In a business we carry risks. Keeping control to contain risks might be counterproductive at times. Risk taking abilities need to be nurtured carefully. But what hinders it is whether we can get signals of risks that could be dragging us behind. Key Risk Indicators (KRI) can provide great value in managing risks and enhance value as you carry risks optimally.

1. Bet on the risk you carry
THRU
Key Risk Indicators

2. Presentation

3. In a business risk opportunity weighed
decisions provide best business value
3
LOW Moderate HIGH
R
I
S
K
Take at your own
peril : Bad decision
Binomial : To take or
not to
Tempting & best
reward proposition.
But can the
organisation take it ?
H
I
G
H
Ignore
Balanced : Risk
return trade off
Most desirable and
optimum conditions
M
o
d
e
rate
Most defensive. But
is it worth ?
Worth taking and
optimal decision
If at all we could
have it ! Ideal but
rare
L
O
W
Oppurtunity
Risk taking and risk-return
trade off is certainly desirable.
Risk - Control mechanism
would also play a role
provided controls are
balanced not to obstruct
desirable level of risk
taking
BUT the key question is how do we know whether risks consciously taken are not
heading towards a disaster? Can early warning signal be available?

4. What Gets Measured managed well : So
here the search for Key Risk Indicators
4
Key risk indicators (KRI) are metrics used by organisations to provide an early
signal of increasing risk exposures in various areas of the enterprise.
In some instances, they may represent key ratios that management throughout
the organisation track as indicators of evolving risks, and potential opportunities,
which signal the need for actions that need to be taken.
Others may be more elaborate and involve the aggregation of several individual
risk indicators into a multi-dimensional score about emerging events that may
lead to new risks or opportunities.
KRI differs from a Key Performance Indicator (KPI) in that the latter is meant as a
measure of how well something is being done while the former is an indicator of
the possibility of future adverse impact.
KRI give us an early warning to identify potential event that may harm continuity of
the activity/project.

5. Do not confuse between KPI and KRI : Both
are desirable measures but KRI is essential
5
Illustration :: Oversight of loan recovery collection
A KPI for credit sanction is likely to include data about customer delinquencies and
write-offs. This KPI, while important, provides insights about a risk event that has
already occurred (e.g., a customer failed to pay in accordance with the contract).
A KRI could be developed to help anticipate potential future recovery issues so that
the credit function could be more proactive in addressing customer repayment trends
before risk events occur.
A relevant KRI for this example might be analysis of financial results of the company’s
some select customers or general recovery challenges throughout the industry to see
what trends might be emerging among customers that could potentially signal
challenges related to recovery efforts in future periods.
So KPIs are important for identifying under performing aspects of the enterprise
as well as those aspects of the business that merit increased resources.
BUT senior management and boards will also benefit from a set of KRIs that
provide timely leading-indicator information about emerging risks.

6. KRIs originate from the balanced
scorecard of an organisation
6
An indicator becomes key when it tracks a potential risk exposure, which
originate due to strategic objective that organisation vigorously pursues at a
given point in time (say to met its profitability expectation) and which could have
a major influence on the organisation.
A risk indicator, thus, is a metric that provides information on the level of
exposure to a given risk that the organisation is experiencing at any time and is
prepared to take and would like to maintain around that.

7. Deriving & articulating KRI is a process
and synthesis of some more indicators
7
To conserve characteristic of KRI as lead indicator, KRI measure is deduced as a
synthesis of KPI measure and Key Control Indicators (KCI) measure.
KPI is a historical measure and KRI being predictive measure, KCI measure
provide the tensile strength to KRI to make it predictive
Key Performance Indicators
KPIs are actually a measure that demonstrates a movement in the likelihood or the
impact of a risk. Although they capture what has actually happened, they can be seen as
events that raise a warning about a risk.
Key Control Indicators
KCIs are a measure demonstrating a change in the effectiveness (e.g, design and
performance) of a control.
Key Risk Indicators
Since controls are natural offsprings to mitigate risks, KRI as a combined measure of a KPI
and KCI are linked to the residual impact of the risk with likelihood of the risk occurring.

