Key risk indicators (KRIs): how to choose them, with 50 examples
A risk register tells you what could go wrong. Key risk indicators tell you when it is starting to. Here is how to pick indicators that give you early warning rather than a post-mortem, how to set thresholds, and 50 examples you can adapt.
A key risk indicator (KRI) is a measurable metric that shows a change in the likelihood or impact of a specific risk — ideally before the risk materialises. Each KRI is linked to a risk in the register, has an owner and a reporting frequency, and has amber and red thresholds that trigger a defined response. Good KRIs are leading: they move before the loss, not after it.
KRI vs KPI vs KCI
Three kinds of indicator are often mixed up. They answer different questions:
| Indicator | Question it answers | Example |
|---|---|---|
| KPI — key performance indicator | Are we achieving our objective? | Monthly recurring revenue growth |
| KRI — key risk indicator | Is our exposure growing to something that could stop us? | Share of revenue from the largest customer |
| KCI — key control indicator | Are our controls working? | % of payments over £10k with a completed call-back check |
The same number can play more than one role. Staff turnover is a KPI for HR and a KRI for the risk of losing key knowledge. What makes it a KRI is the link to a named risk and thresholds tied to risk appetite, not the metric itself.
Control indicators matter too: a failing control is often the earliest sign that a risk is growing. Many organisations report KRIs and KCIs side by side and simply call them all “risk indicators”.
Leading vs lagging indicators
A lagging indicator counts what has already happened: losses, incidents, fines, complaints. It is easy to measure and useful for calibrating your scores, but by the time it moves, the damage is done.
A leading indicator measures a cause or a condition that makes the risk more likely or more severe: unpatched systems, overtime, overdue reviews, concentration on one supplier. It gives you time to act.
| Risk | Lagging indicator | Leading indicator |
|---|---|---|
| Data breach | Number of security incidents | Critical vulnerabilities unpatched beyond 14 days |
| Loss of key staff | Regretted leavers | Key roles without a trained deputy; engagement score in critical teams |
| Cash shortfall | Days with overdraft usage | Debtor days; forecast headroom over the next 13 weeks |
| Project overrun | Milestones missed | Open high-severity defects; unresolved scope change requests |
Aim for a mix: mostly leading indicators for decisions, a few lagging ones to check that the leading indicators actually predict anything. If incidents keep rising while every leading KRI is green, you are measuring the wrong causes.
How to choose good KRIs
Start from the risk register, not from the data you happen to have. For each significant or critical risk:
- Name the risk precisely. “IT risk” has no useful indicator; “ransomware encrypts production systems and backups” does.
- List its main causes and the controls you rely on. The best KRIs usually measure a cause getting worse or a control weakening. A well-built risk register already records both.
- Pick one to three measurable indicators for those causes. Prefer numbers you already collect over new manual surveys.
- Check each candidate against five tests:
- Relevant — if it moves, does the risk really change?
- Measurable — a number or percentage, defined so two people get the same answer.
- Timely — available often enough to act on: monthly at worst for most risks.
- Owned — one person reports it and answers for it.
- Comparable — consistent over time, so trends mean something.
- Set thresholds and the response to each (next section).
Low risks rarely need a KRI. Spend the effort on the 10–20 risks that would genuinely hurt.
Setting amber and red thresholds
A KRI without thresholds is just a chart. Thresholds turn it into a decision rule. Most organisations use three zones:
| Zone | Meaning | Typical response |
|---|---|---|
| Green | Within appetite | No action; report at normal cadence |
| Amber | Approaching the limit of appetite — still time to act | Risk owner investigates and agrees actions within an agreed period, e.g. 30 days |
| Red | Outside appetite | Escalate to the executive or risk committee; treatment plan with deadlines |
How to place the lines:
- Red comes from risk appetite. If your risk appetite statement says no single customer should exceed 25% of revenue, red is 25%. Where appetite is qualitative, translate it into a number with the risk owner.
- Amber is about lead time. Set it far enough from red that the response can take effect before red is reached. If diversifying customers takes a year, amber at 24% is useless; 18–20% might work.
- Check against history. Plot at least 12 months of data. If the KRI would have been red half the time with nothing bad happening, the threshold is wrong — or appetite is.
- Watch trends, not just levels. Three consecutive deteriorating months can justify amber even while the value is green.
- Review annually, and whenever appetite or the business changes.
Reporting cadence
| Audience | What they see | How often |
|---|---|---|
| Risk owner | All KRIs for their risks, with trend | Weekly or monthly, as data allows |
| Executive team | Amber and red KRIs, with owner commentary and actions | Monthly |
| Board or risk committee | 10–20 indicators linked to principal risks and appetite | Quarterly |
Every amber or red value should come with three lines of commentary: why it moved, what is being done, and when it is expected to return to green. A red KRI with no comment is a sign the indicator is ignored.
