Page 519 - COSO Guidance

Unemployment Rate
8.0
7.5 7.5 7.7 7.8 7.8 8 8 8 8 7.9 7.9 7.9
7.5
Thought Leadership in ERM | Developing Key Risk Indicators to Strengthen Enterprise Risk Management | 9
Actual
Projected
7.0
J F M A M J J A S O N D

Retail Occupancy %

90 88 88
86
85 85
85 84
82 82
80 80 80 81 Actual
80
Projected
75
J F M A M J J A S O N D

Also see COSO’s 2004 Enterprise Risk Management – Once an initial set of KRIs has been designed and
Integrated Framework, Volume 2, Application Techniques deployed, it is vital that monitoring occurs to validate their
for additional examples of dashboard reports. effectiveness. Even well-designed and effective KRIs can
lose value as organizational objectives and strategies
It is also important to consider the frequency of reporting adapt to an ever-changing environment. There is a very
KRIs. The appropriate time horizon is dependent upon the real danger, once a network of KRIs has been established,
primary user of a specific KRI. For operational managers, that management devotes resources elsewhere within the
real-time reporting is attractive. For senior management, organization and ignores the need to refine and replace
where a compilation of KRIs that highlights potential existing risk metrics to better capture the data relevant to
deviations from organization-level targets is the likely goal, a the new environment. As part of the initial development and
less frequent (e.g., monthly) status report may be sufficient. deployment phase, attention should be paid to the process
At the board level, the reporting is often aggregated to allow that will be followed to continuously track KRI performance.
for a more strategic evaluation of the data. It is important to
remember that a KRI does not manage or treat risk, and can
lead to a false sense of security if poorly designed. Ideally,
active assessment of the “predictive-ability” of each KRI is
an ongoing facet of the organization’s ERM process.

w w w . c o s o . o r g