Indicators

Key indicators provide risk managers an objective method of monitoring risk and performance against defined goals.

There are two types of key indicators:

• Risk Indicators - typically associated with risks, risk event categories or controls. For example, management may establish a key risk indicator (KRI) such as "Transactions Approaching Limit" around the risk of fraud with respect to the accounts payable process. Management would typically establish a threshold (5 transactions at just below the authorization limit of $5,000), and determine that a certain amount of risk exists if more then 5 transactions approach the authority limit (suggesting that someone is consistently executing fictitious transactions just below the authorization threshold).
• Performance Indicators - typically associated with objectives or processes and in some instances controls. For example, in a sales function, a key performance indicator would likely be a certain sales target. If the sales target is met or exceeded, then it is likely that sales objectives are being met.

Indicators are housed in a library which allows management to create a common framework that may be leveraged across organizations and processes. A standard configuration is shipped with the system for capturing the attributes of indicators (indicator definitions, contextual information, standard measurement points and searches). However, the administrator may define the system fields and configure the forms and associated fields to track specific attributes as necessary for the organization and industry.

Once the system has been configured, indicators are imported or created. Each indicator is defined through attributes (purpose), guidance (how often data should be gathered and reported on) and specifications (how to gather the data). Default contextual information, such as thresholds and measurement periods, are also established for each indicator. Finally, each indicator can be associated with one or more sets of industry-wide characteristics (i.e. standard measurement points). For example, in the financial services industry, a key risk indicator may be associated with a particular business line (e.g. Retail Banking) and Risk Category (e.g. External Theft and Fraud).

Indicators are then linked to specific measurement points (RCM, organization, process, risk event category, objectives, risks, controls or financial element) within the Governance Portal. On a periodic basis, business users provide measurements for the indicator. Based on the measurement and defined thresholds, email notifications are sent to management to track risks and performance of key objectives. High level reporting is available.

Note: Administrators can configure notifications to be sent based on a specific date or event (i.e. creating, updating, closing, deleting) in an indicator. See Notification Management for details.