During the creation of an organization's IT risk management program, the BEST time to identify key risk indicators (KRIs) is while:

Interviewing data owners helps identify *risks* and assets, but not specifically the indicators for *monitoring* the ongoing status or changes in those risks.

Reviewing risk response plans with internal audit occurs *after* risks are identified and responses defined; KRIs are for ongoing monitoring of the effectiveness of those responses and the overall risk posture.

Key Risk Indicators (KRIs) are metrics used to provide an early signal of increasing risk exposure, making them integral to an effective risk monitoring process. Therefore, identifying KRIs is best done concurrently with or as a foundational step of developing the risk monitoring process, as they define what needs to be tracked and reported for ongoing risk awareness.

Reviewing an external risk assessment provides valuable input on potential risks, but the *identification* of specific internal KRIs is a distinct step tied to the organization's own monitoring requirements.