Key Risk Indicators: Leading Signals, Not Lagging Counts

A key risk indicator is a measure chosen in advance, with a trigger set in advance. A change in it says something about a risk before anybody has to ask. A lagging count reports what already happened; a leading signal moves before the loss. At the invented Vindhya Commercial Bank Limited, 11 of 16 indicators are lagging counts, and 4 of the year's 13 incidents were preceded by an amber or a red.

One question settles the whole subject, and it is short enough to ask in a meeting without preparing for it. If this number moves today, has the thing I care about already happened? If the answer is yes, the number is a count, and its value is in explaining the past. If the answer is no, and the movement comes before the event, the number is a signal, and its value is entirely in the time between the movement and the loss. Almost every argument anybody has ever had about a dashboard is that question going unasked, and with the question in hand any indicator set in any institution can be sorted in about five minutes.

What is a key risk indicator, and what makes one key rather than merely interesting?

A key risk indicatorA measure chosen in advance, with a trigger set in advance, because a change in it says something about a risk somebody has named. is a measure that has to pass three tests before it earns a row on anything. The measure has to be chosen in advance. Otherwise the choice falls on whatever tells the most comfortable story after the event. The measure has to be measurable repeatedly, in the same way, from a source that will still exist next quarter. And the measure has to be connected to a risk somebody has actually named. Then a movement in it is a statement about something the institution has already agreed it cares about. Miss any one of the three and what remains is a number in a report rather than an indicator.

Take the household version first. The mechanism is identical and the stakes are legible. A household running on one salary decides to watch three things every month: how many days of expenses sit in the bank, whether the earner's employer has started delaying salary credits, and how many months are left on the rental agreement. All three were chosen before anything went wrong. All three can be measured the same way every month by looking at one statement, one bank credit date and one document. And all three attach to one risk somebody named out loud: the single income stops. Now add a fourth measure, the monthly electricity bill. The electricity bill is measurable, it is repeatable, it moves, and it has nothing to do with the risk that the income stops. The bill is interesting. The bill is not key.

The distinction between key and interesting does most of the work. Key means connected to a named risk, not important-sounding and not merely available. A bank can measure a very large number of things about itself, and the temptation of a dashboard is to fill it with whatever the systems already produce, because those numbers cost nothing to obtain and nobody has to justify them. The result is a dashboard full of movement, in which nothing that moves is telling anybody anything, and everybody who receives it learns to skim. A dashboardA single view of a chosen set of indicators with their current status, which is really a list of choices about what to watch. of everything measurable is a dashboard of nothing, and the way to tell is to take any row and ask which named risk it belongs to. If the answer takes more than one sentence, the row is decoration.

What separates a lagging count from a leading signal?

The whole of it is one question, and there is no second criterion hiding behind the first. The question applies to any indicator at all: if this number moves today, has the thing I care about already happened?

A lagging countAn indicator that counts something that has already happened, whose value is in explaining the past rather than in buying time. answers yes. Losses booked, breaches recorded, issues overdue, complaints received: every one of those moves because the event occurred. The number is a record. The count is often a good record, usually correct, and frequently the only thing anybody can agree on. But by the time it moves the loss is already in the accounts, so it cannot warn anybody. A leading signalAn indicator that moves before the loss, whose value is entirely in the time between the movement and the event. answers no. The signal moves because a condition is forming, and the loss, if it comes at all, comes later. Its whole value is the gap in between.

The difference is not the subject matter, it is the timing. Timing is worth stating flatly, and the commonest mistake is to sort indicators by topic. People assume that anything about fraud is a leading signal because fraud sounds urgent, and anything about complaints is lagging because complaints sound administrative. Neither holds. A count of fraud losses booked is a lagging count, and the proportion of exceptions approved by the very person who raised them is a leading signal, and both are about the same risk. In this invented bank the second of those is one of only five indicators that moves before anything is lost, and it is not a fraud number at all: it is an approvals number.

