According to the CRISC Review Manual (Digital Version), key risk indicator (KRI) thresholds are the most likely elements of a risk register to change as a result of change in management’s risk appetite, as they reflect the acceptable levels of risk exposure for the organization. KRIthresholds are the values or ranges that trigger an alert or a response when the actual KRI values deviate from the expected or desired values. KRI thresholds help to:
Monitor and measure the current risk levels and performance of the IT assets and processes
Identify and report any risk issues or incidents that may require attention or action
Evaluate the effectiveness and efficiency of the risk response actions and controls
Align the risk management activities and decisions with the organization’s risk appetite and risk tolerance
If the management’s risk appetite changes, the KRI thresholds may need to be adjusted accordingly to ensure that the risk register reflects the current risk preferences and expectations of the organization.
References = CRISC Review Manual (Digital Version), Chapter 4: IT Risk Monitoring and Reporting, Section 4.1: IT Risk Monitoring, pp. 217-2181
