From appetite to a number
A risk appetite statement says, in words, how much risk of one category a company is willing to take. A key risk indicator (KRI) makes the statement measurable: it is defined against one risk in the register, has an owner, a data source, a frequency and a unit, and its Amber and Red thresholds express the appetite in numbers. COSO ERM places this in Review and Revision; ISO 22301 asks for it under clause 9.1, monitoring, measurement, analysis and evaluation.
The value of an indicator lies in its history: the same measure, read against the same bands, period after period. Most indicator programmes lose that value in one of two ways — the thresholds are changed and the old observations are silently re-coloured, or a Red reading is noted in a meeting and nothing is assigned.
Three bands, one unit
- Green — within appetite. Amber — approaching the limit, an early warning. Red — outside appetite, a breach.
- Set per indicator, in its own unit. A count, a percentage, an amount, a number of days. The boundaries between the bands belong to the indicator, not to a generic scale.
- The band is computed. An observation is one value for one date. The system places it in a band; the person entering it does not choose the colour.
- Every calibration is a version. When the Entity Risk Manager changes the thresholds, the new boundaries apply from a stated date and the earlier version stays in the indicator's history. Each observation keeps the band of the version in force on its own date, so a trend line does not move when the bands change.
Figure 12KRIs: three bands, versioned thresholds, every Red is an actionEach observation is placed in Green, Amber or Red by the system, against the threshold version in force on its date. A Red observation is a breach: it needs an explanation and creates an action item. Calibration creates a new version; history does not move.
When an observation is Red
- An explanation is required. A Red observation cannot be saved without one: what caused it and what is being done.
- A breach is opened and an action item created, with an owner and a due date, in the same action register as control test failures and single points of failure.
- The breach stays open, with its age shown, until the action is closed. Open breaches by entity and by risk are an input to the management review.
Indicators the continuity side fills in
Some of the most useful indicators are not typed by anyone. Every hazard a company watches in its continuity plan — flooding, a power failure, a system outage — can be an external indicator on the risk side: when the continuity level for that hazard changes, the change is recorded as an observation. Normal reads as Green, Standby as Amber, Activated as Red, and the level note serves as the explanation. The risk desk then sees continuity events in the same place as every other indicator, with the same breach and action rules.
Where it usually breaks
- Indicators without a risk. A dashboard of twenty measures, none of them tied to a risk in the register, so nobody can say which risk a Red reading belongs to.
- Re-coloured history. Thresholds are relaxed and last year's breaches turn Amber. The trend the committee saw in March no longer exists in June.
- Red without an owner. The breach is discussed and minuted. Nothing in the action register changes.
- A chosen colour. The spreadsheet lets the owner pick the band. Amber is a popular choice.
In Risk Core
Risk Core — powered by Qirin X · ComplyWise. In ERM Core each indicator in the KRI library is defined against one risk in the register — an indicator cannot be saved without one — with an owner, data source, frequency and unit, and a code issued by the system (KRI-CM-001). Thresholds are three bands in the indicator's unit, calibrated by the Entity Risk Manager with the date they apply from; every calibration is a new version and each observation keeps the band of the version in force on its date. The band is computed; a Red observation cannot be saved without an explanation; every breach creates an action item and stays open, with its age, until the action is closed. Appetite statements are linked to the indicators that measure them, so the words and the thresholds say the same thing.
External KRIs are filled in by BCP Core: each change of an entity's BCP level for a hazard is recorded as an observation — Normal to Green, Standby to Amber, Activated to Red — with the level note as the explanation. They cannot be typed, edited or deleted by hand, and a group advisory from the parent never creates one for a subsidiary. A group starting from zero can adopt indicators from the Demonstration Set that ships with the module and calibrate them for its own entity.
Platform summary and the ComplyWise services around it: Risk Core. Product documentation: KRI, Thresholds and External KRIs from BCP Core on Risk Core Docs.
The series
Six articles, one stage at a time. Each one explains the framework first and ends with how Risk Core implements it.
- 1
Enterprise risk management in practice: the six-stage risk life cycle
- 2
RCSA in practice: a risk score nobody can type
- 3
Loss events in practice: the tier is computed, the month is always filed
- 4
Key risk indicators in practice: three bands, versioned thresholds, every Red is an action
- 5
From the business impact analysis to the continuity plan: how a recovery time becomes a call-tree order
- 6
Group risk governance in practice: each company runs its own, the parent reads up
Frequently asked questions
- What is the difference between a KRI and a KPI?
- A key performance indicator measures how well an activity is doing against a target. A key risk indicator measures how close a risk is to exceeding appetite; it is defined against a risk and read against thresholds. The same data point can serve both, but the bands and the owner are different.
- How many KRIs should a company have?
- Enough to cover the risks that matter, each with an owner who can act on a breach. A common pattern is one indicator per significant risk in the register, with more for the few risks that need several views. Indicators without a risk or an owner add noise rather than insight.
- Who sets and changes KRI thresholds?
- The entity's own risk manager, for the entity's own indicators, with the date the new bands apply from. Appetite statements approved by the board or risk committee are what the thresholds should express. A parent company reads a subsidiary's indicators and does not calibrate them.
- What should happen when a KRI turns Red?
- The owner explains the cause and the response, a breach is opened and an action item is assigned with a due date. The breach stays open until the action is closed, and open breaches are reviewed by management each period.
Sources
- Risk Core Docs — KRI: library, thresholds, observations and breaches, external KRIs from BCP Core
- Risk Core Docs — Thresholds: Green, Amber and Red per indicator; every change is a new version
- Risk Core Docs — Observations and breaches: the band is derived; an explanation is required on Red
- Risk Core Docs — External KRIs from BCP Core: Normal to Green, Standby to Amber, Activated to Red
- Risk Core Docs — Risk appetite statements: per category, linked to KRIs and their thresholds
- Risk Core Docs — Product rules: the seven rules Risk Core enforces in the database
- Risk Core Docs — Standards mapping: COSO ERM (2017), ISO 22301:2019 and the Basel event types
- COSO — Enterprise Risk Management: Integrating with Strategy and Performance (2017), guidance page
- ISO 22301:2019 — Security and resilience — Business continuity management systems — Requirements
Accessed and last reviewed . Each figure and table cell is traced to a source above.