Key Risk Indicator (KRI) Framework Template

KRI framework: selection criteria, KRI record fields, catalogue, RAG thresholds and calibration, link to RAS, data lineage, reporting, escalation, review

Finanzas, inversión, contabilidadCompletaBCBS PSMOR 2021; FSB RAF Principles 2013; DORA (EU) 2022/2554kri framework spec mathActualizada 24 oct 2026

Abrir en el editorDescargar .md

Cómo usar: Use it when you set up or overhaul key risk indicators for operational, ICT, compliance and people risk. Fill the selection criteria and the KRI record fields first, then build the catalogue with each KRI mapped to a RAS metric. The main pitfall is KRIs that never warn before losses because thresholds were set at comfortable round numbers.

Vista previa

KRI Framework Specification: [Bank name]

Specification of the key risk indicator (KRI) framework of a bank or other financial institution: selection criteria, a standard KRI record, the KRI catalogue, green, amber and red thresholds and how they are calibrated, the link to the risk appetite statement (RAS), data quality controls, reporting and breach escalation. It follows the monitoring and reporting expectations in the Basel Committee Revisions to the Principles for the Sound Management of Operational Risk (2021) and the risk limit and monitoring elements of the FSB Principles for an Effective Risk Appetite Framework (18 November 2013), and it supports the ICT risk monitoring duties in the Digital Operational Resilience Act (Regulation (EU) 2022/2554, applicable from 17 January 2025). Replace every [bracketed] value and every row marked Example. The worked example uses the fictional Fernhollow Bank and the metric IDs of its Risk Appetite Statement (finance/risk-appetite-statement). This is a document format, not legal, regulatory or financial advice. Obtain the principles and laws for the normative text.

Document control

Field	Value
Document ID	[KRI-SPEC-001]
Institution	[Bank name], [legal entity or group]
Version	[1.0]
Status	[Draft / In review / Approved / Superseded]
Owner	[@head-of-operational-risk]
Approvers/reviewers	[@chief-risk-officer], [@chief-operating-officer], [@chief-information-officer], [@chief-data-officer], [@mlro]
Approving body	[Executive Risk Committee, minute ERC-YYYY-NN]
Linked RAS	[RAS-2027, version 1.0]
KRI catalogue system of record	[GRC tool name and module]
Reference date of example values	YYYY-MM-DD
Effective date	YYYY-MM-DD
Next scheduled review	YYYY-MM-DD (at least annually)
Last updated	YYYY-MM-DD
Classification	[Internal]

Approvals

Role	Name	Decision	Date
Head of Operational Risk (prepares)	[@name]	[Submit]	YYYY-MM-DD
Chief Risk Officer (reviews)	[@name]	[Endorse / Return for changes]	YYYY-MM-DD
Executive Risk Committee (approves)	[@name]	[Approve / Approve with conditions]	YYYY-MM-DD

Revision history

Version	Date	Author	Change
0.1	YYYY-MM-DD	[@head-of-operational-risk]	First draft with catalogue of 10 KRIs
1.0	YYYY-MM-DD	[@head-of-operational-risk]	Approved; thresholds calibrated on 24 months of history
1.1	2026-10-25	[@head-of-operational-risk]	Updated to show KRI-OPR-002 red for September 2026 (5-hour payments hub outage), add KRI-CMP-012 for RAS-CMP-02 and clarify the red bound

1. Purpose and scope
2. Roles and responsibilities
3. KRI concepts and selection criteria
4. KRI record specification
5. KRI catalogue
6. Thresholds, RAG status and calibration
7. Link to the risk appetite statement
8. Data quality and lineage
9. Reporting and visualisation
10. Breach escalation and actions
11. Review, change and retirement
12. Glossary and references
Appendix A. Complete KRI record example
Standard and licence note

1. Purpose and scope

This specification sets a single standard for key risk indicators across [Bank name]. It covers non-financial risks (operational, ICT and security, third-party, operational resilience, compliance and financial crime, conduct, people) and the leading indicators that the treasury and credit functions use to warn of movements in financial RAS metrics. It applies to the parent bank and to every subsidiary that adopts the group risk appetite framework.

