Continuous Risk Monitoring and Key Risk Indicators

Risk doesn’t stand still

A risk assessment describes one moment. Threats evolve, systems change, suppliers come and go, and controls quietly degrade. Continuous risk monitoring keeps the picture current, so decisions aren’t based on last year’s facts. One CISM task is to monitor for internal and external factors that may require reassessment of risk.

What triggers reassessment

• New threats: exploited vulnerabilities, new attack campaigns
• Business change: new markets, products, acquisitions, reorganisations
• Technology change: cloud migrations, new systems, AI adoption
• Incidents, at the organisation or at peers
• KRI breaches: indicators crossing their thresholds
• Regulation and suppliers: new rules, supplier changes

Key risk indicators

Indicator	Question	Example
KRI (key risk indicator)	Is risk exposure changing?	% of privileged accounts without MFA
KPI (key performance indicator)	Is the process performing?	% of patches applied within target
KGI (key goal indicator)	Did we achieve the goal?	Security incidents with business impact this year

The best KRIs are leading: they warn before harm occurs. Lagging indicators, such as losses already suffered, confirm the risk but warn too late on their own.

Thresholds make KRIs work

A good KRI is:

• linked to a specific risk in the register
• measurable, preferably automatically
• timely: reported often enough to act on
• owned by a named person
• given thresholds, each triggering an agreed response or escalation

Examples of good KRIs

Risk	KRI
Ransomware	% of critical servers without an offline backup in the last 7 days
Account takeover	% of privileged accounts without MFA
Insider data loss	Leavers with active accounts more than 24 hours after leaving
Supplier breach	Critical suppliers overdue for security review
Phishing	Simulation click rate and report rate

Monitoring also covers controls (are they still operating?) and treatment actions (are they delivered on time?). Pick a few KRIs that track the top risks; dozens of indicators dilute attention.

How the exam asks about it

If the question asks…	The answer is usually…
An indicator that warns risk is rising	A key risk indicator (KRI)
What makes a KRI useful	Linked to a risk, with thresholds and an owner
When to reassess risk	On a schedule, and when internal or external factors change
The best KRIs are…	Leading, giving early warning
A KRI crosses its threshold	Trigger the agreed response or escalation

In short

• Risk changes constantly, so it's monitored continuously, not only at the annual assessment.
• Triggers for reassessment include new threats, business and technology change, incidents, KRI breaches, regulation and supplier changes.
• A key risk indicator (KRI) is a metric that signals a change in risk exposure, ideally before harm occurs (leading).
• Good KRIs are linked to specific risks, measurable, timely, owned and have thresholds that trigger action.
• KRIs differ from KPIs (process performance) and KGIs (goal achievement).
• Monitoring also checks that controls keep working and that treatment actions are delivered.

Exam traps

• A KRI without thresholds and a named response is just a number on a report.
• Lagging indicators (losses already suffered) warn too late on their own.
• Too many KRIs dilute attention; pick the few that track the top risks.
• Monitoring that nobody reviews isn't monitoring.

Slides

Click the slide and use the arrow keys. F toggles full screen.