50 KRI examples by category
The thresholds below are illustrative, for a business of roughly £10–50m revenue. Set your own from your appetite and your history.
Cyber and IT
| # | Indicator | Why it is leading | Example thresholds |
|---|---|---|---|
| 1 | Critical vulnerabilities unpatched beyond 14 days | Each one is an open door attackers actively scan for | Amber > 0 · Red > 5 |
| 2 | % of user accounts without multi-factor authentication | Stolen passwords become access | Amber > 2% · Red > 5% |
| 3 | Days since last successful restore test of critical backups | Untested backups often fail when needed | Amber > 90 · Red > 180 |
| 4 | Phishing simulation click rate | Measures how easy initial compromise is | Amber > 5% · Red > 10% |
| 5 | Leavers whose access was not removed within 1 working day | Orphaned accounts are an access control gap | Amber > 0 · Red > 3 per month |
Operational
| # | Indicator | Why it is leading | Example thresholds |
|---|---|---|---|
| 6 | Backlog of unprocessed orders or cases, in days of work | Backlogs precede errors and missed service levels | Amber > 2 · Red > 5 |
| 7 | Critical processes depending on one person or one system with no fallback | Single points of failure turn small events into outages | Amber > 2 · Red > 5 |
| 8 | Business continuity plans not tested in the last 12 months | Untested plans rarely work first time | Amber > 10% · Red > 25% |
| 9 | Manual workarounds in key processes | Workarounds bypass controls and depend on memory | Amber: rising 3 months · Red > 10 |
| 10 | Near misses reported per month | A sudden drop usually means under-reporting, not safety | Amber: −50% vs average · Red: zero for 2 months |
People
| # | Indicator | Why it is leading | Example thresholds |
|---|---|---|---|
| 11 | Key roles without a trained deputy | Knowledge loss when one person leaves | Amber > 20% · Red > 40% |
| 12 | Voluntary turnover, rolling 12 months | Rising turnover precedes capability gaps | Amber > 15% · Red > 25% |
| 13 | Vacancies open longer than 60 days in critical teams | Overload on remaining staff and delivery risk | Amber > 2 · Red > 5 |
| 14 | Average overtime hours per person in critical teams | Fatigue drives errors and resignations | Amber > 8 h/month · Red > 16 h/month |
| 15 | Mandatory training overdue | Gaps in knowledge of controls and obligations | Amber > 5% · Red > 15% |
Financial and liquidity
| # | Indicator | Why it is leading | Example thresholds |
|---|---|---|---|
| 16 | Cash headroom at the lowest point of the 13-week forecast | Shows a shortfall weeks before it happens | Amber < £1m · Red < £0.5m |
| 17 | Debtor days (DSO) | Slower collection drains cash and may signal customer distress | Amber > 50 · Red > 65 |
| 18 | Receivables over 90 days, % of total | Early sign of bad debt | Amber > 5% · Red > 10% |
| 19 | Headroom against tightest bank covenant | A breach can trigger repayment demands | Amber < 20% · Red < 10% |
| 20 | Unhedged foreign currency exposure, next 12 months | Exchange moves hit margin directly | Amber > £2m · Red > £5m |
Customers
| # | Indicator | Why it is leading | Example thresholds |
|---|---|---|---|
| 21 | Revenue share of the largest customer | Concentration magnifies the impact of one loss | Amber > 20% · Red > 25% |
| 22 | Revenue from contracts up for renewal in the next 6 months with no renewal conversation started | Silent churn risk | Amber > 10% · Red > 20% |
| 23 | Complaints per 1,000 customers | Rising complaints precede churn and regulatory attention | Amber +25% vs average · Red +50% |
| 24 | Net revenue retention | Shrinking accounts before they leave | Amber < 100% · Red < 90% |
| 25 | Service level breaches on key contracts | Breaches lead to penalties and non-renewal | Amber > 1 · Red > 3 per month |
Suppliers and third parties
| # | Indicator | Why it is leading | Example thresholds |
|---|---|---|---|
| 26 | Critical inputs available from only one supplier | No alternative if the supplier fails | Amber > 2 · Red > 5 |
| 27 | Critical suppliers without a due-diligence review in 12 months | Deterioration goes unnoticed | Amber > 10% · Red > 25% |
| 28 | Supplier on-time delivery rate | Falling performance precedes stock-outs | Amber < 95% · Red < 90% |
| 29 | Critical suppliers with a weakening credit score | Financial distress before insolvency | Amber ≥ 1 downgraded · Red ≥ 1 below minimum rating |
| 30 | Contracts with critical providers lacking exit or continuity clauses | Limits your options in a failure | Amber > 0 · Red > 3 |
Compliance and legal
| # | Indicator | Why it is leading | Example thresholds |
|---|---|---|---|
| 31 | Overdue actions from audits or regulator findings | Unfixed findings become repeat findings and enforcement | Amber > 0 · Red > 3 or any > 90 days |
