An organization has an internal control that requires all access for employees be removed within 15 days of their termination date. Which of the following should the risk practitioner use to monitor…

Operation Level Agreements (OLAs) are internal agreements between departments, typically used in IT service management, and are less direct than a KPI for monitoring this specific control adherence.

Service Level Agreements (SLAs) are agreements for service delivery, often with external customers or between internal departments, and are not typically used for monitoring adherence to an internal control's specific threshold.

A KPI measures how effectively an organization is achieving key business objectives and, in this case, adherence to a specific internal control. Monitoring the percentage of terminated employees whose access was removed within 15 days directly measures the performance of the access revocation process against the set threshold.

A Key Risk Indicator (KRI) provides an early warning of increasing risk exposure; while poor adherence could be a KRI, the direct measurement of the control's performance against its target is a KPI.