Which of the following is the BEST evidence of an effectively designed key risk indicator (KRI)?

The correct answer is A. The KRI is quantitative. A quantitative KRI can be measured objectively with numerical values, tracked over time, compared against defined thresholds, and used to trigger alerts when risk levels approach or exceed acceptable limits. This measurability is the hallmark of an effectively designed KRI…

Submitted by sofia.br· Apr 18, 2026Information Security Risk Management

Question

Options

AThe KRI is quantitative.
BThe KRI aligns with industry benchmarks.
CThe KRI measures residual risk.
DThe KRI considers risk appetite.

How the community answered

(21 responses)

A
90% (19)
C
5% (1)
D
5% (1)

Explanation

A quantitative KRI can be measured objectively with numerical values, tracked over time, compared against defined thresholds, and used to trigger alerts when risk levels approach or exceed acceptable limits. This measurability is the hallmark of an effectively designed KRI because it enables consistent monitoring and evidence-based decision-making. Aligning with industry benchmarks (B) is useful for context but does not ensure the KRI is effective for the specific organization's risk profile. Measuring residual risk (C) describes one possible subject of a KRI, not what makes it well-designed. Considering risk appetite (D) is important for setting thresholds but is a configuration concern, not the defining characteristic of an effective KRI design.

Topics

#Key Risk Indicators (KRIs)#Risk Measurement#Quantitative Metrics#Risk Management Effectiveness

Community Discussion

No community discussion yet for this question.

Full CISM Practice