Skip to content

FRM Exam Part II · Risk Measurement and Assessment

Key Risk Indicators and Scenario Analysis in Operational Risk

Updated 11 October 2026 · Fact-checked

Key risk indicators (KRIs) are forward-looking metrics that signal rising operational risk exposure or weakening controls. You set thresholds, escalate on breaches and review them regularly. Scenario analysis builds expert-judged views of severe but plausible losses. Its main weakness is bias, which you manage with structure, challenge and data.

Understand Key Risk Indicators and Scenario Analysis

A key risk indicator (KRI) is a metric that gives early warning of changes in risk exposure or control quality. Examples: staff turnover in a settlements team, number of failed trades, system downtime hours, overdue audit actions, or unreconciled items. KRIs are usually leading indicators. They point to where losses may arise before losses happen.

A key performance indicator (KPI) measures how well a process meets its business goals, such as trades processed per day. A KPI looks at performance. A KRI looks at risk. The same number can serve as both, for example system downtime, but the purpose differs. Loss event data, by contrast, is a lagging measure because it records what has already gone wrong.

Good KRIs are relevant to a specific risk or control, measurable, predictive, easy to obtain on time, and comparable over time. Too many KRIs bury the signal. Too few leave gaps. Each KRI needs an owner and a clear definition. Each is usually given thresholds, often in a traffic-light form: green means within appetite, amber means a warning, red means a breach that requires escalation and action. Thresholds should link to risk appetite and be calibrated using history, peer data and management judgment. Review them periodically because business conditions change.

Scenario analysis asks: what could happen, how often, and how severe would the loss be? It is used for risks where data is thin, especially rare, high-severity events such as a major cyber attack or a rogue trader. Experts, often in workshops, build scenarios and estimate frequency and severity. Results can feed capital models, stress tests and risk appetite. The scenarios should be severe but plausible and forward-looking, and they should reflect changes in the business and control environment.

Scenario analysis relies on judgment, so it is exposed to bias. Common ones: anchoring (stuck on a first number or past loss), availability (overweighting recent or memorable events), confirmation (seeking evidence that supports a prior view), overconfidence (ranges too narrow), and motivational bias (participants shade estimates to protect their unit or its capital). Controls include a trained facilitator, structured questions, diverse participants, use of external and internal loss data, documented assumptions, and independent challenge.

Key formulas to remember

Threshold logic (traffic light)
Green: within appetite | Amber: early warning | Red: breach, escalate
Thresholds should link to risk appetite and be reviewed regularly. Trigger levels are set per KRI.
KRI vs loss data
KRI = leading (before loss) | Loss data = lagging (after loss)
KRIs support prevention. Loss data supports measurement and learning.
Scenario loss estimate
Scenario loss ≈ frequency estimate × severity estimate (per scenario)
Expert judgment gives both inputs. Severity should be severe but plausible, not worst conceivable.

How to solve Key Risk Indicators and Scenario Analysis questions

Use this method for any MCQ on KRIs or scenario analysis.

  1. 1Identify the topic: is the question about KRI design, thresholds, monitoring, or scenario analysis?
  2. 2For a KRI question, decide whether the metric is leading or lagging, and whether it measures risk or performance.
  3. 3Check the selection criteria: relevant, measurable, predictive, timely, comparable, with a clear owner.
  4. 4For thresholds, link them to risk appetite, check the escalation action, and ask whether they need recalibration.
  5. 5For scenario questions, find the bias at work: anchoring, availability, confirmation, overconfidence or motivational.
  6. 6Match the fix to the problem: structured process, facilitator, data support, diverse experts, independent challenge.
  7. 7Eliminate options that treat KRIs as proof of losses or scenarios as precise forecasts.

Quickest way: Leading, risk, appetite, bias

When to use it: When time is short and options look similar.

