Key Risk Indicators (KRIs) are useful tools for business lines managers, senior management and Boards to help monitor the level of risk taking in an activity or an organisation. To business lines managers, they may help to signal a change in the level of risk exposure associated with specific processes and activities. To senior management, they reflect the level of risk exposure, use or stretch of resources and the effectiveness of key controls. To the Board, they can indicate whether the firm operates within the set risk appetite. Finally, for modellers, key risk indicators are a natural way of including the fourth element of AMA (Advanced Measurement Approach), the BEICF (Business Environment and Internal Control Factors), into operational risk capital.
What follows is the IOR’s perspective on current sound practices in relation to the use of risk indicators to support the management of operational risk. The document is an update of the original Sound Practice Guidance document on Key Risk Indicators that was published in 2010.
This updated guidance is structured as follows: Section 2 provides definitions of different indicators; Section 3 reviews their role and purpose. Section 4 explains the desirable features of KRIs; Section 5 proposes a categorisation of KRIs that appeared recently in the literature. Section 6 details the process of designing KRIs, in terms of frequency of capture, thresholds and governance aspects. Section 7 gives some practical guidance on how to set up and manage a KRI programme, while section 8 details the possible reporting structures on KRIs. Finally, Section 9 briefly reviews the necessary validation of indicators ex post and Section 10 concludes. Section 11 contains a bibliography of useful references for further reading.
