Whether you love or hate them, it is hard to dispute thepopularity of fortune cookies. With more than 3 billion fortunecookies consumed annually around the world, it is clear many peopleenjoy the mystique of fortune cookies in their reputed ability topredict the future. And everyone wants to know what the future willbring.

This is especially true in the world of risk management, whereprofessionals are dedicated to identifying current and futuresources of risk or loss, and eliminating or mitigating suchpotential loss through the application of controls. Incookie-speak: “Your life will prosper only if you see andacknowledge your faults, and work to reduce them….”

In this process, key risk indicators (KRIs) are metrics orpieces of data serving as early warning signs of areas ofincreasing risk. In contrast to key performance indicators (KPIs),which are statistics or data points showing what has happenedin the past or current time, KRIs portend future trends, losses andopportunities. When designed carefully, organized well, andcommunicated timely, KRIs are more credible and predictable than amere theoretical fortune. They are used by risk managers toproactively monitor operational processes, and identify potentialbusiness, legal, financial or other environmental risks that mayaffect the company, long before they can occur.

The Benefits and Importance of KRIs

“There is a prospect of a thrilling time ahead foryou.”

Developing effective KRIs is crucial to the success of any riskmanagement program. First, as they assist in predicting potentialrisk events, they are most useful, as noted above, in identifyingkey areas where additional controls or mitigation might be needed.For example, the risk of “financial loss due to breach ofunderwriting authorities” may be partially predicted by a KRI of“number of times in a month a scheduled peer review was notconducted,” or “failure to seek management approval to underwrite aclass of business outside of an assigned underwriting authority.”These types of violations may call for renewed focus on the peerreview process, and shoring up of management review protocols.

Second, KRIs are often associated with legal and regulatoryrequirements, so that monitoring and evaluating KRIs can facilitatecorporate compliance efforts. For instance, insurers are frequentlyexamined by regulators as to their market conduct practices, toensure policy issuance and claims procedures are compliant withstate law. Failure to adhere to laws can result in significantfines, fees or penalties. To this end, companies may track KRIssuch as “number of customer complaints received from all sourceseach month, trailing over a 3-month average, above an expectedaverage.” An increase in customer complaints over time may indicatea larger market conduct issue.

Third, they can also support strategic decision making andbusiness development. Here, insurers may track KRIs such as“win/loss ratios” over time for the acquisition of new business, orthe company's policy renewal rate and trends through specific timeperiods, for particular product lines. Under a more developedenterprise risk management (ERM) program, KRIs can also be mappedand compared against a company's agreed or established risktolerances, to give managers a sense of when risk associated with anew strategy, plan or action is “too much” for the company toaccept as a reasonable business activity.

In addition, KRIs are an important part of an overall “feedbackloop” of information about risk that can be circulated through alllevels of a company. Individual and overall corporate behavior andresults can be improved significantly when all interestedstakeholders are consistently provided detailed information andfeedback about:

• The company's risks, and how the risk profile changes indifferent circumstances;
• How controls well are operating (or not);
• What losses the company has suffered (or has nearly missed);and
• How specific conduct or decisions ultimately play out theircourse.

Such a feedback loop can be a powerful tool for growth andchange. In the process of giving and receiving continual feedback,KRIs can be tracked, acted upon in some fashion, and the results ofthose actions can be analyzed and re-tested over time.

Designing and Using KRIs

“Good luck is the result of good planning.”

While the benefits of KRIs are numerous, designing effectiveKRIs is challenging for all companies. There is no“one-size-fits-all” approach applicable to all entities. Theindicators chosen by an insurer to track and monitor depends on theevaluation and mapping of a number of complex factors, including,for example:

• The current and future business and strategic goals of thecompany;
• The tolerance levels of senior management for risk of financialand non-financial losses;
• How risks are prioritized by the company, particularly in itsoverall enterprise risk management program;
• What operational flows processes are being run; and
• The historical and current data available for extraction fromthe insurer's systems, as a practical matter.

A major first step in this process is surveying keystakeholders, such as the designated internal risk owners, internaland external subject matter experts, customers, and employees.Legal and compliance staff can be particularly helpful, providingadvice related to current and proposed laws and regulations, aswell as internal policy and procedure priorities. Vendors close tothe company or line of business may be able to provide usefulinformation about what trends they are seeing and/or tracking, andmay be able to suggest data links. Competitors may also be a sourceof information, potentially offering glimpses of trends and risksthey are monitoring through published sources, including websites;public company documents filed with the SEC, such as annualstatements and 10Qs; dialogues taking place on social mediaplatforms like LinkedIn; and press releases or news articles.

