Operational Risk

Operational risk: key risk
indicators (KRIs)
October 29, 2015

Kseniya Strachnyi
Key risk indicators, operational risk, risk mitigationthese terms pop
up in most content focused on risk management. But, these terms
aren't often used in a way that provides guidance on improving
processes. We all need to understand what role KRIs play in risk
mitigation, but do we all know how to get started turning concepts
into action? This blog by Kate Strachnyi provides a substantive
introduction to a realistic KRI framework that any company can use as
a foundation for a robust and customized risk management strategy.
Key risk indicators defined

Key risk indicators (KRIs) are an important tool within risk
management and are used to enhance the monitoring and mitigation of
risks and facilitate risk reporting. Operational risk is defined as the
risk of loss resulting from inadequate or failed internal processes,
people and systems, or external events. Operational KRIs are
measures that enable risk managers to identify potential losses before
they happen. The metrics act as indicators of changes in the risk
profile of a firm.
Effective KRIs should be:
Measurable - metrics should be quantifiable (e.g., number, count,

percentage, dollar volume, etc.).
Predictable - provide early warning signals.
Comparable - track over a period of time (trends).
Informational - measure the status of the risk and control.
Leading & lagging KRIs

Leading KRIs are measures that are considered predictive in nature.
They are derived from metrics that can help to forecast future
occurrences. Lagging KRIs are metrics based on historical measures.
These help to identify trends in the firm.
Importance of KRIs
KRIs play an important role in risk management by predicting potential
high risk areas and enabling timely action.
KRIs enable firms to:
Identify current risk exposure and emerging risk trends.
Highlight control weaknesses and allow for the strengthening of

poor controls.
Facilitate the risk reporting and escalation process.
Operational risk management adds value to the firm.
Regulatory expectations
To qualify to use the Advanced Measurement Approach (AMA) to
calculate operational risk capital under Basel II, the Basel Committee
on Banking Supervision (BCBS) has specified detailed criteria for the
use of forward-looking measures. The choice of each factor needs to
be justified as a meaningful driver of risk and whenever possible, and
the factors should be translatable into quantitative measures that lend
themselves to verification. The sensitivity of a firms risk estimates to
changes in the factors and the relative weighting of the various factors
need to be well reasoned.
KRI roadmap
Below is a high-level roadmap for establishing a KRI framework:
KRI processes
KRI identification
Identify existing metrics.
Assess gaps and improve metrics.
Identify KRIs via risk control self-assessment (RCSA)interview

business units.
Dont over rely on them; focus on indicators which track changes

in the risk profile or the effectiveness of the control environment.
Concentrate on the significant risks and their causes and

consider forward looking and historical indicators.
Consider absolute values and numbers, ratios, percentages,

ageing, etc.
Data on KRIs should be collated on a systematic and consistent
basis in order to be meaningful, e.g., on a monthly basis.
KRI selection
Select the KRIs that are measurable, meaningful and predictive

(leading indicators).
Gather a good mix of leading and lagging indicators for effective

risk management.
Dont select too many KRIs that:
o Are too difficult to manage (track).
o Might become unmanageable.
o Select only the ones that provide useful information.
Setting thresholds
Determine and validate trigger levels or thresholds.
Based on industry tolerance or internal acceptance.
Board of directors should approve thresholds.
Should coincide with risk appetite statement.
KRI tracking & reporting
Periodic tracking of KRIs (monthly, weekly, depends on what the