KRIs serve three purposes. They warn early: a well-chosen KRI changes before a loss occurs or before a RAS metric leaves its appetite zone. They monitor control health: a KRI can show that a control is weakening between formal tests. They make appetite operational: Level 3 KRI thresholds translate a board statement such as "minimise operational risk" into numbers that a process owner sees every day.

The framework does not replace other measures. Lagging measures (actual losses, incidents, audit findings) remain essential and are reported alongside KRIs. Control testing, described in the Control Testing Workpaper (compliance/control-testing-workpaper), gives evidence that a control works; a KRI only suggests where to look.

Example: Fernhollow Bank, a fictional mid-sized EU credit institution, runs a catalogue of 11 group-level KRIs in this specification and about 60 process-level KRIs owned by business units. The group KRIs feed the quarterly risk profile report to the Board Risk Committee (BRC).

2. Roles and responsibilities

Role	Responsibilities
KRI owner (first line, business or function head)	Proposes the KRI, owns the underlying risk, reviews each reading, records commentary and leads actions on amber and red
Data owner and technical owner	Produces the KRI from the source system, maintains the calculation, performs data quality checks, reports data incidents
Operational risk function (second line)	Owns this specification and the catalogue, challenges KRI design and thresholds, aggregates KRIs into reports, tracks escalations
Chief Risk Officer	Approves thresholds that protect a RAS metric; escalates to the BRC under the RAS rules
Executive Risk Committee	Approves new group KRIs, retirements and threshold changes; reviews the catalogue each year
Internal audit (third line)	Reviews the design and use of the framework and the reliability of KRI data

Two principles keep the framework honest. The person whose performance a KRI measures should not be the only person who can change its threshold. And a KRI owner who comments "no action required" on three consecutive amber readings must explain why the threshold should not be changed.

3. KRI concepts and selection criteria

3.1 Indicator types

The framework distinguishes four types of indicators so that each is used for what it can do.

Type	What it measures	Example	Use
Key risk indicator (KRI)	Exposure to, or drivers of, a risk	Share of payments needing manual repair	Early warning, appetite monitoring
Key control indicator (KCI)	Health of a specific control	Share of privileged accounts recertified on time	Control monitoring between tests
Key performance indicator (KPI)	Business performance against objectives	Payments processed per full-time employee	Management performance, not appetite
Lagging indicator	Outcome that has already happened	Net operational losses in the month	Validation of KRIs, appetite measurement

In this specification "KRI" covers both KRIs and KCIs where they protect an appetite metric. A KPI becomes a KRI only when a threshold signals a risk, for example when processing volume per employee is so high that error rates are expected to rise.

3.2 Selection criteria

A candidate KRI is accepted only when it meets all mandatory criteria and most of the desirable ones. Score each criterion as met, partly met or not met in the KRI record.

Criterion	Mandatory?	Test
Relevant	Yes	Maps to a named risk in the risk register or RCSA, or to a RAS metric
Predictive	Yes	Evidence or a reasoned argument that it moves before losses, incidents or appetite breaches
Measurable	Yes	Clear formula, unit and source; same result when two people compute it
Timely	Yes	Available within the reporting deadline at the required frequency
Owned	Yes	A named first-line owner accepts accountability
Thresholdable	Yes	Green, amber and red thresholds can be set and defended
Comparable	No	Can be compared across units, entities or over time
Cost-effective	No	Automated or cheap to produce relative to the risk it covers
Actionable	Yes	An amber or red reading leads to a defined action that the owner can take

Avoid three common design errors. Ratio KRIs with tiny denominators produce noise: a 50% failure rate on two transactions tells nothing. Counts that grow with business volume drift into red during growth even when risk per unit falls, so normalise by volume where possible. Composite indices that blend several measures hide which component moved, so keep components visible.

