Charta is on Google Play: practise on the go. Get the app
Charta

Tell apart KRIs (key risk indicators), KPIs (key performance indicators) and KCIs (key control indicators) by what each one measures.

FRM® Part II · Operational Risk and Resilience · Risk Measurement and Assessment · FRM2.ORR.4.c

The idea

The three metrics differ by what they measure. A key risk indicator (KRI) tracks a driver of exposure, such as staff turnover, failed trades or system downtime, and is meant to warn before losses occur. A key performance indicator (KPI) measures how well the business meets its objectives, for example throughput, speed or cost per transaction. A key control indicator (KCI) measures whether a control is operating effectively, such as the percentage of reconciliations signed off on time or access reviews completed. Each is monitored against thresholds, often green, amber and red, that trigger escalation. The common mistake is to classify by subject area instead of by what is measured. Another is to forget that a performance target can increase risk when it is not balanced by a KRI and a KCI.

A practice question

From the question bank, with the reason each wrong option is wrong.

Which description best fits a key risk indicator (KRI)?

  1. A metric that shows how well the business is meeting its targets for output, speed or cost.Why not: Describes a KPI, which measures performance against objectives.
  2. A metric showing whether a specific control is designed and operating as intended.Why not: Describes a KCI, which measures control effectiveness.
  3. A metric that signals changes in exposure to an operational risk, ideally ahead of losses. - correct
  4. A count of the operational losses booked in the accounts during the period.Why not: Describes loss data, a lagging outcome rather than a forward-looking indicator.

KRIs track risk drivers such as staff turnover or system downtime and warn of rising exposure; KPIs measure performance; KCIs measure control effectiveness.

A harder one

A settlements department reports three metrics: (i) percentage of daily reconciliations completed and signed off by deadline; (ii) number of transactions processed per employee per day; (iii) annualised staff turnover. Which classification is correct?

  1. (i) KCI, (ii) KPI, (iii) KRI. - correct
  2. (i) KPI, (ii) KRI, (iii) KCI.Why not: Assigns each metric to the wrong family; timely reconciliation is control operation, not performance or risk driver.
  3. (i) KRI, (ii) KCI, (iii) KPI.Why not: Treats productivity as a control measure and turnover as performance; turnover signals risk exposure.
  4. (i) KCI, (ii) KRI, (iii) KPI.Why not: Right on reconciliations but treats throughput as a risk indicator and turnover as performance.

Reconciliations on time test a control (KCI). Transactions per employee measure productivity against objectives (KPI). Staff turnover is a driver of error and fraud exposure (KRI).

The hardest tier

A bank's reconciliation-break KRI has risen 40% over two quarters, while its KCI, the percentage of reconciliations completed on time, remains at 99%. What is the most sensible conclusion?

  1. The KRI is unreliable, since a KCI at 99% proves that the control environment is effective.Why not: Treats timeliness as proof of effectiveness; a control can run on time and still not address the root problem.
  2. The KCI should be dropped, since it did not predict the KRI movement.Why not: Misreads KCIs as predictors of exposure; they show whether controls operate, not the level of risk.
  3. The control runs on time but may not prevent breaks, so review its design and the upstream cause. - correct
  4. Both metrics are KPIs, and a divergence between KPIs requires no action.Why not: Mislabels both metrics; they measure risk exposure and control operation respectively, and divergence is informative.

The KRI says exposure is rising; the KCI says the control is operating on schedule. Together they suggest the control is not designed to deal with the growing driver, so design and root cause need review.

In the app: 6 practice questions on this outcome, spaced review that brings it back before you forget it.

Start free →

More in Risk Measurement and Assessment