For example, the risk of “financial loss due to breach of underwriting authorities” may be partially predicted by a KRI of “number of times in a month a scheduled peer review was not conducted” or “failure to seek management approval to underwrite a class of business outside of an assigned underwriting authority.” These types of violations may call for renewed focus on the peer-review process and shoring up of management-review protocols.

Second, KRIs are often associated with legal and regulatory requirements, so that monitoring and evaluating KRIs can facilitate corporate-compliance efforts.

For instance, insurers are frequently examined by regulators as to their market-conduct practices to ensure policy issuance and claims procedures are compliant with state law. Failure to adhere to laws can result in significant fines, fees or penalties. To this end, companies may track KRIs such as “number of customer complaints received from all sources each month, trailing over a three-month average, above an expected average.” An increase in customer complaints over time may indicate a larger market-conduct issue.

Third, they can also support strategic decision-making and business development. Here, insurers may track KRIs such as “win/loss ratios” over time for the acquisition of new business or the company's policy-renewal rate and trends through specific time periods, for particular product lines.

Designing and Using KRIs

A major first step in this process is surveying key stakeholders, such as the designated internal risk owners, internal and external subject-matter experts, customers, and employees. Legal and compliance staff can be particularly helpful, providing advice related to current and proposed laws and regulations, as well as internal policy and procedure priorities. Vendors close to the company or line of business may be able to provide useful information about what trends they are seeing.

Historical loss data can also be mined to suggest areas for KRIs. Key performance indicators can often be re-examined and turned around to formulate KRIs for looking at future developments under the theory that “the best prophet of the future is the past.” Past losses and trends may be analyzed for direct and indirect “root causes,” which can then be tracked proactively going forward as KRIs. To this end, trade-publication and loss directories are valuable resources for loss history and cause analysis.

From a review of all available information, KRIs can be selected or designed that are most clearly linked to corporate key strategies and business objectives, or which may help validate or invalidate management decisions and actions. There are several other factors to consider when selecting appropriate KRIs to monitor, and trade-offs may need to be made between potential criteria.

Ultimately, the KRI must be easily applied and understood by the end users, often meaning that it must be balanced in scope—not too complicated or simplistic.

Finally, KRIs should be flexible and reviewed frequently in order to respond to changes in the business market and operational environments. 

Reporting Considerations

Communication of KRI information depends on the audience need. Risk owners will want a more detailed view, often reviewing associated risks and controls that may be impacting trends. Senior management, on the other hand, may desire a holistic dashboard view to compare KRIs across business segments. Consider developing multiple reports for various viewers.

Organizing, monitoring, reviewing and communicating KRI progress can be greatly facilitated by having a centralized, automated system for the company's ERM program, with flexible reporting functionality. Through a dedicated system for tracking risk and/or ERM program information, companies may benefit from the creation of consistent KRI standards, easily capturing attributes that are required to support risk-management processes over time.

These KRI “libraries” can be linked to multiple risks and controls, across multiple departments. System-based linkage of KRIs and ERM reporting with such related information as policies and procedures, losses, incidents, source legal and regulatory content, compliance-control actions taken, auditing, etc. all help risk owners and senior management develop a clearer vision of the future.