KRI represents).
KRIs should be reported regularly and escalation procedures

should be in place (as part of the KRI framework) to ensure
timely reporting to management and board.
Various KRIs will have different levels of escalation. When in

doubt, escalate higher but dont dump too much information on
management/board because they will get overwhelmed.
Reporting of KRIs to head of business units by KRI owners. Head
of business units then reports into risk management. Risk
management reports to risk board and when applicable, the full
board.
This can help improve corporate governance structure.
Risk mitigation plans
Risk mitigation plans (RMPs) should be set for High risk items.
Items with high severity or high frequency of occurrence need to

have RMPs to mitigate risk and enhance controls.
Determine what is high risk by assessing control levels.
Track RMPs to ensure that controls are enhanced and risk is

mitigated. Report on RMPs to management/board, and set target
completion dates.
Roles & responsibilities
Risk management
o Create Framework and provide training
o Guidance and challenge KRI selection process
o Reporting/Escalation of breaches
o Identify Trends
Business units
o Identify KRIs
o Set thresholds
o Monitor positions
o Escalate breaches of limits to management

Internal audit
o Validation and assurance around KRI process
o Incorporate output into audit plan
o Assess control effectiveness for KRIs that were breached

or yellow
Challenges
The potential challenges of establishing an effective KRI framework
include:
Getting business units to buy-in into the need for KRIs
Demonstrating the effect (positive) that it can have on the firm

overall and for each business unit
Might result in setting aside more capital
Identification of KRIs can prove to be difficult
Lack of resources to track KRIs
Key Risk Indicators

The level of risk can be measured continuously through a series of defined and
monitored indicators.
Some of the identified risks can be measured continuously on the basis of defined KRI (Key Risk
Indicators) and defined dashboards, based on the existing data in IT systems. This is a more optimal
approach than an approach based on periodic, eg. an annual assessment of the identified risks
based on expert judgement only.
Continuous risk assessment enables ongoing reaction to the appearing deviations of the risk level
defined as acceptable for the entity and take appropriate action in a short time.

Operational Risk

Uploaded by

Copyright:

Available Formats

Operational Risk

Uploaded by

Document Information

Original Description:

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Operational Risk

Uploaded by

Copyright:

Available Formats

What are key risk indicators (KRIs) and what role do they play in risk management?

What are key risk indicators (KRIs) and what role do they play in risk management?

What are some characteristics of effective KRIs?

What are some characteristics of effective KRIs?

Operational risk: key risk

October 29, 2015

Key risk indicators defined

Effective KRIs should be:

Measurable - metrics should be quantifiable (e.g., number, count,

Predictable - provide early warning signals.

Comparable - track over a period of time (trends).

Informational - measure the status of the risk and control.

Leading & lagging KRIs

Identify current risk exposure and emerging risk trends.

Highlight control weaknesses and allow for the strengthening of

Facilitate the risk reporting and escalation process.

Operational risk management adds value to the firm.

Identify existing metrics.

Assess gaps and improve metrics.

Identify KRIs via risk control self-assessment (RCSA)interview

Dont over rely on them; focus on indicators which track changes

Concentrate on the significant risks and their causes and

Consider absolute values and numbers, ratios, percentages,

Select the KRIs that are measurable, meaningful and predictive

Gather a good mix of leading and lagging indicators for effective

Dont select too many KRIs that:

o Are too difficult to manage (track).

o Might become unmanageable.

o Select only the ones that provide useful information.

Determine and validate trigger levels or thresholds.

Based on industry tolerance or internal acceptance.

Board of directors should approve thresholds.

Should coincide with risk appetite statement.

KRI tracking & reporting

Periodic tracking of KRIs (monthly, weekly, depends on what the

KRIs should be reported regularly and escalation procedures

Various KRIs will have different levels of escalation. When in

This can help improve corporate governance structure.

Risk mitigation plans

Items with high severity or high frequency of occurrence need to

Determine what is high risk by assessing control levels.

Track RMPs to ensure that controls are enhanced and risk is

Roles & responsibilities

o Create Framework and provide training

o Guidance and challenge KRI selection process

o Escalate breaches of limits to management

o Validation and assurance around KRI process

o Incorporate output into audit plan

o Assess control effectiveness for KRIs that were breached

Getting business units to buy-in into the need for KRIs

Demonstrating the effect (positive) that it can have on the firm

Might result in setting aside more capital

Identification of KRIs can prove to be difficult

Lack of resources to track KRIs

Key Risk Indicators

You might also like