The everyday test runs the same way. A street food stall outside a single office building can count its takings each evening. The customers either came or they did not, so the takings are a lagging count. Or the stall can count how many parked scooters are outside the office at nine in the morning. The scooter count moves in the week the office starts letting people work from home, weeks before the takings fall. Same risk, being that one building supplies every customer. One number records it after the fact; the other one sees it forming. A count cannot be made leading by watching it more often, and a signal cannot be made lagging by ignoring it.

Why does a bank end up with mostly lagging counts?

Not through laziness, and not because anybody prefers them. Counts accumulate because of what happens in the room where a dashboard is agreed, and the mechanism is almost entirely social. Nobody argues with a count, and everybody argues with a signal.

Put a count of losses booked on the table and there is nothing to dispute. The number is a fact somebody can look up in the loss register, the definition writes itself, and the source is already producing it every month for another purpose. The count costs nothing to add and it survives every challenge. The only challenge available is that the register is wrong, and that is a different conversation. Now put a leading signal on the table. The share of manual journal entries at close, say. Immediately somebody asks the fair question: why does that predict anything? And the honest answer is that it is a claim, held by the person proposing it, that manual entries are where errors and manipulations hide, and that the share rising means the automated route is being bypassed more often. The claim can be doubted, and doubting it costs the doubter nothing.

So the two kinds of row face completely different odds of surviving the meeting. A count needs no defence and gets none. A signal needs a defence and finds one person to give it. Over three or four annual cycles of adding a row here and dropping a row there, the composition drifts, and nobody ever made a decision to make the dashboard backward looking. The ease of agreement is exactly what makes a count useless as a warning, and it is also exactly why the count is on the dashboard.

The same drift appears in a school report. Marks in last term's examinations are a count: undisputed, easy to produce, and entirely about what already happened. Whether the child has stopped asking questions in class is a signal, and it would tell a parent months earlier. Nobody writes that one down. A teacher who writes it down can be asked to justify it, and a teacher who writes down a mark cannot.

One caution before the list. The even split drawn on the left of that figure is an illustration of a starting point, not a target and not this bank's history: there is no correct proportion of leading to lagging for an institution to hold. The invented bank's own composition can be counted exactly, and the table below gives it.

What does a real dashboard of sixteen indicators actually contain?

Vindhya Commercial Bank Limited runs sixteen key risk indicators, and every number attached to them is that bank's own. Its own record counts them and does not number them, so the numbering K1 to K16 below is added here to give every row an identifier that can be cited without anybody writing a bare number. Month 12 is this bank's reporting date. At month 12 the sixteen stand at 9 green, 5 amberA status meaning attention is required and no limit has been breached, whose usefulness depends entirely on where the level was set. and 2 red, and 9 plus 5 plus 2 is 16.

Two of those figures are locked by the bank's own record and the rest is assignment. The record fixes the sixteen, fixes 9 green, 5 amber and 2 red, and fixes which two are red, and it fixes nothing else. So the colours shown against K3 to K11 below are an allocation against the bank's locked totals and its own trigger levels, rather than the bank's own record. Every one of the sixteen rows, and every number in them, belongs to the invented bank.

Read the rows on their own and nothing jumps out. Two things are red, five need attention, nine are fine, and a committee looking at that would conclude, quite reasonably, that most of the bank is in order and two concentrations need work. The finding is not in any row. The finding is in the arrangement.

What changes when the dashboard is sorted by type instead of by colour?

Sorting by colour gives a summary of health. Sorting by type gives a summary of foresight, and they are not the same summary at all. Here is what the second sort shows, and it is exact. Both reds, K1 and K2, are lagging counts: a sector concentration that has already crossed limit L3 and a depositor concentration that has already crossed limit L12. All five leading signals, K12 to K16, are green. Every amber, K3 to K7, is also a lagging count.

Say that back in plain words. Everything on this dashboard that is shouting is a record of something that has already gone wrong, and everything capable of moving first is silent. The type sort delivers a genuinely different message from the colour sort. Green on a leading signal is not bad news. Green on a signal is real good news and should be read as such. A committee told that two things are red and five things need attention has been told about the past in detail and about the next quarter not at all, and nothing on the dashboard distinguishes those two kinds of telling.

Can the most important thing on a dashboard be something that is not on it?

