Glossary term
Key Control Indicators (KCIs)
Subject: Risk Management, Risk Assessment and Quantification
Also known as: KCI, Key control indicator, Control effectiveness metrics
Key control indicators are metrics that show whether important controls are operating as intended, for example the share of reconciliations done on time or access reviews completed.
Explanation
A control that exists on paper may not work in practice. KCIs give regular, measurable evidence of how it is performing. Typical measures include the percentage of approvals made within policy, the number of overdue control tests, system patches applied within deadline, or the rate of failed reconciliations. Each has a threshold, and breaches go to the control owner and the risk function. KCIs sit between control testing, which happens periodically, and risk indicators, which look at risk exposure. A well-chosen KCI can be pulled from system data without manual effort. A weak one measures activity (training sessions held) instead of effect. Together with KRIs, they feed management reports and the risk and control self-assessment. Risk teams read them to spot a control that is quietly decaying well before it produces a loss.
Example
A utility requires two approvers for supplier payments above a set limit. Its KCI is the percentage of such payments with two recorded approvers, with a target of 100%. One month the figure drops to 96% after a system change. The control owner investigates and the gap is closed within the week.
Not to be confused with
- Key Risk Indicators
- KRIs signal rising exposure to a risk. KCIs show whether a control meant to contain that risk is working.