when a threshold is crossed and board-level reports drawn from current data.

Common KRI Mistakes

These show up in almost every first attempt at a KRI set.

• Teams measure what has already happened. Counts of incidents and losses tell you the risk has arrived, so measure its drivers instead.
• Organisations track too many indicators. Fifty KRIs produce noise, not warning, so start with one or two for each top risk.
• Thresholds are set from averages. A red line at the long-run average produces constant false alarms, so set it where history says harm becomes more likely.
• Nobody agrees the response in advance. If no one knows what amber triggers, an amber reading becomes a discussion instead of an action.
• Indicators cannot be traced. A KRI that cannot be linked to a risk and an objective is a metric looking for a purpose.
• The set is never reviewed. Strategies change and indicators lose their value, so review the set when the strategy moves and check whether past breaches really preceded problems.

The thread running through all six is the same. A KRI is the last link in a chain: the traceable link from an organisation’s objectives through its risks, controls, actions and assurance to the indicators that show whether it is performing. Break any link and the indicator loses its meaning. For a deeper treatment of indicators in operational risk, read using risk indicators to strengthen operational risk management.

Put your indicators to work. Clew is a risk and assurance platform built around the Golden Thread, so every KRI traces back to the risk it watches, the controls and actions that manage that risk, and the objective it protects. Risk and assurance teams in construction, government, infrastructure and utilities, mining and resources, and transport use Clew to see indicators move in time to act on them. Find out where your organisation stands with the free risk maturity assessment, or explore Clew’s risk management software.

Related Resources

• A practical guide to implementing a risk management framework sets out the build from scope to first review.
• How risk appetite differs from risk tolerance explains the two lines your thresholds depend on.
• What directors actually need to see in a risk report covers the board view in more depth.
• Reporting risk to the board is Clew’s white paper on board-level risk reporting.
• How to write a risk management plan, step by step shows where KRIs sit in the wider plan.