4. KRI record specification

Each KRI has one record in the system of record. The fields below combine the general metric definition fields (shared with the Metric Definition template, data/metric-definition, which covers business question, plain-language definition, formula, grain, sources, filters, freshness, thresholds, caveats, change log and ownership) with fields specific to risk monitoring.

Field	Source of field	Content
KRI ID	Metric definition: Metric ID	`KRI-<risk area>-<NNN>`, never reused after retirement
Name and short code	Metric definition	Plain name and a machine code
Definition in plain words	Metric definition section 2	One or two sentences a non-specialist understands
Formula	Metric definition section 3	Numerator, denominator, unit; KaTeX where helpful
Grain and dimensions	Metric definition section 4	Level of computation (entity, business unit, process) and breakdowns
Source systems and query	Metric definition section 5	System, table, extract or query reference
Filters and exclusions	Metric definition section 6	What is excluded and why
Frequency and freshness	Metric definition section 7	Measurement frequency, cut-off, reporting deadline
Thresholds	Metric definition section 8, extended	Green, amber and red bounds, direction, calibration method
Known caveats	Metric definition section 9	Data gaps, seasonal effects, manual steps
Change log	Metric definition section 11	Dated changes to definition or thresholds
Owner, data owner, steward	Metric definition section 13	Named people
Risk type and taxonomy	Risk-specific	Level 1 and Level 2 risk categories; Basel event type where operational
Linked RAS metric	Risk-specific	RAS ID, or "none" with justification
Linked risks and controls	Risk-specific	RCSA risk IDs (RSK-PAY-NNN) and control IDs (CTL-PAY-NNN)
Indicator type	Risk-specific	KRI, KCI or lagging
Escalation route	Risk-specific	Who is told at amber and red, within which time
Standard actions	Risk-specific	Pre-agreed actions for amber and red
Selection criteria assessment	Risk-specific	Result of section 3.2
Last validation	Risk-specific	Date of the last check that the KRI still predicts risk

5. KRI catalogue

Direction "Max" means higher values are worse; "Min" means lower values are worse. Values are at the reference date 2026-09-30.

KRI ID	Name	Formula (summary)	Unit	Direction	Green	Amber	Red	Current (Example)	RAG	Linked RAS	Owner	Frequency
KRI-OPR-001 (Example)	Payment repair rate	Payments needing manual repair / payments processed	%	Max	≤ 1.5	> 1.5 to 2.5	> 2.5	1.9	Amber	RAS-OPR-01	Head of Payments Operations	Daily, reported monthly
KRI-OPR-002 (Example)	Unplanned downtime of critical systems	Minutes of unplanned outage of systems supporting important business services	minutes per month	Max	≤ 60	> 60 to 120	> 120	340	Red	RAS-OPR-02	Chief Information Officer	Monthly
KRI-ICT-003 (Example)	Overdue critical security patches	Critical patches not applied within 30 days of release, on in-scope assets	count	Max	0	1 to 3	> 3	0	Green	RAS-OPR-02	Chief Information Security Officer	Weekly
KRI-ICT-004 (Example)	Overdue exit plan tests for critical ICT providers	Critical ICT arrangements whose exit plan test is past due	count	Max	0	1	> 1	0	Green	RAS-OPR-03	Head of Third-Party Risk	Quarterly
KRI-OPR-005 (Example)	Overdue high-rated risk and audit actions	High-rated actions past due date / open high-rated actions	%	Max	≤ 5	> 5 to 10	> 10	6.3	Amber	RAS-OPR-01	Chief Operating Officer	Monthly
KRI-CMP-006 (Example)	Aged transaction monitoring alerts	Alerts open more than 30 days	count	Max	≤ 150	151 to 400	> 400	120	Green	RAS-CMP-01	MLRO	Weekly
KRI-CRD-007 (Example)	Early mortgage arrears	Mortgage balances 30 or more days past due / total mortgage balances	%	Max	≤ 0.8	> 0.8 to 1.2	> 1.2	0.7	Green	RAS-CRD-01	Head of Retail Credit Risk	Monthly
KRI-LIQ-008 (Example)	Five-day retail deposit outflow	Net decrease in retail deposits over 5 business days / retail deposits at start	%	Max	≤ 2.0	> 2.0 to 4.0	> 4.0	0.6	Green	RAS-LIQ-01, RAS-LIQ-03	Treasurer	Daily
KRI-PPL-009 (Example)	Turnover in critical roles	Voluntary leavers in roles flagged critical, rolling 12 months / average headcount in those roles	%	Max	≤ 8	> 8 to 12	> 12	9.5	Amber	RAS-OPR-01	Chief People Officer	Monthly
KRI-OPR-010 (Example)	External fraud losses on payments	Gross external fraud losses on customer payments in the month	EUR thousand	Max	≤ 250	> 250 to 400	> 400	180	Green	RAS-OPR-01	Head of Fraud Risk	Monthly
KRI-CMP-012 (Example)	Complaints received per 10,000 active customers	Complaints received in the month / active customers x 10,000	ratio	Max	≤ 6.0	> 6.0 to 8.0	> 8.0	5.2	Green	RAS-CMP-02	Chief Compliance Officer	Monthly

