Key risk indicator (KRI)

Roles that need it

• Operational Risk Analyst
• Compliance Officer
• Risk Advisory Consultant
• Cybersecurity GRC Consultant
• Liquidity Risk Analyst

Skills it belongs to

• Defining and using KPIs
• Internal controls and risk oversight
• Risk judgment and escalation instinct

Related concepts

• RCSA (risk and control self-assessment)A risk and control self-assessment is the periodic exercise in which a business unit identifies its operational risks, rates inherent risk, assesses how well its controls work and derives the residual risk. Results are challenged by the second line and lead to actions where residual risk exceeds appetite.
• Operational loss eventAn operational loss event is an incident from a process, people, system or external failure that causes a financial loss, a near miss or a gain. Banks record each event with dates, amounts, recoveries and an event type in a loss database used for analysis and capital.
• Risk appetite (risk appetite framework)Risk appetite is the level and types of risk a firm is willing to take to meet its strategy, approved by the board. The risk appetite framework turns it into a statement, limits and indicators that are monitored and escalated when breached.
• Operational riskOperational risk is the risk of loss from inadequate or failed internal processes, people and systems, or from external events. It includes legal risk and excludes strategic and reputational risk. Examples are fraud, processing errors, cyber incidents and outages.

Sources

• Revisions to the principles for the sound management of operational risk, BIS (external site) accessed 31 Oct 2026

Updated 31 Oct 2026.