8. Let Us Illustrate how KRI originate logically from
KPI and KCI measures
8
Illustration :: Risk :: Loss of Key Personnel
Risk has been mapped to a control. How do we measure the effectiveness of control? KCI
will indicate that i.e., whether people have been really been retained as a result of better
remuneration and incentive (by no. so retained)?
Risk Loss of key personnel
Control Adequate remuneration & motivation packages. Performance
incentive/ Bonus Pool
KPI Number of staff leaving without a planned successor
KCI Number of employees kept as a result of remuneration
change / bonus payment
KRI Number of staff leaving without a planned successor due to
remuneration / bonuses not being sufficient
How do we measure whether risk has actually been addressed or not? KPI provides an
answer i.e. by providing information on how many have actually left? But these are all on
historic information after occurrence.
Can we get a signal of impending risk? Look at the KRI. If we track how many has
actually left only due to remuneration and incentive not being sufficient, say on the basis
of exit interview, we can get an alert to improve the compensation and bonus policy.

9. Do not confuse : KRIs are not risks. Map the KRIs
to the risks that these signal
9
Illustration :: One risk each for ten major processes
Sl. Process/ Function Key Risk Indicator Risk
1 Accounts Unreconciled balances Manipulation of accounting data
2 Finance Increasing Idle cash at branches Loss of revenue
3 Credit Increasing NPA Erosion of profit
4 Treasury Interest rate fluctuation Erosion of value of debt portfolio
5 HR Employee turnover ratio Loss of skilled employee
6 Purchase Excess Inventory Loss of revenue margin
7 Sales No of customer complaints Lacking in market penetration
8 IT Network downtime Business / operational loss
9 Production Idle capacity percentage Unrecovered cost of production
10 Marketing Loss of market share Non achievement of growth
expectation

10. Derive benefits when you have KRI
measurement process in place
10
Early warning signal
Can provide a means of identifying: (a) emerging risk trends; (b) current exposure levels;
and (c) events that may have materialised in the past and which could re-occur..
Support risk assessments
Can also be used to support risk assessments by indicating whether pre-assigned
thresholds or limits are breached.
Control enhancement
Get indication that require the development and implementation of control measures.
Realistic risk appetite
Monitoring of KRIs is an important mechanism by which an organisation’s management can
gain assurance that it remains within its stated appetite for risk.
Capital allocation
Can be a supporting tool to calculate an accurate capital allocation for operational risk.
Enhanced process
KRIs hold promise in helping reduce service disruptions, supply chain management, and
enhancing customer experiences by potentially avoiding certain decisions that unexpectedly
create risks associated with these processes.

11. Potential value proposition from KRI can
be significantly derived in managing risks
11
Articulating risk appetite
By mapping KRI measures to identified risk appetite and tolerance levels, KRIs can be a
useful tool for better articulating the risk appetite that best represents the organisational
mindset.
o Interest volatility KRI would have a predetermined level of fluctuations at which the
organisation’s appetite for the risk associated with the security exposure would be exceeded.
Risk and opportunity alerts
KRIs can be designed to alert management to trends that may adversely affect the
achievement of organisational objectives or may indicate the presence of new
opportunities.
o if interest rate movements actually takes place as predicted, portfolio value may go up or profit
booked through immediate sale.
Risk Therapy
KRIs can initiate action to mitigate risks by serving as triggers for organisational units
assigned for monitoring particular KRIs. These can also serve to review the influence of any
controls by defining limits to certain actions.
o There may be a point at which interest rate fluctuation goes beyond such a high level beyond
expectation that the risk of moving forward with the exposure exceeds the organisation’s appetite
and therefore that KRI level would trigger a revision to the exposure limits set for the fund manager.

12. KRIs can assist Boards in enterprise-wide risk
oversights to enable proactive adjustment to
strategies in response to risk events
12
The use of KRIs to anticipate emerging risks and shifts in risks over time can reduce losses,
identify opportunities for strategic exploitation, and potentially reduce the cost of capital by
mitigating perceptions of risk borne by capital providers.
The use of KRIs makes the senior and middle management people to think in quantitative
terms helping the organisation to shay away from excuses of missing alerts. It can also lead
to fewer episodes of crisis management, requiring normal tasks to set aside for full-time
devotion to the impending threat.
A robust set of KRIs should help reduce the likelihood of surprises and position
management and boards in a proactive versus reactive stance, as indicated below
in COSO provided framework

13. Evaluation, Judgement and decision is a mental process. If
we think of a mechanical substitute to replace the same, it
will challenge the intelligence of human mind. The
quantitative models or evaluation techniques are only
facilitator and not end by itself.

14. www.treatriskinfo.blogspot.in
www.treatriskblog.blogspot.in
www.treatrisk.wordpress.com
Thanks
Contributed on request by : Kalyan Debnath : kalyan.debnath@gmail.com