Worked check for KRI-OPR-001: in September 2026 the payments operations unit (parent bank and Fernhollow Payments) processed 250,000 outgoing payments and 4,750 needed manual repair, so the reading is 4,750 / 250,000 = 1.9%. The value is above the 1.5% green bound and not above the 2.5% amber bound, so the status is amber.

Worked check for KRI-OPR-005: 8 of 127 open high-rated actions were past due, so the reading is 8 / 127 = 6.3%, which is amber.

Worked check for KRI-OPR-002: on 2026-09-12 the payments hub failover left the domestic payment service down for 300 minutes (5 hours, one hour beyond its 4-hour impact tolerance), and other critical systems had 40 minutes of unplanned downtime in the month, so the reading is 300 + 40 = 340 minutes. That is above the 120-minute red bound, so the status is red. One monthly reading captures both the single long outage and the accumulation of short ones; the impact tolerance itself is tracked event by event under RAS-OPR-02.

Coverage check: every non-financial Level 1 RAS metric is covered by at least one leading KRI. RAS-OPR-01 has four (KRI-OPR-001, KRI-OPR-005, KRI-PPL-009, KRI-OPR-010), RAS-OPR-02 has two (KRI-OPR-002, KRI-ICT-003), RAS-OPR-03 has one (KRI-ICT-004), RAS-CMP-01 has one (KRI-CMP-006) and RAS-CMP-02 has one (KRI-CMP-012: complaints received lead upheld complaints by one to three months). Record coverage gaps in the review in section 11.

6. Thresholds, RAG status and calibration

6.1 Status rules

Each KRI has two bounds: the green bound (the edge of normal operation) and the red bound (the level at which the owner must act before the linked RAS metric leaves appetite). Status is computed mechanically for a "Max" KRI with reading $x$ , green bound $g$ and red bound $r$ :

\text{Status}(x) = \begin{cases} \text{Green} & x \le g \\ \text{Amber} & g < x \le r \\ \text{Red} & x > r \end{cases}

For a "Min" KRI the inequalities reverse. Status is never overridden by hand; if the owner believes a reading is misleading, the commentary says so and the data issue is logged under section 8.

Where KRIs protect a RAS metric, their thresholds sit inside the RAS thresholds, so that the KRI turns amber before the RAS metric leaves its appetite zone. The RAS uses appetite, tolerance and limit thresholds (see the Risk Appetite Statement, finance/risk-appetite-statement, section 6.1); a KRI's green and red bounds correspond to warning levels inside the RAS appetite and tolerance.

