Appearance
KRI Register
Where to find it: Risk Management, then KRI Register (/kris).
A Key Risk Indicator is a measure whose movement tells you a risk is changing before the risk materialises.
KRI versus control indicator
These are often confused. They measure different things for different audiences.
| KRI | Control Indicator | |
|---|---|---|
| Attached to | A risk | A control |
| Measures | Risk exposure or its drivers | Control operation |
| Question | "Is this risk getting worse?" | "Is this control working?" |
| Thresholds | Green, amber, red bands | Pass or fail against a rule |
| Audience | Risk committee, board | Control owner, compliance |
| Reference | KRI definition | IND-YYYY-NNNN |
Both can measure the same underlying number. "Privileged accounts without MFA" is a control indicator when it asks whether the MFA control operates, and a KRI when it asks whether unauthorised-access exposure is rising.
What a KRI definition carries
| Field | Purpose |
|---|---|
| Name and description | What is measured, and why it matters |
| Linked risk | The risk it indicates |
| Measurement unit | Count, percentage, currency, duration |
| Thresholds | The amber and red breach points |
| Direction | Whether higher or lower is worse |
| Frequency | How often it is measured |
| Owner | Who is accountable for measuring it |
| Status | Active or retired |
Measurements and breaches
A measurement records the value at a point in time. A breach occurs when a measurement crosses a threshold.
| Band | Meaning |
|---|---|
| Green | Within tolerance |
| Amber | Approaching the limit; attention warranted |
| Red | Beyond the limit; action required |
Breaches surface as risk signals on the linked risk, with the measured value, the threshold crossed and the timestamp.
A KRI breach does not change a risk rating
A breached KRI raises a signal recommending review. It does not rerate the risk, change its status or alter its treatment.
Whether a breach means the residual rating should move is a judgement about context — and the platform does not have the context.
Recording measurements
Measurements can be recorded manually or imported. Requires kri.measure.
Where the underlying number is already produced by a continuous indicator, record the KRI measurement from that result rather than measuring it twice — two sources for one number is two numbers that will eventually disagree.
Choosing good KRIs
Leading beats lagging. "Number of incidents last month" tells you what already happened. "Number of overdue critical patches" tells you what is about to.
Measurable without a project. A KRI requiring a manual data-gathering exercise each month will be measured for two quarters and then quietly stop.
Thresholds you would actually act on. If a red breach would not trigger a decision, the threshold is decoration.
Few. A risk with eleven KRIs has none — nobody reads eleven numbers about one risk.
Permissions
| Action | Permission |
|---|---|
| View definitions, measurements and breaches | kri.read |
| Create, edit and retire definitions and thresholds | kri.manage |
| Record or import measurement values | kri.measure |
All require the risk_management entitlement.
Example
Risk RSK-2026-0014 — Unauthorised privileged access.
| KRI | Unit | Amber | Red | Frequency |
|---|---|---|---|---|
| Privileged accounts without MFA | Count | 1 | 5 | Daily |
| Privileged accounts inactive over 90 days | Count | 10 | 25 | Weekly |
| Days since last privileged access recertification | Days | 100 | 120 | Weekly |
| Emergency access grants in period | Count | 3 | 8 | Monthly |
March measurements:
| KRI | Value | Band |
|---|---|---|
| Accounts without MFA | 3 | Amber |
| Inactive accounts | 7 | Green |
| Days since recertification | 118 | Amber |
| Emergency grants | 1 | Green |
Two amber breaches, and read together they tell a story the individual numbers do not: the recertification that would have caught the three MFA gaps is itself overdue.
The Risk Manager reviews the signals, leaves the residual rating at Medium given the accounts are on a decommissioning path, and raises a finding on the overdue recertification — which is the more consequential of the two breaches.
Troubleshooting
"A KRI shows no measurements." None have been recorded. KRIs do not measure themselves; the measurement is recorded manually or imported.
"A breach does not appear as a risk signal." Check the KRI is linked to the risk and that the definition is active.
"Thresholds seem to breach constantly." Either the threshold is set at a level the organisation routinely operates beyond, or the risk genuinely sits outside appetite. Both are worth resolving; neither is fixed by widening the threshold without a decision.
"KRI Register is not visible." Requires the risk_management entitlement and kri.read.