How key risk indicators help manage risk

On this page

• Identifying potential indicators of change
• When do you need to identify potential risk indicators?
• Workshopping your indicators
• Deciding what indicators you’ll monitor
• Pick a range of indicators
• Make effective use of what’s available
• The difference between risk indicators and performance indicators
• Creating as well as protecting value
• Making decisions

Risk is dynamic. As time goes by, a possible event may become more likely and its consequences more severe or less. It could go either way.

Risk owners need to identify the indicators of that change. These are your risk indicators. They indicate whether risk is changing and how it’s changing.

Control owners will need to monitor them so they can tell if they’re controlling the risk effectively.

Your risk practitioners can help risk owners to identify risk indicators. They can also help analyse the costs and benefits to see if monitoring the risk indicators is worth the effort, given the kinds of decisions you need to make. 

This diagram shows what we’re focused on and where it fits into the overall process of managing risk.

In this topic, we’ll talk mostly about events that you want to avoid—what we normally think of as risk—but remember that uncertainty is also a source of opportunities. Risk indicators can help you here too; for example, you may want to look out for indicators that a region, segment of the population, or a market is ready to adopt a particular service or accept a change, giving you the confidence to pursue an objective that had been too risky up till then.

In this guide, we’ll talk about

• analysing your risk so you can identify the indicators of change
• deciding what indicators are worth monitoring, given the decisions you need to make
• the difference between risk indicators and performance indicators 
• creating as well as protecting value
• making decisions.

Identifying potential indicators of change

There are two ways that a risk can change. It can become more or less likely and its consequences can become more or less severe.

If you want to identify changes in the likelihood of an event occurring, then you need to look at the causes of the event. If you want to identify changes in the severity of the impacts on the people, places and systems in your care, then look at the consequences.

To be a good indicator, they need to

• change in an observable way
• be connected to the causes and consequences that you analysed in your risk assessment.

Use the bow tie to help you identify potential risk indicators and map out what they’re an indicator of.

When do you need to identify potential risk indicators?

The best time to do this is when you’re identifying, analysing and evaluating your risks. This is when you’re building your understanding of the risk and how it affects your objectives.

In fact, it's highly likely that in working on your risk indicators, you'll come to a more thorough understanding of your risk and its causes and consequences, leading you to revise your initial assessment of the risk and its description.

You’ll also have a greater understanding of what’s going on in your internal and external context and how it could affect your objectives.

Workshopping your indicators

A group workshop with the risk owners, control owners and others involved in its management will help you home in quickly on indicators that do actually indicate change. You can do this at the same time as you’re assessing your risks or come back to an assessment you did earlier.

Start with 5 to 10 risks rather than your whole risk register. To produce your shortlist, ask yourself

• Which risks are critical to your objectives?
• Where do you have the greatest risk of loss and harm?
• What kind of decisions do you need to make if the risk changes?

This last point is a subtle one. Risk owners need to be able to draw a direct line between a risk assessment and their decisions about how to manage it. What counts as a reason or information for that decision? How is it grounded in your analysis of the risk? There’s no point tracking ‘data’ for a risk when it’s not going to be used in decisions about that risk.

Deciding what indicators you’ll monitor

The previous step was about identifying reliable indicators of change.

At this point, risk owners and control owners will need to make a judgement call on which risk indicators they’ll monitor. There are three things to bear in mind

• work out the costs and benefits of having the information
• pick a range of indicators
• make effective use of what’s already available.

Work out the costs and benefits

Monitoring risk indicators takes effort, so risk and control owners need to work out whether it’s worth it, given the kind of decisions you need to make.

Ask yourself what are the benefits you’re seeking from having information at your disposal? Will you make better decisions about how you manage risk? Will it improve your accountability? Will it help people collaborate better on shared risk? Are the potential consequences so catastrophic that you simply must be able to track if the event is becoming more likely—bushfire is a good example of this type of event.

What information do you actually need to make a decision about what to do?

Now look at the costs of getting that information. What will it take to 

• identify sources of data
• test the quality and relevance of the information
• assess when you’re approaching risk thresholds
• monitor indicators
• analyse
• report to decision-makers.

That’s the cost of monitoring your risk indicators—it’s valuable information about part of being accountable for how you manage risk.

Pick a range of indicators

Once you’ve decided that the benefit of monitoring the risk is worth the costs, you should make sure you watch a range of indicators.

Risk indicators aren’t just about ‘data’ and thresholds—in fact not all risks will have stereotypical ‘data’ or quantitative indicators.

To make your decisions, you need a well-rounded, intuitive grasp of your risk as well as the unambiguous ‘metrics’—if they’re available. You also need a set of indicators that are adequate for your decisions—what do you need to know to make a justified decision and account for it later?

We recommend risk and control owners rely on a variety of indicators in your internal or external context. For example,

• business information systems
• user behaviours in digital environments
• customer surveys
• focus groups
• observational research
• statistical information and analysis produced by governments and other organisations
• whistleblower reports
• the number and types of complaints and incidents
• training histories
• audits
• analysis and evaluation by subject matter experts
• anecdotal reports.

Use the PESTLE [DOCX, 4.59MB] and PPRACKIF [DOCX, 4.6MB] tools to help you scan the important aspects of your context for indicators of change.

Bear in mind too that indicators don’t determine a decision. Instead, they provide risk and control owners with information. In a positive risk culture, the leadership will make it clear to risk and control owners that this is part of the work of managing risk.

Make effective use of what’s available

Organisational systems generate a lot of data. We encourage control owners to talk to their business and operational specialists about the software and systems used for service delivery, compliance, finances, remuneration and planning to see what information can be extracted for monitoring risk. Again, the PPRACKIF [DOCX, 4.6MB] tool can help you examine your whole organisational context.

For information about what’s changing in your external context (use PESTLE [DOCX, 4.59MB]) we recommend that you make full use of the information the government sector generates. A good place to start is DataVic.

The Commonwealth also has a data portal Data.gov.au.

For the specific case of climate-change risks, the Victorian government has also published climate change projections for the state.

To make effective use of the information, consider these questions

• Does this inform us about the changing likelihood and consequences of the risk?
• Is it relevant to our actual decisions about how to control the risk?
• Are we confident that this information will be consistently reliable over time?
• Could we scale up if we needed to?

• Examples of risk indicators

  Percentage of projects that are delayed

  The number of projects currently in progress that are delayed as a percentage of the total number of projects currently in progress at the time of measurement.

  Percentage of performance indicator targets not met

  The number of targets not met by the organisation during the measurement period as a percentage of the total number of KPI targets defined by the organisation.

  System availability

  The amount of time that all systems are online and available for use by all authorised users divided by the total amount of time those systems are scheduled to be available for use over the same period, as a percentage.

  Health of the organisational culture

  Number of voluntary resignations by key persons

  Compliance in information management

  Percentage of incidents where the personal data of customers is put at risk

  Disaster preparedness

  Percentage of disaster recovery plans tested in the past 12 months

• Training information reflecting performance

  This information can indicate how well you’re performing on the delivery of your training program. If your objective is to train a staff of 1200 people by 30 June and you’ve trained only 50% by 1 March, then you have information you need for a decision about how you can train the remaining 600 people in the time you have left. In this case, it’s an indicator of how well you’re rolling out your training program.

• Training information indicating risk

  The same information can also indicate that the risk of unwanted events is increasing because not enough people are trained to prevent it from happening. In this case, it’s also an indicator of a risk in your internal context.