Key control indicators (KCIs) are metrics that measure how well a specific control is performing in reducing the causes, consequences, or likelihood of a risk1. Key risk indicators (KRIs) are metrics that measure changes in the risk exposure or the potential impact of a risk2. By linkingan effective KCI to relevant KRIs, the organization can monitor changes in the risk environment and assess how the control is influencing the risk level3. This can help the organization to:
Identify emerging or escalating risks and take timely and appropriate actions
Evaluate the effectiveness and efficiency of the control and make improvements if needed
Align the control with the risk appetite and tolerance of the organization
Communicate the risk and control status to stakeholders and regulators
References = Risk and Information Systems Control Study Manual, Chapter 6: Risk Response and Mitigation4
Contribute your Thoughts:
Chosen Answer:
This is a voting comment (?). You can switch to a simple comment. It is better to Upvote an existing comment if you don't have anything to add.
Submit