CORES Key Risk Indicator Development 4 — Questions and Answers
Question 1: When developing KRIs for a new business line, what should be the FIRST step in the process?
- Source available data fields from existing systems
- Map risks to the business line's objectives and risk taxonomy (Correct answer)
- Benchmark against competitor KRI libraries
- Set thresholds based on industry loss databases
Correct answer: Map risks to the business line's objectives and risk taxonomy
Effective KRIs must be grounded in the specific risks that could derail the business line's objectives, making risk-to-objective mapping the essential first step.
Question 2: A KRI for model risk measures 'number of models without current validation.' Which risk category does this indicator address?
- Market risk
- Operational risk — model governance (Correct answer)
- Credit risk
- Liquidity risk
Correct answer: Operational risk — model governance
Unvalidated models represent an operational risk under model governance, as their outputs may be unreliable and drive flawed business or risk decisions.
Question 3: What distinguishes a 'diagnostic KRI' from a 'directional KRI'?
- Diagnostic KRIs are reviewed annually while directional KRIs are reviewed monthly
- Directional KRIs show trend movement while diagnostic KRIs pinpoint the root cause of an alert (Correct answer)
- Diagnostic KRIs require board approval while directional KRIs do not
- Directional KRIs use external data while diagnostic KRIs use internal data
Correct answer: Directional KRIs show trend movement while diagnostic KRIs pinpoint the root cause of an alert
Directional KRIs signal whether a risk is improving or worsening, while diagnostic KRIs drill into specific sub-drivers to explain why the alert occurred.
Question 4: Which of the following BEST describes the concept of 'KRI cascading' in a large organization?
- Publishing KRI reports to all employees simultaneously
- Decomposing enterprise-level KRIs into linked business-unit-level indicators (Correct answer)
- Automatically escalating every amber alert to the board
- Importing KRI benchmarks from industry consortia
Correct answer: Decomposing enterprise-level KRIs into linked business-unit-level indicators
KRI cascading breaks high-level enterprise indicators into business-unit sub-indicators so that each layer of management has metrics relevant to their scope of control.
Question 5: A compliance team proposes a KRI: 'number of regulatory inquiries received.' What is the main limitation of this KRI as a standalone operational risk indicator?
- Regulatory data is too expensive to obtain
- It is a lagging indicator that only captures risk after regulatory attention has been triggered (Correct answer)
- It duplicates existing financial reporting metrics
- Regulators prohibit using inquiry data as internal risk metrics
Correct answer: It is a lagging indicator that only captures risk after regulatory attention has been triggered
Regulatory inquiries confirm that a compliance risk has already materialized, making this a lagging measure that provides no early warning capability on its own.
Question 6: In the context of RCSA (Risk and Control Self-Assessment) linkage, KRIs should primarily be mapped to which element?
- Legal entity structures
- Residual risks identified for specific controls (Correct answer)
- Financial statement line items
- Employee performance objectives
Correct answer: Residual risks identified for specific controls
Linking KRIs to residual risks from RCSA ensures that the indicators monitor the risks that remain after controls are applied, validating control effectiveness over time.
Question 7: What is the recommended maximum number of KRIs per risk category according to most operational risk best-practice frameworks?
- No limit — more KRIs always provide better coverage
- Typically 3–7 high-quality KRIs per category to maintain focus and actionability (Correct answer)
- Exactly 10 KRIs per category as mandated by Basel III
- 1 KRI per category to avoid conflicting signals
Correct answer: Typically 3–7 high-quality KRIs per category to maintain focus and actionability
Best practice suggests a small set of 3–7 well-chosen KRIs per category; too many indicators dilute management attention and create reporting noise.
CORES Key Risk Indicator Development 4
When developing KRIs for a new business line, what should be the FIRST step in the process?