The purpose of aKey Control Indicator (KCI)is to measurecontrol effectiveness. Therefore, the most important design criterion is that itdemonstrates whether the control objective is being achieved.
ISACA defines:
“KCIs are metrics that measure the effectiveness of controls in achieving their intended objectives.”
Quantitative methods are desirable but secondary.
Hence,Bis correct.
CRISC Reference:Domain 4 – Risk and Control Monitoring and Reporting, Topic: Control Performance Metrics.
Contribute your Thoughts:
Chosen Answer:
This is a voting comment (?). You can switch to a simple comment. It is better to Upvote an existing comment if you don't have anything to add.
Submit