The KRI the CRO Wants Turned Amber
Atlas Manufacturing's monthly risk report shows four KRIs. The 'third-party security assessment completion' KRI has been red for five months: 61% of critical vendors assessed against a 90% target. The vendor management team says the breach is caused by two large vendors whose assessments are booked for next quarter. Two weeks before the board risk committee, the CRO asks the risk analyst to reclassify the KRI to amber because 'the trend is improving' and to move the vendor detail to an appendix. The KRI's threshold was approved by the board. Last quarter the board spent 40 minutes on this KRI.
1. Should the analyst reclassify the KRI to amber? Explain the reasoning.
Read the worked answer
No. The threshold was approved by the board, and the measured value is still 61% against a 90% target. Changing the status because the trend is improving is a presentation decision dressed up as a measurement decision, and it was requested two weeks before the meeting that will read the report - timing that makes the motive visible.
Doing it once costs the credibility of the whole pack. The board will learn the two vendors' dates regardless, and the next time a KRI is red they will reasonably wonder what was adjusted.
There is a legitimate way to give the CRO what he actually wants: keep the red status and show the forward path beside it - '61% today, 78% by Q3 on booked assessments'. That conveys improvement without falsifying the current position. If the threshold itself is wrong, propose a change to the body that set it, with evidence, on a normal cycle.
2. How should this KRI be presented to the board risk committee so it supports a decision?
Read the worked answer
Lead with the risk, not the colour. The board needs: how many unassessed critical vendors hold regulated or customer data (count alone hides this), the two named vendors with their committed dates and the consequence if those slip, the proportion of third-party risk actually covered rather than the proportion of forms completed, and the specific decision requested.
Detail can go to an appendix only if the headline still carries cause and ask. A committee that spent 40 minutes on this last quarter will want to know what changed, what management is doing, and whether the appetite for unassessed vendors is being breached. 'Amber, improving' answers none of those and invites the committee to spend the time again.
3. What is structurally weak about this KRI, and how should it be strengthened?
Read the worked answer
Completion percentage measures activity, not risk. It says how much assessment paperwork was finished, not how much unassessed third-party exposure the organization is carrying - and it can be moved by assessing low-risk vendors quickly.
Strengthen it in three ways:
- Weight by exposure - a vendor holding customer data counts more than one holding none, so the metric reflects risk coverage rather than vendor headcount.
- Add a lead indicator - contracts renewing within 90 days without a completed assessment, which gives the committee time to act rather than reporting a backlog.
- Pair with an outcome measure - third-party incidents, or findings from vendors assessed, to test whether the assessments are finding anything.
The best version answers 'how much unassessed third-party risk are we carrying', not 'how many assessments have we finished'.