| 32 | Data subject requests answered outside the legal deadline | Direct breach of data protection law | Amber > 0 · Red > 2 per quarter |
| 33 | Policies past their review date | Outdated rules miss new obligations | Amber > 10% · Red > 25% |
| 34 | New regulatory changes without an assessed owner | Obligations nobody is preparing for | Amber > 0 for 30 days · Red > 0 for 60 days |
| 35 | Customers or payees not screened against sanctions lists | Sanctions breaches carry severe penalties | Amber > 0 · Red > 0 for 7 days |
Projects and change
| # | Indicator | Why it is leading | Example thresholds |
|---|---|---|---|
| 36 | Schedule performance index (SPI) | Slippage compounds over time | Amber < 0.95 · Red < 0.85 |
| 37 | Contingency budget used vs % of project complete | Burning contingency early predicts overrun | Amber: used > complete +10 pts · Red: +25 pts |
| 38 | Open high-severity defects before go-live | Quality problems at launch | Amber > 5 · Red > 15 |
| 39 | Unapproved scope change requests | Scope creep without budget | Amber > 3 · Red > 8 |
| 40 | Key project roles vacant or shared across projects | Delivery depends on stretched people | Amber ≥ 1 · Red ≥ 3 |
Health and safety
| # | Indicator | Why it is leading | Example thresholds |
|---|---|---|---|
| 41 | Safety inspections completed on schedule | Hazards go unnoticed when inspections slip | Amber < 95% · Red < 85% |
| 42 | Corrective actions from incidents overdue | The same incident can recur | Amber > 0 · Red > 5 |
| 43 | Staff working on equipment without current certification | Untrained operation of hazardous equipment | Amber > 0 · Red > 0 for 7 days |
| 44 | Statutory equipment checks overdue (lifting, pressure, fire) | Legal breach and failure risk | Amber > 0 · Red > 2 |
| 45 | Contractor induction completion before site access | Contractors are over-represented in serious incidents | Amber < 100% · Red < 95% |
Strategic
| # | Indicator | Why it is leading | Example thresholds |
|---|---|---|---|
| 46 | Share of revenue from products launched in the last 3 years | Falling renewal of the portfolio signals obsolescence | Amber < 15% · Red < 10% |
| 47 | Win rate against the main competitor | Losing position before it shows in revenue | Amber −10 pts vs last year · Red −20 pts |
| 48 | Revenue from a single channel or platform (app store, marketplace) | One policy change can cut sales | Amber > 40% · Red > 60% |
| 49 | Strategic initiatives behind plan | Strategy not being delivered | Amber > 20% · Red > 40% |
| 50 | Gross margin trend, rolling 3 months | Pricing pressure or cost inflation not passed on | Amber −2 pts · Red −4 pts vs plan |
Common mistakes
- Only lagging indicators. Counting incidents and losses describes the past. Ask, for each KRI: would this have warned us before the last incident?
- KRIs not linked to a risk. A dashboard of interesting metrics is not a risk dashboard. Every KRI should point to a risk in the register, and every critical risk should have at least one KRI.
- Thresholds nobody believes. Red that has been red for a year means the threshold or the appetite is wrong. Fix one of them.
- Too many indicators. 150 KRIs means none are read. Keep the board set to 10–20.
- No response attached. If amber and red trigger nothing in particular, the KRI is decoration. Write down who does what at each threshold.
- Data only the owner can produce. Indicators that rely on manual spreadsheets stop being updated. Prefer data that comes from systems.
- Never revisiting them. Risks change; so should their indicators. Review the KRI set at least once a year alongside the risk scores.
Frequently asked questions
What is a key risk indicator?
A measurable metric that signals a change in the likelihood or impact of a specific risk, ideally before it materialises. Each KRI has an owner, a reporting frequency and thresholds that trigger action.
What is the difference between a KRI and a KPI?
A KPI measures progress towards an objective; a KRI measures exposure to something that could prevent it. The same metric can be both — a KRI is defined by its link to a risk and by thresholds tied to appetite.
How many KRIs should a risk have?
One to three for each significant or critical risk. Low risks rarely need one. Keep the board-level set to 10–20 indicators.
How do you set KRI thresholds?
Red is where the risk would exceed appetite; amber leaves enough time to act before that. Calibrate both against at least 12 months of history and review them annually.
KRIs linked to each risk
In Risk Samurai indicators sit next to the risks they measure, with owners, thresholds and review dates — so an amber value leads straight to the risk and its actions. AI drafts the first version of your register.
Get early access