Edward Sankey, Chairman of the Council of the IOR, says:
“Reporting with KRIs is the operational risk activity that is most evident to directors and business management. The impact of operational risk management depends on accurately directing management attention to the issues of the day.”
“This sound practice paper drives home the key link between risk reporting on the one hand and governance and monitoring risk tolerance on the other, It provides senior managers and risk practitioners with practical guidelines on developing and using KRIs.”
In an operational risk context a KRI is a metric that provides information on the level of exposure an organisation has at a particular point in time to a given operational risk. It is, however, an area that has proven to be particularly challenging for many organisations.
The IOR’s paper outlines the sound practices in relation to the use of risk indicators to support the management of operational risk. But whilst risk indicators are acknowledged as a valuable tool, the guidance paper warns against over reliance on a metric driven traffic light mentality at the expense of good management judgement. The use of fixed lists or optimum indicators is also advised against as KRIs will vary both by organisations and over time and, in addition, need to be updated on an ongoing basis.
Selecting the best indicators – those that are relevant, easy to use and predictive – is crucial as any piece of data could conceivably be viewed as a metric. The paper provides guidance on establishing the specific characteristics and how to select the optimum indicators.
Implementing a set of indicators is only part of the solution the paper advises. Guidelines also need to be established on how to interpret the indicators, the actions that are required and the thresholds/limits for selected indicators.
Simon Ashby a Member of the IOR’s Council adds:
“Risk indicators are an invaluable tool, but can be misunderstood. A poorly designed or implemented risk indicator framework can be worse than having nothing at all. Our new KRI guidance sheds further light on current sound practices in the area.”
“The production of guidance on the effective design and use of key risk indicators is an area that has been largely overlooked by regulators, academics and other professional associations. Therefore, it presented a key area where the IOR could add value and fulfil a key element of its mission – to develop the discipline of operational risk.”
“The IOR’s guidance on key risk indicators has been produced by risk management professionals who have practical experience in the selection and use of risk indicators. We are especially delighted that for the first time these professionals have come from a broad international base, including two members of our recent Asia chapter, which is based in Hong Kong. ”
In addition to the practice guidance the paper also includes appendices that provide examples of potential report formats and a number of potential risk indicators. The paper is available, free of charge, from the Institute’s website at www.ior-institute.org
