Which of the following is the GREATEST challenge when developing key risk indicators (KRIs)?

The correct answer is D. Linking KRIs to specific risks. Linking KRIs to specific risks (D) is the greatest challenge because KRIs are only meaningful if they serve as early warning signals for a particular risk - without that linkage, you have metrics that don't actually predict or measure anything actionable, making the entire KRI…

Submitted by chiamaka_o· Apr 18, 2026Information Security Risk Management

Question

Options

ALimiting the number of KRIs
BComprehensively reporting on KRIs
CAggregating common KRIs
DLinking KRIs to specific risks

How the community answered

(42 responses)

A
12% (5)
B
21% (9)
C
7% (3)
D
60% (25)

Explanation

Linking KRIs to specific risks (D) is the greatest challenge because KRIs are only meaningful if they serve as early warning signals for a particular risk - without that linkage, you have metrics that don't actually predict or measure anything actionable, making the entire KRI program ineffective. Limiting the number of KRIs (A) is a governance decision, not a technical challenge - organizations simply prioritize and set thresholds. Comprehensively reporting on KRIs (B) is an operational task that tools and dashboards handle well once KRIs are defined. Aggregating common KRIs (C) is a process that adds efficiency but is straightforward once the underlying KRIs are already mapped to risks.

Memory tip: Think of it this way - a KRI without a linked risk is just a random metric. The word "indicator" only makes sense if it's indicating something specific; the hard part is always establishing that cause-and-effect relationship between the metric and the risk it's supposed to signal.

Topics

#Key Risk Indicators#KRI Development#Risk Monitoring#Risk Management Challenges

Community Discussion

No community discussion yet for this question.

Full CISM Practice