KRI Breach: Recalibrate or Escalate?
Meridian Digital Bank's onboarding fraud team uses KRI-FR-02: 'percentage of high-risk onboarding alerts not reviewed within five business days'. Amber is set at 10%, red at 15%, and the current level is 23%. Alert volume is 4,200 a month, up from 2,300 a year ago; account openings rose 80%. Alerts per 1,000 applications are stable at 6.1 versus 6.0. Open case backlog is 1,200, with 22% older than 30 days. Three investigators left in the last quarter; two replacements are in training and not yet productive. A model change in March increased auto-clearance of low-risk applications. The head of onboarding wants the red threshold reset to 25% and the KRI redefined as 'average age of open cases', arguing that growth, not control failure, caused the breach. The CRO has asked for an independent assessment before the next risk committee.
1. Is the breach caused by volume growth, control degradation, or both? What analysis would you perform?
Read the worked answer
The breach is not explained by growth alone. Alerts per 1,000 applications are stable at 6.1 versus 6.0, so the alert rate is not deteriorating; but absolute alert volume has risen 82% (2,300 to 4,200) and the team has lost three investigators. The KRI measures timeliness, and a backlog of 1,200 with 22% over 30 days shows the review process is capacity-constrained. A stable rate with a growing queue is consistent with demand outpacing capacity, which is still a control failure because the control, timely review, is not operating. The model change increasing auto-clearance may have reduced low-risk work, but it has not prevented the high-risk backlog; it also needs validation for fraud risk. I would decompose arrivals, clearances, productivity per full-time equivalent and attrition. The key question is whether high-risk alerts are being reviewed before onboarding decisions; if not, the risk is financial crime, not just delay. The KRI is therefore signalling a real problem, even if the cause is volume plus attrition.
2. Should the red threshold be raised to 25% and the KRI redefined? Justify your recommendation.
Read the worked answer
Do not reset the red threshold to 25% to accommodate the breach. Thresholds should be derived from risk appetite, not from current performance. A 25% threshold would formally accept that one in four high-risk alerts is not reviewed within five days, which may be outside the bank's financial crime appetite. The CRO can approve a temporary amber status only with a capacity plan and a date. A revised KRI set is reasonable after root cause: keep the timeliness KRI, add backlog, 30-day ageing, clearance rate per full-time equivalent and quality sampling. 'Average age' alone can hide a long tail, so use a percentile. Any recalibration should be back-tested against the last 12 months to see whether it would have warned earlier. Document the rationale and get risk committee approval. If the bank genuinely accepts slower review for lower-risk alerts, segment the KRI by risk tier rather than raising the overall threshold.
3. What immediate actions and reporting would you recommend while the assessment is completed?
Read the worked answer
Move experienced investigators to high-risk queues; authorise overtime or a temporary contractor; pause or reverse the auto-clear change until validated; triage the 1,200 backlog by risk and age; set a daily dashboard for arrivals, clearances and aged cases; escalate to the Financial Crime Committee and, if required by policy, to the regulator. Report the breach as a control issue, not a volume exception. Track remediation: two trainees productive by week six, backlog below 300 by week eight, 30-day ageing below 5%. Re-test the KRI after capacity is restored. If the bank cannot meet the appetite, it should consider limiting onboarding growth for higher-risk segments rather than accepting an uncontrolled backlog. The risk committee should see both the raw KRI and the capacity metrics so it can judge whether the breach is transient or structural.