Key Risk Indicators

A key risk indicator is a number with a job: it is tied to one named risk, has a unit and a cadence, and its thresholds trace back to the organisation's appetite for that risk. A KPI tells you how the business is performing; a KRI tells you how close a risk is to materialising. Most programmes have plenty of the first and almost none of the second.

Two failures make KRI programmes quietly useless. The first is direction: an indicator like patch-SLA compliance or MFA coverage is worse when it falls, and an engine that only understands 'higher is worse' will show it green however far it drops. The second is silence: an indicator nobody has read for a quarter is not green, it is unknown — and a dashboard that renders the two the same makes the emptiest register look the healthiest.

GRCLens builds the engine around those two rules, and adds a third that turns indicators into findings: inside a maturity assessment, an indicator names the requirements it measures. When it sits outside appetite while every linked requirement was answered as met, that contradiction is surfaced — the finding a self-assessed score can never produce.