Yes, and this invented bank supplies the example. Three of its twelve limits are in live breach at month 12. Limit L3, sector concentration, is breach B1 and it appears as indicator K1. Limit L12, depositor concentration, is breach B4 and it appears as indicator K2. Limit L10, the wholesale funding share, is breach B3, standing at 22.6 per cent of total liabilities against a 20.0 per cent limit, and it appears nowhere among the sixteen indicators at all.

Nobody removed it, and the absence is the part worth sitting with. There was no meeting in which somebody argued for taking the wholesale funding share off the dashboard and won. The wholesale funding share was simply never chosen, at some point years ago, by people picking sixteen things out of a very long list of measurable things who had to stop somewhere. And because it was never chosen, it produces no colour, no trigger and no line of discussion, every single month, including the months in which it crossed its limit.

The absence does something to the reading. A committee looking at the dashboard sees two reds, both concentrations, and forms a picture: this bank has a concentration problem on the asset side and on the deposit side. The picture is not wrong. The picture is incomplete, and the incompleteness is invisible from inside the dashboard. The third concentration, on the funding side, is the one that is missing. Absence produces nothing to notice, so an indicator that is absent cannot be spotted by reading the dashboard, however carefully. The only route to it is to read the dashboard against something outside it: the breach log, the limit set, the register of risks. Reading the dashboard against the breach log takes ten minutes a quarter, and it is the single highest yield move anybody can make with a dashboard.

The household version is unpleasantly familiar. A household tracks its bank balance, its card outstanding and its loan instalment every month, all three chosen years ago, all three carefully watched. The household does not track how many months of the earner's notice period remain. Nobody ever put that on the list. Every month, the three tracked numbers are read and discussed. The untracked one goes to zero without producing a single conversation.

Where does an amber trigger come from, and how wide should the band be?

An indicator without a triggerThe level at which an indicator changes colour, set by the institution itself and in advance rather than in the meeting. is a number that moves. The trigger is what turns movement into a status, and it is worth being blunt about where it comes from. Nobody outside the institution sets it. It is not derived, it is not published anywhere, and no supervisor hands it over. The trigger is a decision the institution makes about itself, in advance, and writes down. Every trigger level below belongs to the invented Vindhya Commercial Bank Limited, and none of them is a requirement of any kind.

Take indicator K3, the net operational loss over a rolling twelve months. The bank's own limit L11 caps that at Rs 60.0 crore. The position at month 12 is Rs 43.8 crore, the year's thirteen incidents I1 to I13 netted down, and it stands at 73.0 per cent of the limit. Somewhere between zero and Rs 60.0 crore, somebody has to put an amber line. Where?

The two ends answer that faster than any principle. Put the amber at Rs 60.0 crore, being 100 per cent of the limit, and the indicator changes colour at exactly the moment the limit is gone. The colour change is not a warning but a breach report, and the breach log already carries the same fact. Put the amber at Rs 43.8 crore, being 73.0 per cent, and the indicator turns amber on the day it is switched on. Rs 43.8 crore is where the bank already is. The indicator has told nobody anything, and it will keep telling them nothing until the position moves. Both ends destroy the indicator, and they destroy it in opposite directions.

So the useful range for the amber on K3 runs from Rs 43.8 crore to Rs 60.0 crore. The range is Rs 16.2 crore wide, being 27.0 per cent of the limit. The distance between the amber and the limit is the bandThe distance between a warning level and the limit it warns about, which is the whole of the warning an indicator gives., and it is not a detail of the design, it is the design. Set the band at zero and there is no warning. Set it so wide that the amber sits below today's position and there is no warning either, only a permanent colour. The width of the band is the whole of the warning, measured in whatever the indicator is measured in.

The everyday version is the fuel gauge. A car whose warning light comes on when the tank is empty has a light and no warning. A car whose light is on permanently because it was wired to come on at three quarters full has a light and no warning either, and after a week the driver stops seeing it. The useful setting leaves enough distance to reach a fuel station. How much distance that is depends on where the car is driven, and that is a decision about the driver rather than about the car.

