KPIs, KRIs & KCIs – Are they different? If so, does it really matter?
Google the terms ‘Key Performance Indicators’, ‘Key Risk Indicators’ and ‘Key Control Indicators’ and you will accumulate 13,900,000, 7,180,000 and 9,400,000 hits respectively.
Evidently there is a lot of information out there on these topics, but the two specific questions that we are often asked are – KPIs, KRIs, KCIs – are they different? And if so, does it really matter?
In our view, the answer to both these questions is YES.
These three types of indicators are used within the Risk-Based Performance Management methodology, they are related and in cases interchangeable however lets start by defining each of these different indicators.
Key Performance Indicator
An indicator which enables an organisation to define its performance targets based on its goals and objectives and to monitor its progress towards achieving these targets. KPIs are used to answer the question: Are we achieving our desired levels of performance? KPIs can be financial and non-financial in nature, and leading or lagging. They can be quantitative or qualitative in nature.
Key Risk Indicator
An indicator which is used by organisations to help define its risk profile and monitor changes in that profile. KRIs are used to answer the question: How is our risk profile changing and is it within our desired tolerance levels? Like KPIs, KRIs can be financial and non-financial in nature, and leading or lagging. They can be quantitative or qualitative in nature. Where KPIs tell us if we are achieving our targets, KRIs help us to understand the changes in our risk profile and the impact and likelihood of achieving our overall objective.
Key Control Indicator
An indicator which is used by organisations to help define its controls environment and monitor levels of control relative to desired tolerances. KCIs are used to answer the question: Are our organisation’s internal controls effective? Are we ‘in control’?
Having defined each of these different types of indicators, let us return to the original questions: Are they different?
From the definitions above it is clear that these three types of indicators each have a different emphasis and provide different management indicators to different audiences. However, do not assume that three times the volume of data is required; often it is not. This is fundamentally because these three different types of indicators are interlinked (but not the same!) and often data can be reused for different types of indicators. It would not be unusual to see data for a lagging KCI being reused for a leading KRI, for example.
Does it matter? Yes, it does. Firstly, we return to the point about developing greater clarity around the management information that is generated via these indicators. By being very clear about the type of question you are trying to answer and the type of indicators you are defining, you can significantly improve the quality and clarity of the resulting management information.
Within the Risk-Based Performance Management methodology, we suggests using three different types of scorecards – a performance scorecard, a risk scorecard and a controls scorecard – with the corresponding types of indicators.
In our experience, as clients work with this methodology, the quality of the resulting scorecard (and supporting management information) increases as the number of indicators reduces to the ‘vital few’, and the quality of each set of indicators is high. This illustrates that, because of data reuse, data volumes do not multiply three.
Additionally, being specific about the different types of indicators used allows for a wide range of audiences to be satisfied with the insights delivered from the Risk-Based Performance Management approach.
As a simple example, Management will be interested in all three types of information, whereas the Risk team, Internal Audit and the Regulator will be focused primarily on the risk and controls data.
We would strongly recommend that if you are implementing an approach which includes KPIs, KRIs and KCIs it is important to have a clear definition of each type and develop understanding of these differences within your organisation.
We have seen cases where everything is called a ‘KPI’ which leads to a lot of confusion about what the indicator means and what actions it triggers. We have also seen examples where KRIs and KCIs are used but they mean different things in different parts of the organisation, both different departments and different geographical locations. This leads to no end of confusion and time wasted.
Closing tip: Think about the questions you are trying to answer and your various audiences to determine the types of indicators you should deploy. Think about the relationships between indicators to enable data to be reused and to promote informed discussions and decision-making. Be very clear about the definitions for each of the different types of indicators and apply those definitions consistently across the organisation.