Conduct Risk KRIs: Indicators, Thresholds, and Incentive Blind Spots

TL;DR

• Conduct risk key risk indicators should connect commercial pressure, employee behavior, and customer outcomes. A complaint count by itself is too late and too easy to explain away.
• Use rates and segmented peer comparisons, not raw totals. Review by product, channel, team, and manager so enterprise averages do not hide a pocket of harm.
• Treat the thresholds below as starter logic. Calibrate them against clean internal history, then test whether prior complaints, refunds, cancellations, and investigations would have triggered an alert.

A conduct dashboard can stay green while the sales floor is producing the next enforcement order. That happens when the dashboard counts completed training and total complaints but never measures pressure, unusual overrides, early cancellations, or whether one manager’s team behaves differently from everyone else.

Good conduct risk key risk indicators answer a harder question: Where is the operating model creating pressure to produce an outcome that is good for the employee and bad for the customer? The answer rarely lives in one system. It appears when compensation data, sales activity, quality reviews, complaints, refunds, employee signals, and customer outcomes are joined at the right level.

Wells Fargo remains the blunt example. In its September 8, 2016 action, the OCC assessed a $35 million civil money penalty, ordered restitution, and cited the bank’s failure to implement an effective enterprise risk management program to detect and prevent unsafe or unsound sales practices. The practices included unauthorized deposit or credit-card accounts and transfers from authorized accounts to unauthorized accounts. The order required an enterprise-wide sales-practices risk management and oversight program.

That is the job of this KRI set: make pressure and abnormal behavior visible while someone can still investigate it.

What should conduct risk key risk indicators cover?

Build the set across three layers. If one layer is missing, the dashboard tells only part of the story.

The design principle is supported by the banking agencies’ June 21, 2010 Final Guidance on Incentive Compensation. The Federal Reserve, OCC, OTS, and FDIC said incentive arrangements should take risk into account and remain consistent with safe and sound practices. Their horizontal review found, among other deficiencies, that many firms lacked adequate mechanisms to evaluate whether established practices were actually successful in balancing risk.

A compensation policy can be approved and still fail in operation. The KRI has to show whether the arrangement changes behavior.

A practical conduct-risk KRI library

Do not activate every indicator at once. Select a small linked set for the specific conduct pathway you are monitoring. A deposit-sales program may need account-opening, funding-transfer, dormancy, and complaint indicators. A lending channel may need add-on attachment, decline overrides, fee reversals, early payoff, and affordability-review quality.

The thresholds below are illustrative starting points, not external benchmarks. Replace them after reviewing at least three to six months of clean internal history.

The point is linkage. An override spike with no customer effect may reflect a process change. Early cancellations without override movement may point to disclosures or channel quality. Both moving under the same manager deserves immediate review.

For broader indicator design mechanics, use the KRI examples and threshold guide before adding the conduct-specific joins above.

How do you set thresholds without inventing a benchmark?

A threshold should identify a decision point, not decorate a dashboard.

1. Clean the denominator

Confirm what belongs in the eligible population. If the override denominator excludes vendor-originated decisions while the numerator includes only employee overrides, comparisons between channels will be nonsense. Reconcile a sample of source transactions to the KRI extract and from the extract back to source.

2. Segment before calculating

Split by product, channel, tenure band, geography, and manager where those factors change expected behavior. Compare employees handling similar work. A mortgage team and a deposit contact center should not share one cancellation baseline.

3. Establish internal history

Use three to six months as a workable starting window only if the process and data definitions were stable. Longer history is useful when volumes are seasonal. Flag policy changes, campaigns, migrations, acquisitions, and taxonomy changes so they do not quietly reset the baseline.

4. Back-test known events

Take prior substantiated complaints, refunds, quality failures, employee reports, and investigations. Ask: Would this threshold have fired before or during the event? If no indicator moves, either the KRI is poorly chosen or the source data is too aggregated.

5. Define the action with the color

A threshold without a response owner is just formatting.

This is where a general KRI policy needs a conduct playbook. The KRI library versus build-from-scratch guide explains the trade-off between adopting a structured catalog and maintaining bespoke definitions.

The blind spots that make a conduct dashboard look healthier than reality

Enterprise averages

A company-wide complaint rate can improve while one partner, branch, or manager deteriorates. Require the dashboard to surface the worst stable segments, not just the blended result.

Raw counts

Ten complaints may be severe for 200 transactions and noise for two million. Use an exposure denominator and preserve the count. The rate supports comparison; the count shows workload and customer impact.

Self-reported reason codes

If employees choose the cancellation or override reason that drives the KRI, expect the taxonomy to drift toward harmless categories. Compare notes, call recordings, transaction behavior, and downstream complaints against the selected reason.

Threshold hovering

Teams learn dashboard rules. Review repeated values just below amber, end-of-period reversals, delayed complaint classification, manual exclusions, and changes in denominator logic. Map dashboard rows back to case and transaction IDs so Internal Audit can reproduce the number.

Complaint counts without operations data

The CFPB’s public Consumer Complaint Database is useful for themes, but an internal program needs more than submitted complaints. Join complaints to repeat contacts, refunds, cancellations, sales, employees, managers, products, and channels. The complaint-management program guide covers the case-level foundation needed before complaints can support a reliable KRI.

Training as the main measure

Training completion proves attendance, not behavior. Keep it as a control-performance measure. Do not let 99% completion offset rising override, cancellation, or substantiated-complaint rates.

What should happen after a conduct KRI breaches?

Use a short, evidence-driven sequence:

1. Validate the number. Reconcile source data, confirm the denominator, inspect exclusions, and verify that a system or taxonomy change did not create the movement.
2. Localize the pattern. Cut the result by manager, employee, product, channel, tenure, campaign, and customer cohort.
3. Review linked signals. Pull compensation, quality, override, cancellation, complaint, refund, and speak-up data for the same population and period.
4. Test cases. Select targeted records from the outlier population plus a comparison sample. Retain recordings, disclosures, decisions, approvals, and customer communications.
5. Assess harm. Determine whether customers paid fees, received unwanted products, lost access to funds, received inaccurate information, or were otherwise disadvantaged.
6. Decide remediation. Address customer redress, employee or manager action, compensation adjustment, process changes, enhanced monitoring, and control validation.
7. Track recurrence. Keep the KRI and case linked until the corrective action is independently validated.

The Department of Justice’s 2020 Wells Fargo resolution required the bank to pay $3 billion to resolve criminal and civil investigations into sales practices. That outcome did not begin with a dashboard color. It grew from an operating model where pressure, behavior, and harm were not interrupted effectively.

So what?

This week, pick one high-pressure customer journey and build a six-column trace: pressure signal → employee behavior → customer outcome → source system → owner → breach action. Start with one manager-level view. Reconcile ten records back to source. Then back-test the proposed thresholds against known complaints and refunds.

If the team cannot trace a red metric to the affected transactions and the person who must act, the KRI is not ready for committee reporting.

Need a structured starting catalog with owners, data sources, thresholds, and escalation fields? The KRI Library (132 Key Risk Indicators) gives you the operating structure; calibrate every threshold to your own history before use.