The Definition of Key Risk Indicator (KRI)

Definition of Key Risk Indicator (KRI)

A key risk indicator (KRI) is a measurable value that signals a change in the level of risk an organization faces, before that risk turns into a loss. In environment, health and safety (EHS) management, KRIs track the conditions, exposures and control weaknesses that make serious incidents more likely, such as overdue critical maintenance, excessive overtime or repeated failures of safety-critical equipment.

What makes a KRI different from an ordinary measurement is that it is tied to a specific risk and compared against agreed thresholds. When the value crosses a threshold, it triggers a defined response, such as a management review, extra controls or a pause in work. In this way, KRIs act as an early warning system that gives leaders time to act.

KRIs come from the field of enterprise risk management, where they are used to monitor financial, operational and compliance risks. Safety teams use the same idea to watch the health of the barriers that protect people from major hazards.

KRIs vs. KPIs

KRIs are closely related to the key performance indicator (KPI), and the same number can sometimes serve as both. The difference lies in the question each one answers.

• Purpose: a KPI shows how well the organization is performing against a goal. A KRI shows how much risk exposure is building up and whether it is moving toward an unacceptable level.
• Time focus: many KPIs, such as injury rates, look back at results. KRIs are designed to be forward-looking and to change before an incident happens.
• Thresholds: KPIs are usually compared with targets. KRIs are compared with tolerance limits, often shown as green, amber and red zones, that trigger escalation.
• Ownership: each KRI should be linked to a named risk and a risk owner who is responsible for responding when the indicator moves.

For example, the number of safety inspections completed is a KPI that measures program activity. The percentage of safety-critical inspections that are overdue is a KRI, because a rising number means the chance of an undetected failure is growing.

Building Effective Safety KRIs

Characteristics of a good KRI

• Linked to a specific risk: the indicator should measure a cause, condition or control that clearly affects the likelihood or severity of a known hazard scenario.
• Predictive: it should move before harm occurs, not after.
• Measurable and reliable: the data should be collected the same way each time and be hard to manipulate.
• Timely: it should be reported often enough to allow action, such as daily, weekly or monthly depending on the risk.
• Actionable: there should be a clear response plan when a threshold is crossed.

Setting thresholds

Thresholds turn a KRI from a number into a decision tool. Organizations usually set them based on their risk appetite, historical data, regulatory limits and engineering judgment. A common approach uses three levels:

• Green: risk is within tolerance and normal monitoring continues.
• Amber: risk is rising, so the risk owner investigates and plans corrective steps.
• Red: risk is outside tolerance, so the issue is escalated to senior leaders and immediate controls are applied.

Examples of safety and operational KRIs

• Maintenance backlog: the number or percentage of overdue preventive maintenance tasks on safety-critical equipment.
• Barrier impairments: how many safety systems, such as gas detectors, fire pumps or interlocks, are bypassed or out of service, and for how long.
• Overdue corrective actions: open corrective actions from audits and investigations that have passed their due date.
• Fatigue exposure: overtime hours, consecutive shifts or workers exceeding hours-of-work limits, often tracked through a fatigue risk management system.
• High-potential events: the number of near misses that could have caused a serious injury or fatality.
• Training and competency gaps: the share of workers in high-risk roles whose required certifications have expired.
• Contractor and workforce change: the proportion of new or temporary workers on a site, since less experienced crews face higher risk.
• Process deviations: how often equipment operates outside its safe operating limits, such as pressure or temperature excursions.

Using KRIs in a Safety Program

KRIs work best as part of a wider risk management process. Teams first identify their most serious hazard scenarios, often through a risk assessment, then ask which causes and controls matter most. Indicators are chosen for those causes and controls rather than for whatever data happens to be easy to collect.

• Keep the list short: a small set of well-chosen KRIs is easier to act on than a long dashboard.
• Review regularly: discuss KRIs in safety committee and leadership meetings so that trends lead to decisions.
• Test against outcomes: check whether the KRIs actually moved before past incidents. If they did not, refine them.
• Avoid gaming: if people are rewarded for keeping a KRI green, they may stop reporting problems. Treat a red KRI as useful information, not a failure.
• Update as risks change: new equipment, processes or sites may need new indicators and thresholds.

Example of Key Risk Indicator (KRI)

A chemical distribution company identified loss of containment during tank transfers as one of its most serious risks. After reviewing past near misses, the safety team chose three KRIs: the number of overdue inspections on transfer hoses and couplings, the number of high-level alarms that were out of service, and the percentage of transfer operators with expired training. Each KRI had green, amber and red thresholds, and the operations manager was named as the risk owner.

Within two months, the overdue hose inspection KRI moved into the red zone after a maintenance technician left the company. The red status triggered a review at the monthly leadership meeting. The company assigned a contractor to clear the inspection backlog, found and replaced two hoses with damaged fittings and added a backup inspector to its maintenance plan. No release occurred, and the team began reporting the KRIs weekly instead of monthly.

Frequently Asked Questions: Key Risk Indicator (KRI)

What is the main difference between a KRI and a KPI?

A KPI measures how well the organization is performing against a goal. A KRI measures how much risk exposure is building and warns when it approaches an unacceptable level. KRIs are tied to specific risks and thresholds that trigger action.

Are KRIs the same as leading indicators?

They overlap but are not identical. Many leading indicators can serve as KRIs. A leading indicator becomes a KRI when it is linked to a specific risk, has defined thresholds and has an owner who must respond when it moves.

How many KRIs should a safety program track?

There is no fixed number. Most organizations focus on a small set of indicators for their highest risks, enough to give early warning without creating a dashboard that no one reviews.

Can injury rates be used as KRIs?

Injury rates are lagging measures and usually change only after people are hurt, so they make weak KRIs. They are better used as KPIs, while KRIs focus on the conditions and control failures that come before injuries.