How to choose KRIs that actually work

A key risk indicator (KRI) is a metric that gives early warning that a risk is increasing — before it turns into a loss. The value of your KRI program depends almost entirely on choosing the right indicators. Too few and you're blind; too many and the important ones drown. Here's how to choose well.

Leading beats lagging

The best KRIs are leading — they move before the risk materialises, giving you time to act. "Number of critical vulnerabilities open" is leading; "number of breaches last quarter" is lagging (it only tells you what already went wrong). Lagging metrics have their place for learning, but a KRI you can act on early is worth far more.

Tie each KRI to a real risk

Every KRI should trace back to a specific risk in your register. If you can't name the risk a metric is warning you about, it's probably a vanity indicator — interesting, but not a risk indicator. Start from your top risks and ask: "what would move before this happened?"

Prefer a few good indicators to many weak ones

Most risks need only one or two well-chosen KRIs. A sprawling library of dozens of metrics feels thorough but guarantees that no one watches any of them closely. Be ruthless: keep the indicators that would actually change a decision, and drop the rest.

Set green, amber and red thresholds

An indicator without a threshold is just a number. Define the boundaries that separate "fine" from "watch" from "act", tied to your risk tolerance. Be explicit about direction, too — for most metrics higher is worse, but for some (service uptime, cash reserves) lower is worse. Getting the direction right is a surprisingly common mistake.

Name a data source and an owner

For each KRI, record where the number comes from and how often you'll measure it — and who is responsible for acting when it turns amber or red. A KRI with no owner is a KRI no one responds to.

Watch the trend, not just the latest value

A single reading tells you where you are; the trend tells you where you're heading. An indicator drifting steadily toward its amber threshold deserves attention even before it crosses. This is why logging readings over time matters more than a one-off snapshot.

Make breaches impossible to miss

The final, decisive step: what happens when a KRI breaches? In a spreadsheet, the answer is usually "nothing, unless someone happens to look". In Rukn ERM's KRI software, readings are logged over time and the owner is alerted automatically the moment the red threshold is crossed — turning a passive metric into an active early-warning system.