Key Risk Indicators (KRIs) are emerging as an important element of performance management. This reflects the times, since corporations tend to pay closer attention to understanding and mitigating risk during a crisis or a tough business environment. I’ve written a great deal about how the downturn in the developed countries and prevailing high level of volatility in the world economy has focused executives’ attention on improving planning. (For example, see Integrated Business Planning – More Important Than Ever; Why Companies Flunk Planning ; Integrating Business to Business Planning – A New Finance Imperative.)  They have discovered the traditional annual budget process and monthly or quarterly review and re-forecast is too inflexible to be a useful management tool. Volatility itself poses a broad set of risks to companies that do not anticipate it, have not formulated useful and coordinated contingency responses in advance and therefore cannot react quickly enough to change. Along with volatility, companies are discovering they must anticipate other risks, identifying the most important, determining how to measure these and monitoring their business to provide timely alerts that a problem is emerging. They also need to determine how best to mitigate these important risks as well as consider ahead of time the right approach to resolving an adverse situation.

In a challenging business environment, KRIs are becoming increasingly important because they are an important complement to Key Performance Indicators (KPIs). KPIs are related to the most important business objectives. They indicate the degree to which individuals, business units or companies are achieving them. KRIs are specific events or root causes that prevent achievement of performance goals. A competitor’s new product introduction, a strike at a supplier’s plant, new regulations, price changes, weather and so on are external risks, while poor execution elsewhere in the company is an internal risk.

Making KRIs explicit is important for three reasons. First, one of the biggest systemic risks midsize and larger companies face is the lack of communication about the risks individuals or individual business face. The process of making them explicit enables companies to assess their potential importance and clearly lays out the factors that drive the risk. Second, by surfacing the key risks, understanding their consequences and prioritizing them organizations can (ideally) have predictive analytics in place to trigger alerts to eliminate or minimize their impact. Or, at the very least, they can plan the best ways to react to these possibilities. Third, companies seek to balance objectives because business inherently is about trade-offs, such as market share versus profits or minimizing time spend per caller versus achieving a minimum level of customer satisfaction. Risk is another factor involved in business decisions that should be explicit because minimizing costs such as staff hours in retail carries a risk.

Developing and implementing KRIs requires the complete gamut of people, process, information and technology efforts and are built on business metrics that are the information currency that matters as pointed out by my colleague. Risk identification, mediation and attenuation are inherently collaborative, especially for cross-functional risks that are especially common in manufacturing and distribution businesses. The process of identifying, assessing and monitoring risks must be explicit and consistent to be effective. Moreover, the information and technology must be in place to support a risk management effort. The data needed for these efforts typically will come from a wide range of disparate enterprise systems and even other sources. Having the ability to bring together these strands is especially challenging in larger firms but one where solutions already exist.

Let me know your thoughts or come and collaborate with me on Facebook, LinkedIn and Twitter.

Regards,

Robert D. Kugel CFA - SVP Research