Which of the following is the MOST important factor in an organization's selection of a key risk indicator (KRU)?

The correct answer is A. Target audience. The target audience is the most important factor because a KRI only has value if it is meaningful, understandable, and actionable to the people who will consume it. Different audiences-board members, C-suite executives, or operational managers-require KRIs at different levels…

Submitted by takeshi77· Apr 18, 2026Information Security Risk Management

Question

Options

ATarget audience
BReturn on investment (ROI)
CBusiness impact
DCompliance requirements

How the community answered

(33 responses)

A
85% (28)
B
9% (3)
C
3% (1)
D
3% (1)

Explanation

The target audience is the most important factor because a KRI only has value if it is meaningful, understandable, and actionable to the people who will consume it. Different audiences-board members, C-suite executives, or operational managers-require KRIs at different levels of abstraction and with different thresholds. A technically perfect KRI that the audience cannot interpret or act upon provides no risk management value. Business impact, ROI, and compliance requirements are secondary considerations that matter only after the indicator is appropriately designed for its intended consumers.

Topics

#Key Risk Indicators (KRIs)#Risk Monitoring#Risk Communication#Stakeholder Engagement

Community Discussion

No community discussion yet for this question.

Full CISM Practice