How many of the year's incidents did the dashboard actually warn about?

Are the two thirds on the dashboard and the two thirds in the year the same fact?

No, and the closeness is a trap rather than a clue. Two figures in this guide sit 0.4 percentage points apart. Eleven of sixteen indicators being lagging is 68.8 per cent, and nine of thirteen incidents arriving unheralded is 69.2 per cent, and they are different objects with no arithmetic connecting them at all.

The first counts rows on a dashboard. Its denominator is sixteen, it is a fact about how somebody designed a dashboard, and it would be exactly the same figure in a year with no incidents in it. The second counts events in twelve months. Its denominator is thirteen, it is a fact about what happened, and it would move if a single incident had landed differently. Change one and the other does not budge. There is no formula that takes 68.8 per cent and produces 69.2 per cent, and if the bank had run 17 indicators with 12 lagging, the first figure would be 70.6 per cent while the second stayed exactly where it is.

Why labour a coincidence? Because a sentence that puts them side by side without naming both objects invents a relationship that is not there, and it is a very tempting sentence to write. Something like: the dashboard is two thirds backward looking, and that is why two thirds of incidents came as a surprise. The sentence reads beautifully. The sentence is also causal-sounding, memorable and false. The second figure would be roughly what it is even if the composition were different, and the first would be what it is even in a year when nothing happened. A near coincidence is more dangerous than a distant one. Nobody merges a distant one.

What is the cheapest leading signal available, and why did this bank waste it?

A near miss. A near miss carries almost the same information as a loss, it costs nothing to collect because somebody has already noticed it, and it arrives before the money goes. A near miss is the cheapest leading signal any institution has, and this invented bank collected two of them and used neither.

Near miss N3, in month 6: a data quality check caught the collateral valuation feed stale for 2 working days. The check worked exactly as designed. The staleness was found, and nobody raised it as an issue. In month 10 the same feed went stale for 11 working days and 340 loans were wrongly marked, and that is incident I10, at a net loss of Rs 1.4 crore. Near miss N4, in month 7: a checker refused a trade finance document set carrying the same forgery pattern that runs through incident I13. The refusal was correct. The refusal was recorded as routine and never linked to anything. One month later, in month 8, I13 was discovered, at a net loss of Rs 15.4 crore, the largest of the year.

The obvious reading of those two stories is the wrong one. Both controls worked. Both people did their jobs correctly. The data quality check found the stale feed. The checker refused the forged documents. Nothing in either story is a failure of attention, diligence or skill, and any account of it that lands on a person has misread it. No route existed: no mechanism connected a routine refusal to anything that could look at it twice, and no mechanism turned a caught data staleness into an entry that somebody had to close. The failure is a design failure, and it sits in the absence of a route rather than in anybody's work.

Notice what this does to indicator K10, near misses recorded, sitting green on the dashboard. As a count of near misses recorded, K10 is a lagging count and a perfectly honest one: it moves when a near miss has already been logged. The leading signal is not in the count at all. The leading signal is in the linking, and linking is the step this bank never built. Recording a near miss is a count; connecting it to what it resembles is a signal, and only the first of those was ever on the dashboard.

Every household has its own version of this. The car makes an unfamiliar noise on a Tuesday and stops making it on Wednesday, so nobody mentions it again. A month later the same part fails on a highway. Nobody was careless on the Tuesday: they heard it, they registered it, and there was no place to put it.

Is an indicator the same thing as a warning?

An indicator is not a warning, and the difference is one sentence long. The same invented bank runs a second set of measures entirely: seven early warning indicators, numbered W1 to W7, sitting in its liquidity material. Each one of the seven carries a defined action against a defined trigger. Crossing it starts something without anybody having to decide whether it should. The sixteen indicators K1 to K16 do something different. The sixteen report a position to a committee.

An indicator with no action attached is a measurement, not a warning, and this bank has sixteen of the first and seven of the second. That is not a criticism of either set. Reporting a position to a committee is a real job and a dashboard that does it well is worth having. The distinction is only a statement about what each object can do. A measurement informs a decision that somebody still has to take. A warning is a decision already taken, in advance, in a calmer room, and stored against a level so that the crossing releases it. The whole of the difference is whether anything happens on its own when the line is crossed.