  1. Ask: does it warn before loss? If yes, it is a KRI. If it records past loss, it is loss data.
  2. Ask: does it show risk or performance? Risk means KRI. Output goals mean KPI.
  3. For a breach, pick the answer with escalation and action, not just recording.
  4. For scenarios, name the bias from the clue: first number is anchoring, recent event is availability, shaded estimate is motivational.

Common mistakes in Key Risk Indicators and Scenario Analysis

  • Treating KRIs and KPIs as identical.

    Both are numbers on a dashboard and can overlap.

    Fix: Check the purpose. A KRI signals risk or control weakness. A KPI tracks goal achievement.

  • Calling KRIs lagging indicators.

    Students confuse them with loss event data.

    Fix: KRIs are mainly leading. Actual losses are lagging.

  • Choosing many KRIs for completeness.

    More data feels safer.

    Fix: Choose a focused set that is relevant and predictive. Too many obscure the signal.

  • Setting thresholds once and never revisiting them.

    Thresholds look like fixed limits.

    Fix: Review them as business, risk appetite and the environment change.

  • Mixing up the biases in scenario workshops.

    The names sound similar.

    Fix: Anchoring is a fixed starting number. Availability is memorable recent events. Motivational is self-interest. Overconfidence is ranges that are too narrow.

  • Believing scenario analysis gives precise forecasts.

    It outputs frequency and severity numbers.

    Fix: Treat it as structured judgment with uncertainty. It supplements data and does not replace it.

Worked examples

Example 1

A bank's payments unit reports monthly: failed payments, staff vacancy rate and overdue control tests. Failed payments rise from 0.4% to 0.9% of volume, past the amber trigger of 0.7% but below the red trigger of 1.2%. What is the correct response?

Show the solution
  1. Failed payment rate is a leading indicator of process or control weakness, so it is a KRI.
  2. 0.9% is above 0.7% (amber) and below 1.2% (red), so the status is amber.
  3. Amber is an early warning. The owner should investigate causes and report, with remedial action planned before red.
  4. Red escalation is not yet required, but the trend should be monitored closely.

Answer: Status is amber: investigate the cause, assign an owner and action, and monitor. Formal red escalation is not yet triggered.

Example 2

In a scenario workshop on a major data breach, the facilitator opens with last year's loss of USD 8 million. Experts then give estimates close to that figure, though the business has since doubled its customer data. Which bias is most evident and what is the best remedy?

Show the solution
  1. The estimates cluster near the first number given, USD 8 million.
  2. This is anchoring.
  3. The remedy is to remove or delay the anchor, then have experts estimate independently first.
  4. Add external loss data and changes in exposure to challenge the figure, with a facilitator probing the assumptions.

Answer: Anchoring. Use independent initial estimates, supporting internal and external data reflecting the larger exposure, and independent challenge.

Exam tips

  • Expect scenario questions that describe behavior and ask you to name the bias.
  • Remember KRIs are leading and loss data is lagging. This distinction is tested often.
  • For threshold questions, the best answer links triggers to risk appetite and defines escalation.
  • Watch for options that overstate scenario analysis as precise or as a substitute for data.

Practice questions from Risk Measurement and Assessment

Key Risk Indicators and Scenario Analysis: frequently asked questions

What is the difference between a KRI and a KPI in operational risk?

A KRI signals rising risk or weakening controls, usually before losses occur. A KPI measures how well a process meets its goals. Some metrics, such as system downtime, can serve as both.

How do you select KRIs and set thresholds?

Pick metrics that are relevant to the risk, measurable, predictive, timely and comparable, each with an owner. Set trigger levels, often green, amber and red, based on risk appetite, history and judgment. Review them regularly.

Why is scenario analysis used in operational risk?

Severe operational losses are rare, so historical data is limited. Scenario analysis uses expert judgment to build forward-looking views of severe but plausible events. It can inform capital, stress testing and risk appetite.

Which biases affect scenario analysis for FRM Part II?

The main ones are anchoring, availability, confirmation, overconfidence and motivational bias. Structured workshops, independent challenge, diverse participants and supporting data help reduce them.