6.2 Calibration methods

Choose and record one primary method per KRI and test the result against at least one other.

Method	How it works	Best for	Weakness
Historical distribution	Green bound near a high percentile of normal history (for example the 80th), red bound near an extreme percentile (for example the 95th), after removing known incidents	KRIs with 24 or more months of stable data	Normalises a bad history; breaks after process change
Appetite back-solving	Estimate the reading at which the linked RAS metric would reach appetite or tolerance, then set bounds before that point	KRIs with a demonstrated link to losses or a RAS metric	Needs a credible relationship model
Control design	Set from the control standard (for example patch within 30 days)	KCIs	Says little about risk severity
Expert judgement	Workshop with owner, risk and audit	New KRIs without data	Bias towards comfortable bounds
Peer or industry comparison	Benchmarks from consortium data or supervisory publications	Comparable KRIs	Definitions rarely match exactly

Example calibration for KRI-OPR-002: over 24 months, monthly unplanned downtime on critical systems had a median of 35 minutes, an 80th percentile of 58 minutes and a 95th percentile of 115 minutes after removing one outlier caused by a power failure. The domestic payment service has an impact tolerance of 240 minutes for a single disruption. The bank set the green bound at 60 minutes and the red bound at 120 minutes, which are close to the historical percentiles and leave time to act before a single event approaches the impact tolerance tracked by RAS-OPR-02.

6.3 Threshold governance

Threshold changes follow the same approval route as new KRIs. Each change is recorded in the change log with the old and new values, the method, the evidence and the approver. Thresholds are never changed while the KRI is red, except to correct an error in the original calibration, and that correction must be reported to the committee that receives the red escalation.

7. Link to the risk appetite statement

The RAS sets appetite at Level 1. The KRI framework operates at Level 3 and protects it. The mapping is held in the catalogue (column "Linked RAS") and is shown in the diagram for the operational metrics of the worked example.

Use the mapping in three ways. When a RAS metric turns amber, the report lists the linked KRIs and their status, which shows whether the early warning worked. When several KRIs linked to one RAS metric are amber at the same time, the operational risk function reports a cluster warning to the CRO even if the RAS metric is still green. When the board changes a RAS threshold, the owners of linked KRIs review their bounds within one reporting cycle.

Example: at 2026-09-30, RAS-OPR-01 (net operational losses of EUR 9.6 million against an appetite of EUR 12.0 million) is green, but three of its linked KRIs (KRI-OPR-001, KRI-OPR-005, KRI-PPL-009) are amber. The cluster warning went to the CRO and the payments subsidiary was asked to present its repair-rate remediation to the Executive Risk Committee. Two of these KRIs relate to risks assessed in the payments operations RCSA (finance/operational-risk-rcsa).

8. Data quality and lineage

KRIs are only as useful as the data behind them. The data controls below follow the aggregation and reporting principles in BCBS 239 (accuracy, completeness, timeliness, adaptability), cited by name, and the bank's Data Quality Standard (data/data-quality-standard).

Control	Description	Applies to
Documented lineage	Source system, extraction logic and transformations recorded in the KRI record	All KRIs
Automated extraction	Readings produced by scheduled jobs, not manual entry	Target for all group KRIs; manual KRIs flagged
Completeness check	Record counts compared with the source for the same cut-off	All KRIs with a denominator
Reasonableness check	Reading compared with the previous reading and a tolerance band; large jumps require commentary	All KRIs
Reconciliation	Reconciled to a financial or regulatory figure where one exists (for example fraud losses to the loss database)	Lagging and loss-based KRIs
Late reading rule	A missing reading is shown as "not reported" and counts as amber for escalation purposes	All KRIs
Restatement log	Any change to a published reading is logged with reason and approver	All KRIs

Treat a KRI data failure as an operational risk event in its own right when it hides a risk. If a KRI could not be produced for two consecutive periods, the owner must propose a substitute measure or a remediation date.

