How to Run a Risk Voting Workshop
Risk voting is an easy and powerful way to increase executive engagement in your ERM program and generate more value
Why you should add Key Risk Indicators to your ERM program
Using KRIs and KPIs in ERM for improved decision making and strategy execution
Key Risk Indicators (KRIs) and Key Performance Indicators (KPIs) have long been viewed as an essential component of operational risk management. Many risk managers are now looking to incorporate these valuable tools into enterprise risk management (ERM) programs as well.
Their goal is to transform their ERM programs from static repositories into dynamic systems that continually monitor risk and performance, and provide up-to-date information that can be used for better decision making and strategy execution.
Unfortunately, however, some ERM managers miss out on the value that indicators can provide because they mistakenly believe that KRIs and KPIs are either too complicated or require detailed mathematical models in order to be effective. We have found through experience that this is not the case, and nearly all ERM programs can benefit from using indicators in the easy and practical manner described in the following sections. Furthermore, this is an area where software tools can help considerably, by providing automation, along with built-in guidance and analysis expertise.
This is the first in a series of three articles that provide an overview of KRIs and KPIs and shares best practice experience on how to incorporate indicators into ERM programs. Together, they will cover the benefits of using indicators, common implementation pitfalls, contrasts with operational risk indicators, and 6 practical steps to quickly and easily add KRIs and KPIs to your ERM program today.
This article provides an overview of indicators, including examples and benefits of using indicators in ERM. The second article discusses different types of indicators and the third article provides a practical 6-step process to add indicators to your ERM program today.
All three articles use example screenshots from our Essential ERM software system, but note that everything described in them can be performed manually without software (albeit with much more effort!).
In the context of ERM, key risk indicators (KRIs) are activities or outcomes that signal to a risk manager that a particular risk event is becoming more or less likely. They may also indicate that a risk event has already occurred and provide a sense of its impact or severity.
KRIs are usually numerical (although they can be qualitative too) and are tracked against upper and/or lower tolerance bands. Tolerance bands usually represent the expected range of the metric, or the values of the metric that can be “tolerated” by the organization without a material change in risk levels or a serious threat to objectives. When the value of the indicator exceeds a tolerance band, it is viewed as abnormal behavior and as a strong signal that the risk events associated with the indicator are becoming much more likely.
Indicator Explorer screen from the Essential ERM system showing KRIs and KPIs including their trend and status relative to tolerance levels
The key for ERM managers then, is to find the key metrics and events (i.e. the “RHR indicators”) in their business that are closely tied to their top enterprise risk events and related objectives. By doing so, ERM managers will create an early warning system that lets them know when the corporate risk profile is changing. This is especially valuable in the context of ERM, where strategic objectives and risks may be set and reviewed on an infrequent basis. This infrequency leaves ERM programs vulnerable to new Interval Risks (risks that arise between assessment windows) and high velocity risks (risks whose likelihood and impact can change rapidly).
Furthermore, ERM is closely linked to strategic planning and decision making. All strategic decisions are based on assumptions, which are essentially predictions about uncertain variables, relationships and outcomes. The process of creating and measuring indicators (as will be described in the sections below) leads leadership teams to better identify and consider their strategic assumptions more carefully.
Indicators can then be used to subsequently monitor those assumptions and the factors that affect them. Changes to the assumptions that underpin a strategic plan can and should be an important trigger for leadership teams to revisit their objectives and immediately address emerging risks - rather than simply waiting for the next annual or quarterly risk review. Measuring and collecting indicator data will also generate valuable information to measure prediction accuracy and to develop baselines that will be helpful in future planning and decision making. (In future articles, we will discuss methods to use indicator data and predictive analytics to uncover new insights and correlations between metrics, risks and performance.)
Finally, note that risk managers do always need to understand how or why indicators are correlated with changing risk profiles for indicators to be effective. Athletes don’t need to know why rising resting heart rates warn of burnout in order to use this indicator to reduce risk. Similarly, indicators do not have to be causally related to be useful. It is highly unlikely that rising heart rates are the cause of burnout (they are both correlated to the same underlying cause), just as infectious outbreaks in one county may not directly lead to resource shortages in other health systems, but can still be a useful early warning to help neighbouring hospital administrators.