Performance Risk and Control Metrics are quantifiable measures used to assess how effectively and efficiently risk responses and control activities execute over time. They answer two distinct questions: (1) Are controls designed to address the right risk? — control design effectiveness. (2) Are controls being executed consistently and correctly? — control operational effectiveness. The metric set combines Key Performance Indicators (KPIs), which measure control execution quality, with Key Risk Indicators (KRIs), which measure residual risk outcomes. Leading indicators signal future control health (e.g., MFA enrollment rate, training completion rate); lagging indicators confirm past outcomes (e.g., unauthorized access incidents, audit findings). Together, these metrics form a closed-loop measurement system that connects risk treatment decisions to measurable business outcomes.
Where it stops · what it isn't
- —IS: Quantifiable measures of control execution quality and risk outcome levels — including KPIs, KRIs, leading and lagging indicators, control exception rates, and remediation cycle times.
- —IS: Both design effectiveness metrics (does the control address the right risk?) and operational effectiveness metrics (is the control executed consistently and correctly?).
- —IS NOT: A risk register or risk assessment — those identify and score risks; performance metrics measure the ongoing health of controls managing those risks.
- —IS NOT: Synonymous with audit findings — audit findings are discrete, point-in-time observations; performance metrics are continuous or recurring measures tracked over time.
- —IS NOT: Generic IT operational metrics (e.g., system uptime, CPU utilization) unless explicitly linked to a defined control objective and risk outcome.
- —IS NOT: A compliance checklist — compliance confirms a control exists; performance metrics confirm the control is working.
Connected concepts in the graph
Every cubelet sits in a knowledge graph. Here's what this one connects to.
REQUIRESControl Design, Selection, and AnalysisControl Implementation, Testing, and EffectivenessRisk and Control Monitoring and Reporting
PART OFRisk Response and Reporting (CRISC Domain 3)
ENABLESRisk Treatment Plan Review and Continuous ImprovementExecutive Risk Reporting and Audit Committee Communication
RELATED TOKey Risk Indicators (KRI) Design and Management
CONSTRAINSGRC Platform Configuration and Dashboard Design