DerpGRC

    Topics in this domain

    KRIs, KPIs and KCIs

    Monitoring and metrics · 1 min read

    Four kinds of indicator

    KGI: did we achieve the goal? KRI: is risk rising? KPI: is the process performing? KCI: is the control working?

    Same goal, different indicators

    KGI measures result, KPI measures process performance, KRI signals rising risk, for the goal of fewer incidents.

    What makes a good indicator

    Useful metric: linked to an objective, measurable and accurate, timely, owned, with target and threshold, meaningful to the audience.

    Leading versus lagging

    Lagging (after the fact)Leading (early warning)
    Number of breaches last yearPrivileged accounts without MFA
    Outage hours last quarterFailed backup tests this month
    Fraud lossesOverdue supplier bank-detail verifications

    Example. A bank chose “percentage of high-risk vendors without a current assessment” as a KRI for third-party risk. When it rose from 5% to 22% after a reorganisation, assessments were restarted before any incident occurred.

    How the exam asks about it

    If the question asks…The answer is usually…
    MOST useful characteristic of a KRIIt’s a leading indicator of risk change
    Measures whether a control worksKCI
    Measures process performanceKPI
    Who should help choose KRIsThe risk owner

    In short

    • KRIs signal changes in risk; KPIs measure process performance; KCIs measure control effectiveness; KGIs measure goal achievement.
    • The best KRIs are leading indicators: they change before the risk materialises.
    • Good indicators are linked to a risk or objective, measurable, timely, owned and have thresholds.
    • Indicators should be chosen with the risk owner and reviewed as risks change.
    • A small set of meaningful indicators beats a long list nobody reads.

    Exam traps

    • Using lagging measures such as incident counts as early warnings.
    • Confusing a KPI (process performance) with a KRI (risk change).
    • Indicators with no threshold or owner.
    • Collecting indicators because the data is easy to get.

    Slides

    Click the slide and use the arrow keys. F toggles full screen.

    CRISC · Domain 3 · Monitoring and metrics

    KRIs, KPIs and KCIs

    The difference between key risk, performance, control and goal indicators, what makes each useful, and how to choose indicators that warn before risk materialises.

    1 / 8