How the seven are triggered, what actions hang off each of them, and where their levels sit is set out under early warning indicators and triggering action before the limit. Only the distinction belongs here. Two of the seven are triggered at this bank's month 12, W4 red and W7 amber, and what follows from each of those belongs under triggering action before the limit.

Everyday version. A smoke alarm and a thermometer both measure the same physical thing. The thermometer reports the temperature, accurately, whenever anybody looks at it. The alarm has a level written into it and a siren wired to that level, so it acts whether or not anybody is looking. Nobody thinks the thermometer is broken. A thermometer is simply not the object fitted in a corridor.

What does one measurement sitting on both lists prove?

The invented bank supplies the cleanest possible demonstration, and it does it by accident. The certificate of deposit roll rate, meaning the share of certificates rolled at each auction, is one of the sixteen indicators, sitting as K16 and green. The same measurement is also early warning indicator W2, with amber below 90 per cent, red below 75, and an action attached to it. One measurement. One bank. Two lists.

The overlap is not a duplication and not an error in anybody's record. Look at what is actually identical and what is not. The definition is identical. The source is identical. The number on any given day is identical. As indicator K16 it reports a position to a committee and nothing follows from it, and as early warning indicator W2 it carries levels with an action against them, so crossing it starts something. The measurement was never the difference between the two objects, and this overlap is the proof, because here the measurement is held constant and the two objects are still different.

Which gives the fastest test anybody can run on their own institution's dashboard. For any row, the question is what happens, automatically, on the day it changes colour. If the honest answer is that it gets discussed at the next meeting, the row is a measurement. If the honest answer names an action and the person who starts it, the row is a warning. Most rows on most dashboards answer the first way, and there is nothing wrong with that as long as nobody is under the impression that the dashboard is protecting them.

Who actually picks up a dashboard, and what do they do with it?

Four readers, four different uses, and none of them is re-checking the arithmetic.

The chief risk officer, Sunanda Ravikumar in this invented bank, reads it for composition before she reads it for colour. She is not going to recompute any of the sixteen. In one minute she can count how many rows could move before a loss, and this month the answer is five. The single most useful question anybody can ask of a dashboard is how many of these rows are capable of telling me something I do not already know. The second most useful is the absence question: which live breach has no indicator at all?

An analyst at another institution, looking at this bank from the outside as a counterparty rather than from inside it, reads it for what the choice of rows reveals. Sixteen indicators with eleven counts is a description of what the bank believes it can control and what it has settled for observing. The composition changes which questions are worth asking on a call, and none of those questions is about the colours. The useful one is: what would have had to move, and when, for this dashboard to have flagged the bank's largest loss of the year?

The operational risk head, Purnima Ganeshan here, reads it for the one row that is about to become a problem and is currently amber. Amber is where all of the useful information sits, precisely because red means the argument is over. Indicator K3 at Rs 43.8 crore of Rs 60.0 crore, and indicator K4 at 31 open issues past their date out of 92, are the two rows where the next month's work is actually decided, and neither is red.

A lender or an investor reading a published risk section cannot see the sixteen rows at all, so the same task is harder. Either of them can still apply the type test to whatever measures are disclosed. A section that reports losses, breaches and complaints has told them what happened. A section that reports staff turnover in the units taking risk, the age of unresolved access rights, or the share of transactions going round the automated route has told them something about what might happen next. Reading a disclosure by type rather than by tone is a five minute skill that survives every change of format.

And the household version takes an evening and is worth it. A person writes down the five or six things they actually watch about their own money, and marks against each whether it moves before the problem or after it. Most people find that all of them move after: the balance falling, the card outstanding rising, the instalment bouncing. The next step is to work out what would have moved first in each case, and write that down as well. The first mover will be something like the employer paying salaries three days late, or the number of months of expenses in reserve, or an insurance renewal drifting past its date. The exercise turns up no new fact, only how much notice had been bought, and for most people that proves to be none.

Which questions belong elsewhere?