9. Reporting and visualisation

Reporting is layered. Process owners see their own KRIs daily or weekly. The Executive Risk Committee sees the group catalogue monthly. The BRC sees the KRIs linked to amber or red RAS metrics, the cluster warnings and the open escalations each quarter, inside the quarterly risk profile report described in the RAS.

Audience	Content	Frequency	Format
KRI owner	Own KRIs with drill-down by dimension	Daily to monthly	Dashboard
Executive Risk Committee	Full group catalogue, status, 13-month trend, commentary, open actions	Monthly	Dashboard and one-page summary
Board Risk Committee	KRIs linked to amber or red RAS metrics, cluster warnings, overdue actions	Quarterly	Section in the risk profile report
Internal audit	Full catalogue, change log, data issue log	On request	Extract

Design guidance for the dashboard: show each KRI as a row with the reading, the two bounds, the status, a small trend line and the commentary; order rows by status, then by linked RAS metric; use text labels as well as colour for status so the report is readable in grey scale and by colour-blind readers. Build it from the Dashboard Specification (data/dashboard-specification).

10. Breach escalation and actions

Status	Who acts	Timeline	Expected response
Amber	KRI owner	Comment within 5 business days of publication	Explain the cause; record an action with owner and date, or a reasoned decision to accept
Amber for three consecutive periods	Operational risk function	Next ERC meeting	ERC decides on action, threshold review or acceptance
Red	KRI owner and second line	Notification same business day; plan within 10 business days	Action plan with dated milestones; linked RCSA risks reassessed
Red linked to RAS metric outside appetite	CRO	Per RAS timelines	RAS escalation process applies

Example: the September 2026 reading of KRI-OPR-002 (340 minutes) was red, and the linked metric RAS-OPR-02 moved outside appetite to amber (one impact tolerance exceedance against an appetite of zero). The KRI owner notified the second line on the day the reading was published, the RAS escalation followed under breach BRE-2026-009, and the action plan is ISS-PAY-01 and ACT-PAY-01 in the payments RCSA (finance/operational-risk-rcsa).

Actions are tracked in the same issue log as audit and RCSA actions, with the KRI ID as a reference, so that action closure can be checked against the KRI returning to green.

11. Review, change and retirement

The operational risk function reviews the full catalogue at least annually and after any of these triggers: a material loss or incident that no KRI anticipated, a change in the RAS, a reorganisation or new system that changes data sources, or an audit finding. The review tests each KRI against the selection criteria and asks four questions. Did the KRI change status before related losses or incidents? Did it produce false alarms that consumed effort without risk? Is it still produced reliably? Is the risk it covers still material?

Back-testing supports the review. For each loss event above the reporting threshold in the Operational Loss Event Report (finance/operational-loss-event-report), check whether any linked KRI was amber or red in the preceding three months. A KRI that never warns before related losses should be redesigned or retired.

Review item	Result (Example)	Decision
KRIs green for 24 consecutive months	KRI-ICT-003	Keep: the control standard requires it; tighten green bound to zero overdue beyond 14 days in next version
Incidents where the KRI warned only in the same month	Payments hub failover outage 2026-09-12 (KRI-OPR-002 was green in July and August, 42 and 51 minutes, and turned red only with the outage itself)	Add a KCI for failover test success rate under KRI-OPR-011
KRIs with manual production	KRI-PPL-009	Automate from HR system by YYYY-MM-DD

Retired KRIs keep their ID and history in the system of record. IDs are never reused.

