Free KRI library template.

What is a KRI?

A key risk indicator (KRI) is a metric that gives early warning that a risk is increasing — before it turns into a loss. Failed logins per day, overdue actions, critical vulnerabilities open, service uptime: each has a threshold, and crossing it should prompt action. KRIs are the "review & revision" heartbeat of a COSO ERM program.

What's inside the template

• One row per KRI with ID, name, related category, description, unit, data source and measurement frequency.
• Green / amber / red thresholds so status is unambiguous.
• Direction drop-down — "higher is worse" or "lower is worse" (e.g. uptime).
• Automatic status — enter the current value and the status cell colours itself GREEN, AMBER or RED.
• Owner for each indicator.
• Five worked examples across cyber, operations and reputation.

How to build your KRI library

1. For each significant risk, pick one or two metrics that move before the risk materialises.
2. Set green/amber/red thresholds and choose whether higher or lower is worse.
3. Name the data source and how often you'll measure it.
4. Assign an owner who acts when it turns amber or red.
5. Log readings on schedule and review trends, not just the latest value.

The template shows status when you type a value. In Rukn ERM, readings are logged over time and the owner is alerted automatically the moment a KRI breaches — no one has to be watching the sheet.