CORES Key Risk Indicator Development 2 — Questions and Answers
Question 1: When calibrating a KRI threshold, what does the 'amber' zone typically signify?
- Risk is within appetite and no action needed
- Risk is approaching the limit and management attention is warranted (Correct answer)
- Risk has breached tolerance and escalation is mandatory
- The KRI is being retired from active monitoring
Correct answer: Risk is approaching the limit and management attention is warranted
The amber zone is an early-warning band indicating the metric is trending toward the red limit, prompting proactive management review.
Question 2: Which data quality attribute is MOST critical when a KRI feeds directly into an executive risk dashboard?
- Granularity
- Timeliness (Correct answer)
- Historical depth
- Decimal precision
Correct answer: Timeliness
Timeliness ensures decision-makers are acting on current conditions rather than stale information that may misrepresent the current risk state.
Question 3: A KRI for IT system availability shows 99.95% uptime but incidents are increasing. This illustrates which KRI design flaw?
- Threshold set too high
- Metric averages out localized spikes (Correct answer)
- Insufficient data sources
- Incorrect ownership assignment
Correct answer: Metric averages out localized spikes
Averaging across long periods or broad system groups can mask concentrated failures, making the KRI misleading despite appearing within tolerance.
Question 4: In the CORES framework, which stakeholder is primarily responsible for validating that a proposed KRI is operationally feasible to collect?
- Chief Risk Officer
- Internal Audit
- Business Line Owner / Data Provider (Correct answer)
- Board Risk Committee
Correct answer: Business Line Owner / Data Provider
The business line owner who generates or stores the underlying data must confirm the metric can be consistently extracted and reported.
Question 5: What is the key difference between a KRI and a Key Performance Indicator (KPI)?
- KRIs measure past events while KPIs measure future events
- KRIs signal potential adverse outcomes while KPIs measure operational efficiency or success (Correct answer)
- KPIs are always financial while KRIs are always operational
- KRIs require board approval while KPIs do not
Correct answer: KRIs signal potential adverse outcomes while KPIs measure operational efficiency or success
KRIs are forward-looking signals of risk exposure or vulnerability, whereas KPIs assess how well an organization is achieving its objectives.
Question 6: A bank wants to track credit risk contagion across its loan portfolio. Which KRI design approach is MOST appropriate?
- Single KRI tracking average loan-to-value ratio
- Composite KRI combining concentration, delinquency rate, and sector correlation (Correct answer)
- KRI limited to non-performing loan count only
- KRI based solely on regulatory capital ratio
Correct answer: Composite KRI combining concentration, delinquency rate, and sector correlation
Contagion risk is multi-dimensional, requiring a composite KRI that captures concentration, early delinquency signals, and inter-sector correlation simultaneously.
Question 7: When conducting a KRI effectiveness review, which outcome BEST justifies retiring a KRI?
- The KRI has never triggered an amber alert
- The metric consistently lags behind actual loss events by more than two reporting cycles (Correct answer)
- The KRI owner has changed three times in one year
- The threshold has not been updated in 18 months
Correct answer: The metric consistently lags behind actual loss events by more than two reporting cycles
A KRI that only confirms losses after they occur provides no predictive value and should be replaced with a more leading indicator.
CORES Key Risk Indicator Development 2
When calibrating a KRI threshold, what does the 'amber' zone typically signify?