12. Glossary and references

12.1 Glossary

Term	Definition used in this document
KRI	Key risk indicator: a measure that signals a change in exposure to a risk
KCI	Key control indicator: a measure of the health of a specific control
KPI	Key performance indicator: a measure of performance against business objectives
Green bound, red bound	The two thresholds that define the green, amber and red zones of a KRI
Cluster warning	Several KRIs linked to one RAS metric in amber or red at the same time
Impact tolerance	The maximum disruption an important business service can tolerate
RAS	Risk appetite statement
RCSA	Risk and control self-assessment
Lineage	Documented path of data from source system to reported reading

12.2 References

Basel Committee on Banking Supervision, Revisions to the Principles for the Sound Management of Operational Risk (March 2021), and Principles for effective risk data aggregation and risk reporting (BCBS 239, 2013), cited by name only.
Financial Stability Board, Principles for an Effective Risk Appetite Framework, 18 November 2013.
Regulation (EU) 2022/2554 on digital operational resilience for the financial sector (DORA), applicable from 17 January 2025, EUR-Lex.
European Banking Authority, Guidelines on internal governance under Directive 2013/36/EU, EBA/GL/2021/05.
Metric Definition template (data/metric-definition) for the shared definition fields.

Appendix A. Complete KRI record example

Field	Value
KRI ID	KRI-OPR-001 (Example)
Name and short code	Payment repair rate, `pay_repair_rate`
Definition in plain words	The share of outgoing customer payments that could not be processed automatically and needed a person to correct or complete them
Formula	Payments routed to the manual repair queue in the period divided by all outgoing customer payments processed in the period, times 100
Grain and dimensions	Daily, by entity, payment scheme (SEPA credit transfer, SEPA instant, card) and channel
Source systems and query	Payments hub, repair queue table and processed payments table; extraction job `kri_pay_repair_daily`
Filters and exclusions	Excludes payments rejected by the customer's own cancellation; excludes test transactions
Frequency and freshness	Daily by 09:00 for the previous day; monthly reading is the month total
Thresholds	Max; green ≤ 1.5%, amber > 1.5% to 2.5%, red > 2.5%; calibrated by historical distribution (80th and 95th percentiles over 24 months) and checked against loss data
Known caveats	Readings rise in the first week after scheme rule changes; commentary required in those weeks
Change log	1.0 YYYY-MM-DD created; 1.1 YYYY-MM-DD SEPA instant added to grain
Owner, data owner, steward	[@head-of-payments-operations], [@payments-data-engineer], [@ops-risk-partner]
Risk type and taxonomy	Operational risk; Basel event type: Execution, delivery and process management
Linked RAS metric	RAS-OPR-01
Linked risks and controls	RSK-PAY-001, RSK-PAY-005; CTL-PAY-001, CTL-PAY-002, CTL-PAY-005 (see `finance/operational-risk-rcsa`)
Indicator type	KRI (leading)
Escalation route	Amber: owner comment within 5 business days; red: same-day notification to the Head of Operational Risk
Standard actions	Amber: root-cause sample of 50 repaired payments; red: freeze non-urgent payment system changes, add repair staff
Selection criteria assessment	All mandatory criteria met; comparable across entities: met; cost-effective: met
Last validation	YYYY-MM-DD (back-test against 2025 and 2026 loss events)

\text{Repair rate} = \frac{\text{payments routed to manual repair}}{\text{payments processed}} \times 100

Standard and licence note

Structure aligned with the monitoring and reporting topics of the Basel Committee Revisions to the Principles for the Sound Management of Operational Risk (2021) and BCBS 239 (cited by name only, no text reproduced) and with the risk limit and monitoring elements of the FSB Principles for an Effective Risk Appetite Framework (2013). Based on public law where cited: Regulation (EU) 2022/2554 (EUR-Lex). EBA guidelines are referenced with acknowledgement and no text is reproduced. All text, indicators, thresholds and figures are original and illustrative; they are not regulatory requirements. Fernhollow Bank and all figures are fictional. Check the current official version of each principle, guideline and regulation before use. Template licence: MIT.

Plantillas relacionadas

Finanzas, inversión, contabilidad