Historical loss data can also be mined to suggest areas forKRIs. Although historical key performance indicators are not thesame as KRIs, as noted above, KPIs can often be re-examined andturned around to formulate KRIs for looking at future developments,under the theory that “the best prophet of the futureis the past.” Past losses and trends may be analyzed fordirect and indirect “root causes,” which can then be trackedproactively going forward as KRIs. To this end, trade publicationand loss directories are valuable resources for loss history andcause analysis.

Trade organizations dedicated to risk management also providesome help. In the U.S., for example, the Risk Management Association (RMA)helps financial services companies improve risk management effortsthrough its KRI LibraryServices, a database of potential KRIs collected to helpcompanies “achieve a degree of consistency and standardization” and“enable KRI to be compared, analyzed, and reported at the corporatelevel,” as well as foster benchmarking of KRIs with peer groups.The RMA also has conducted surveys focused on the use of popularkey risk indicators, including a recent survey issued in September 2011.

From a review of all available information, KRIs can be selectedor designed which are most clearly linked to corporate keystrategies and business objectives, or which may help validate orinvalidate management decisions and actions. There are severalother factors to consider when selecting appropriate KRIs tomonitor, and trade-offs may need to be made between potentialcriteria. Important factors include whether the KRI:

• Is commonly used in the industry, based on establishedpractices or benchmarks;
• Can be used, developed or tracked consistently across theorganization;
• Is based on high-quality data and reliable sources;
• Is measurable, allowing for quantitative comparisons andbusiness units;
• Can be tracked across time, providing opportunities fortrending analysis;
• Illustrates the performance of specific risk owners;
• Shows inter-relationships and correlations amongst causes;and
• Is not too costly or time consuming to collect, in acost/benefit analysis.

Ultimately, the KRI must be easily applied and understood by theend users, often meaning that it must be balanced in scope – nottoo complicated or simplistic.

“Simplicity and clarity should be the theme in yourdress.”

While implementing processes to track and communicate selectedKRIs, it may helpful to provide definitions and guidelines oninterpreting certain KRIs. Plain data may not tell the whole story,and their significance may not always be obvious to all those whoreview the statistics. Also, the KRI may require notes or caveats,and any assumptions made in the collection or analysis of a pieceof data should be communicated.

Finally, KRIs should be flexible, and reviewed frequently inorder to respond to changes in the business market and operationalenvironments. This includes changes to address positive, not justnegative or potentially dangerous trends.

“The road to success is always under construction.”

KRI Reporting and Automation Considerations

“It's all right to have butterflies in your stomach, justget them to fly in formation.”

Communication of KRI information depends on the audience need.Departmental managers typically need a high degree of visibilityinto their business, and must be able to drill down or roll upinformation on key risk indicators. Risk owners will want a moredetailed view of KRIs, often reviewing associated risks andcontrols that may be impacting trends. The board/senior management:overview, on the other hand, may desire a holistic dashboard viewto compare KRIs across business segments. Consider developingmultiple reports for various viewers.

“Out of confusion come new patterns.”

Organizing, monitoring, reviewing and communicating KRI progresscan be greatly facilitated by having a centralized, automatedsystem for the company's ERM program, with flexible reportingfunctionality. Through a dedicated system for tracking risk and/orERM program information, companies may benefit from the creation ofconsistent KRI standards, easily capturing attributes that arerequired to support risk management processes over time.

These KRI “libraries” can be linked to multiple risks andcontrols, across multiple departments. System-based linkage of KRIsand ERM reporting with such related information as policiesand procedures, losses, incidents, source legal andregulatory content, compliance control actions taken,auditing , etc. all help risk owners and senior management developa clearer vision of the future.

Automating as much of the ERM process as possible also helpsensure that key historical and financial data is secure andreliable, and that formulas used for trending and analysis areconsistent and accurate – particularly important because one smallerror in a spreadsheet calculation can magnify and throw of trendsin metrics, leading to wrong conclusions or poor decisions.

Predicting the future is not easy, but key risk indicators, whencarefully designed to reflect a company's unique profile of risksmay reveal patterns and trends in workflows, processes, or thebusiness or market environment that can impact the future.

“The wise man expects to prepare for theunexpected.”

Spend time now to develop, trend and communicate strong riskmetrics, through organization and automation, to help steerstrategy and behavior.

“Control your destiny or it will control you.”