Key risk indicators (KRIs) are metrics that provide information on the level of exposure to a given operational risk1. KRIs have upper and lower acceptable risk limits (warning thresholds) that trigger actions when exceeded2. These thresholds are based on the organization’s risk appetite or tolerance, which is the amount and type of risk that the organization is willing to accept in pursuit of its objectives3. Therefore, changes in risk appetite or tolerance would prompt changes in KRI thresholds, as the organization would need to adjust its risk monitoring and response accordingly. The other options are not the primary factors that would prompt changes in KRI thresholds, although they may have some influence on the risk management process. References = Risk IT Framework; IT Risk Resources; ISACA Risk Starter Kit; Key Risk Indicators; Key Risk Indicators: A Practical Guide