A risk practitioner implemented a process to notify management of emergency changes that may not be approved. Which of the following is the BEST way to provide this information to management?

Change logs record changes but don't inherently highlight the *risk* associated with unapproved emergency changes for management.

Meeting minutes document discussions but are reactive and not a proactive mechanism for alerting management to a specific risk arising from emergency changes.

KCIs measure the effectiveness of controls, but KRIs specifically focus on the *risk* level, which is more appropriate for notifying management about potential unapproved changes.

KRIs are metrics used to provide an early warning of increasing risk exposures, making them ideal for signaling when controls (like change approval processes) are being bypassed or are ineffective due to emergency actions, which could lead to significant risk. This allows management to proactively address potential issues before they become incidents.