KPIs and KRIs look alike — both are numbers with thresholds. The difference is the direction of view. A KPI looks back and tells you how you performed. A KRI looks forward and warns what is likely to happen if nothing changes.
The difference on an example
Take IT. A KPI: service availability last month was 99.2 per cent. That is a fact, already happened, nothing to influence. A KRI: the share of servers without a software update for more than ninety days has risen to 18 per cent. No incident yet, but the probability has grown and there is still time to act.
The same logic in procurement. KPI: three deliveries missed this quarter. KRI: 40 per cent of critical items have a single source — the risk covered in losing a supplier.
What makes a KRI work
- It leads. It moves before the event, not with it. Incidents per month is a KPI whatever you call it.
- It has a threshold and an addressee. A value at which somebody is obliged to act. Without that it is just a figure in a report.
- It is tied to a named risk with an owner — see the risk management system.
- It is collected automatically. An indicator gathered by hand once a quarter cannot warn in time.
- There are few of them. Five to seven at company level, not fifty.
How thresholds are set
A threshold is not an average and not a wish. It follows from the boundary the company has set for itself, which is risk appetite. If annual losses from outages are capped and a day of downtime has a known cost, the maximum number of days follows — and with it the threshold values of the indicators that lead there.
A practical device is two levels. Amber means investigate and report, red means act now and escalate. Who receives which signal is defined by the three lines of defence.
FAQ
Can one measure be both a KPI and a KRI? Sometimes, but it has to be read differently. It is more useful to hold a pair: the result for the period and a leading sign that the result is about to deteriorate.
How many KRIs does a company need? Five to seven at board level and two or three per key function. More than that and nobody looks at them.
Where does the data come from? From systems already in use — accounting, service desk, HR. An indicator that needs manual collection usually dies within a quarter.