Module 35: Key Performance Indicators (KPIs)

If you only remember one thing from this module, let it be this: strong KPI numbers do not guarantee low risk. KPIs evaluate:

• Control performance
• Process efficiency
• Remediation progress
• Treatment plan execution

KPIs answer:

Are we doing what we said we would do?

They do not directly measure risk exposure.

What the exam is really testing

When KPIs appear, CRISC is asking:

• Is control performance measurable?
• Are treatment plans progressing?
• Are remediation timelines met?
• Are controls operating consistently?
• Are operational goals achieved?

KPIs measure execution — not exposure.

KPI characteristics

Effective KPIs are:

• Specific
• Measurable
• Time-bound
• Actionable
• Linked to control or process objectives
• Aligned to risk treatment plans

If KPIs are vague or unmeasurable, governance weakens.

KPI examples

Examples of KPIs:

• % of access reviews completed on time
• Average time to remediate high-risk findings
• % of critical systems with updated patches
• % of vendor assessments completed
• % of policy exceptions reviewed quarterly
• % of controls tested as scheduled

These measure performance of controls and processes.

They do not directly measure residual risk.

KPI vs KRI (critical distinction)

Let’s make this crystal clear.

KPI:
Measures control/process performance.
Example: 95% patch compliance.

KRI:
Measures risk exposure.
Example: % of critical vulnerabilities beyond SLA.

Patch compliance is performance.
Unpatched critical vulnerabilities beyond SLA is exposure.

CRISC frequently tests this difference.

Example scenario (walk through it)

Scenario:
An organization tracks the percentage of access reviews completed on time.

This is a:

A. Key Performance Indicator
B. Key Risk Indicator
C. Heatmap metric
D. Residual risk score

Correct answer:

A. Key Performance Indicator

This measures performance of the review process.

A tougher one

A dashboard shows that 98% of controls were tested as scheduled. However, incident frequency is increasing.

What does this MOST likely indicate?

A. Excessive appetite
B. Weak inherent risk
C. Strong KPI performance but rising risk exposure
D. Poor threat modeling

Correct answer:

C. Strong KPI performance but rising risk exposure

KPIs may look strong while KRIs indicate rising exposure.

KPI design principles

KPIs should:

• Be tied to treatment plans
• Align with control objectives
• Have defined targets
• Have defined thresholds
• Be monitored regularly
• Trigger corrective action when performance degrades

KPIs without action are meaningless.

KPI thresholds

KPIs should define:

• Target (e.g., 95% compliance)
• Warning level (e.g., < 90%)
• Escalation threshold (e.g., < 80%)

If performance degrades, corrective action must occur.

CRISC tests failure to act on degraded KPIs.

KPI & treatment plan integration

KPIs should measure:

• Implementation milestones
• Remediation progress
• Control execution rates
• Closure of issues
• Exception aging

KPIs support monitoring of treatment plans.

The most common exam mistakes

The number one trap on KPI questions is assuming that strong performance numbers mean risk is under control. They do not. A 98% completion rate on control testing is meaningless if the controls keep failing when they run. Also, if a KPI has no threshold or escalation path, it is just a number on a slide. CRISC evaluates structural clarity.

Now consider this

An organization reports 100% completion of control testing as a KPI. However, testing reveals recurring control failures.

What is the MOST significant governance concern?

A. Strong performance
B. Weak inherent risk
C. Excessive mitigation
D. KPI measuring activity instead of effectiveness

Correct answer:

D. KPI measuring activity instead of effectiveness

Completion of testing does not measure control effectiveness.

KPI vs activity metrics

Activity Metric:
Number of meetings held.
Number of reports generated.

KPI:
% of remediation plans completed on time.
% of controls operating effectively.

Activity does not equal performance.

CRISC favors meaningful KPIs.

Quick knowledge check

1) KPIs primarily measure:

A. Risk exposure
B. Control and process performance
C. Threat likelihood
D. Inherent risk

2) Which is a KPI?

A. % of vulnerabilities beyond SLA
B. % of controls tested as scheduled
C. Risk heatmap severity
D. Residual risk score

3) Strong KPI performance always guarantees low risk exposure.

A. True
B. False

Final takeaway

KPIs measure:

• Execution
• Performance
• Process discipline
• Control activity

KRIs measure:

• Exposure
• Trend risk
• Threshold breaches
• Potential loss movement

Confusing the two is one of the easiest ways to miss CRISC questions.

Confusing the two is one of the easiest ways to miss CRISC questions. Keep them separate and you will be in good shape.