Key Risk Indicators (KRIs): A Practitioner's Guide with 50+ Examples by Risk Domain

Your regulator just asked how you’re monitoring operational risk. Your head of internal audit wants to see the early warning indicators that feed into the board risk report. You’re building an ERM program from scratch and the framework document says “establish KRIs” but doesn’t tell you what those actually are.

Here’s a practitioner’s guide — including 50+ ready-to-use examples you can drop straight into your risk register.

TL;DR

• KRIs are forward-looking metrics that signal increasing risk exposure before a loss or incident occurs — not the same thing as KPIs
• Good KRIs are measurable, owned by the right function, and tied to three-tier thresholds (green/amber/red) that trigger defined escalation responses
• Most organizations need 3–5 KRIs per material risk category — more creates noise, fewer creates blind spots
• The 50+ examples below span operational, credit, compliance, cyber, liquidity, model, and third-party risk domains

KRI vs. KPI: The Distinction That Actually Matters

The most common mistake in KRI design is confusing a KRI with a KPI. They look similar — both are metrics, both are tracked on dashboards — but they serve opposite purposes.

A KPI (Key Performance Indicator) measures whether the business is achieving its objectives. Customer retention rate, revenue growth, loan origination volume — these are KPIs. They tell you where you’ve been.

A KRI (Key Risk Indicator) measures whether a risk is trending toward its tolerance limit. Percentage of overdue escalated complaints, rate of unpatched critical vulnerabilities, number of policy exceptions approved in the past quarter — these are KRIs. They tell you where you’re heading.

The relationship between them: a KPI records an outcome; a KRI predicts whether that outcome will deteriorate. If loan delinquency rates (a KPI) are rising, you’ve already had the problem. If your early-stage 30-day delinquency KRI has been trending up for three months, you can still intervene.

As the Institute of Operational Risk notes, KRIs work as an early warning system only when they’re prospective — measuring conditions that precede losses, not the losses themselves.

What Makes a KRI Actually “Key”

Not every metric that touches risk is a key risk indicator. The COSO ERM 2017 framework establishes that effective risk monitoring requires metrics that are predictive, measurable, and tied to risk appetite. That translates into four criteria a KRI has to meet:

1. Predictive, not reactive. The KRI should move before the risk materializes, not after. “Number of data breaches this quarter” is not a KRI — it’s a loss event count. “Percentage of systems with unpatched critical vulnerabilities older than 30 days” is a KRI — it predicts breach probability.

2. Measurable and timely. If you can’t produce the metric reliably on the required reporting cycle, it’s not operational. Don’t commit to weekly KRIs you can only measure monthly.

3. Linked to risk appetite. Each KRI should connect back to a specific risk category in your risk appetite statement. If your appetite says zero tolerance for regulatory violations, you need KRIs that predict regulatory violations before they occur — complaint escalation rates, exam finding aging, policy exception accumulation.

4. Owned by the right function. Metrics monitored by people who have no ability to act on them are decorative. KRI ownership should sit with the business function closest to the risk, with the risk function providing governance and escalation protocol.

How to Set Thresholds

Thresholds are what separate a KRI from a metric. Without defined escalation triggers, you have a dashboard. With thresholds, you have a risk monitoring program.

The three-tier structure used across most ERM frameworks:

In practice, amber should trigger at roughly 70–80% of the red threshold — early enough to act before you breach, late enough that you’re not in permanent amber. A KRI that’s almost always amber has the wrong threshold; a KRI that’s almost always green and never hits amber might have a threshold that’s too loose.

Set thresholds by working backward from your risk appetite statement. If your appetite says acceptable operational loss is less than 2% of annual revenue, the red threshold for your operational loss KRI is 2%. Amber starts at 1.4–1.6%. Calibrate with historical data where you have it; start with judgment-based estimates where you don’t, and revise after the first year of monitoring data.

50+ KRI Examples by Risk Domain

Operational Risk KRIs

Credit Risk KRIs (Financial Services)

Compliance Risk KRIs

Cybersecurity KRIs

Liquidity Risk KRIs

Model Risk KRIs (AI/ML)

Third-Party/Vendor Risk KRIs

KRI Governance: Who Owns What

The most common KRI failure isn’t bad metrics — it’s orphaned metrics. KRIs that exist in a spreadsheet, are reported upward every quarter, and never trigger any conversation because nobody owns the response.

Effective KRI governance requires three things:

1. Explicit ownership at the business level. Every KRI has a named owner in the function responsible for the underlying risk. That owner reports on threshold status in risk committee and initiates investigation when amber is reached — without waiting to be asked.

2. Risk function governance. The risk team sets the framework, reviews thresholds annually, tracks breach trends, and ensures KRIs connect to the risk appetite statement. Risk is the referee, not the player.

3. Board-level visibility for red threshold breaches. When a KRI hits red, it should be on the board risk committee agenda within one reporting cycle. Not buried in an appendix — explicitly discussed, with a named response plan.

The COSO ERM 2017 framework establishes that risk monitoring is a continuous process, not a periodic report. KRIs operationalize that principle — they turn abstract risk appetite language into specific metrics with specific owners and specific escalation protocols.

Common KRI Design Mistakes

Tracking outcomes instead of leading indicators. “Number of regulatory fines paid this year” is not a KRI. It’s a loss event log. By the time you’re counting fines, the risk has already materialized.

Setting thresholds without owner alignment. A threshold your risk team set without consulting the business owner will get challenged every time it goes amber. Set thresholds collaboratively, document the rationale, and revisit annually.

Too many KRIs. A KRI library with 150 indicators across 30 categories generates reporting fatigue and organizational numbness. When everything is monitored, nothing is monitored. Three to five KRIs per material risk category is the right density.

KRIs with no escalation protocol. A metric that goes red with no defined response is theater. Before you publish a KRI, document what happens when each threshold tier is breached: who is notified, what investigation is initiated, what treatment is required.

Monitoring frequency mismatch. Cyber KRIs need daily or real-time monitoring. Vendor risk KRIs work monthly or quarterly. Matching monitoring cadence to risk volatility is a governance decision, not a convenience choice.

So What?

KRIs aren’t a compliance checkbox. They’re the operational mechanism that connects your risk appetite statement to real-world monitoring — the thing that lets you tell your regulator, your board, and yourself that you know when your risk exposure is shifting before it becomes a problem.

The examples above are starting points. The right KRIs for your organization depend on your business model, risk profile, and what your risk appetite statement actually says. Start with your highest-priority risk categories, pick 3–5 indicators per domain, set three-tier thresholds, assign owners, and build the reporting cadence. Revise after the first year of data.

If you’re building this from scratch and want a pre-built library mapped to risk categories, the KRI Library includes 100+ KRIs across 15 risk domains with suggested thresholds, ownership guidance, and monitoring frequency — designed to be dropped into an existing risk register without rebuilding from scratch.

Related reading:

• How to Build an Enterprise Risk Management Framework from Scratch
• Risk Appetite Statement: How to Write One Your Board Will Actually Approve
• COSO ERM Framework Explained: The 5 Components and 20 Principles

External references:

• Institute of Operational Risk: Key Risk Indicators
• MetricStream: Key Risk Indicators in ERM
• Ncontracts: Key Risk Indicators for Banks and Financial Institutions
• Quantivate: KPI vs. KRI in Risk Management