KPIs and KRIs: a practical guide from strategy to monthly review

A few years ago I sat in a review where the management pack had 64 KPIs in it. Sixty four. Most of them were green, a few were red, and nobody in the room could say which ones actually mattered to the strategy the board had signed off six months earlier. The red ones had been red for a while. Everyone had stopped looking at them.

That meeting is the reason I wrote this. Not because KPIs are hard to understand, but because most companies get the idea right and the practice wrong. This is the practical version: what KPIs and KRIs are, how a strategy turns into a short list of them, and how to keep them honest month after month.

I have also built a free Excel toolkit that follows every step below, with a worked example. You can download it here.

KPIs and KRIs in plain words

A KPI (key performance indicator) tells you if you are getting where you said you would go. Revenue growth, gross margin, customer repeat rate, on-time delivery.

A KRI (key risk indicator) warns you early that something could stop you getting there. Overdue receivables climbing, too much spend with one supplier, security patches piling up, key jobs sitting empty.

The easiest way I have found to explain the difference:

• A KPI looks at the road ahead and asks "are we on track?"
• A KRI looks at the dashboard lights and asks "is something about to go wrong?"

	KPI	KRI
Question it answers	Are we achieving the objective?	Is a risk to the objective getting bigger?
Linked to	A strategic or department objective	A risk on the risk register, which threatens an objective
Good result	Hitting or beating the target	Staying inside risk appetite
Limits you set	Target and lowest acceptable result	Appetite and tolerance
Who usually owns it	The business owner of the objective	The risk owner, with risk or compliance watching
Example	Online share of sales 20%	Receivables over 90 days below 5%

The same number can be a KPI in one company and a KRI in another. Staff turnover is a KPI for an HR team trying to keep people. It is a KRI for a business that depends on a handful of specialists. What makes it one or the other is the question you are using it to answer.

Leading and lagging

You will hear these two words a lot.

• Lagging measures tell you what already happened. Revenue, profit, turnover for the year. They are accurate but late.
• Leading measures move before the result does. Repeat customer rate moves before revenue. Training completion moves before error rates. Overdue patches move before a breach.

A good set has both. If every measure you have is lagging, you will always find out after the damage is done. Most KRIs should be leading. That is the whole point of them.

What a good KPI or KRI looks like

Before getting into the cascade, it helps to know what "good" looks like for one single measure. Every KPI and KRI should have a short definition card. If you cannot fill in every line, the measure is not ready.

• Name: short and clear. "Repeat customer rate", not "Customer engagement index v2".
• How it is calculated: the actual formula. "Customers who bought again within 90 days divided by all customers in the period."
• Linked objective: which department objective it serves, and through that, which company objective.
• Data source: the system or report the number comes from.
• Owner: one named person. Not a team, not a committee.
• How often: weekly, monthly or quarterly.
• Better when: higher or lower.
• Limits: for a KPI, the target (green) and the lowest result you can live with (amber). For a KRI, the risk appetite (green) and the tolerance (amber). Anything past amber is red.
• Baseline: where you are today, so the target means something.

The formula line is where most problems start. I have seen two departments report "customer retention" with numbers 15 points apart, both correct, because one counted customers and the other counted revenue. Write it down once and make everyone use that definition.

How strategy turns into KPIs and KRIs

This is the part people call "cascading". It just means each level of the company can see how its work connects to the level above. Here is how I would do it, step by step. I will use a made-up retail chain as the example, the same one that is in the toolkit.

Step 1: Start from a small number of company objectives

Take the strategy the board approved and pull out the few things the company is really trying to achieve. Three to six is plenty. If you have twelve, you do not have a strategy, you have a wish list.

For our retail chain:

1. Grow revenue by 15% a year
2. Customers come back more often
3. Make more profit from every sale
4. Keep good people
5. Grow without a major compliance or cyber incident

Each one needs a target for the end of the strategy period. "Net margin up from 5% to 8% by 2028" is something you can measure. "Be more efficient" is not.

Step 2: Ask two questions for each objective

For every company objective, ask:

• How will we know we are getting there? The answers become KPI candidates.
• What could stop us? The answers point you to risks, and the early signs of those risks become KRI candidates.

The second question is where you should pull in the risk register. If your company has done any enterprise risk work (COSO ERM and ISO 31000 both push for this), the risks are often already written down. They just were never connected to the strategy. This step connects them.

For "Make more profit from every sale", the "how will we know" answers might be gross margin and inventory days. The "what could stop us" answers might be customers paying late (cash gets tight) and depending too much on one supplier (they can raise prices on you).

Step 3: Cascade to departments, one owner each

Now break each company objective into what each department has to do for it. Every department objective gets one owner.

Company objective	Department	Department objective	Owner
Grow revenue 15% a year	Sales and e-commerce	Grow online to 25% of sales by 2028	Head of E-commerce
Customers come back more	Marketing and service	More customers buy again within 90 days	Head of Marketing
More profit per sale	Supply chain	Right stock on the shelf, less cash tied up	Head of Supply Chain
More profit per sale	Finance	Protect gross margin and cash	CFO
Keep good people	HR	Hire well and keep staff longer	HR Director
No major incident	IT	Keep systems and customer data safe	Head of IT
No major incident	Risk and compliance	Close control gaps on time	Chief Risk Officer

Two things to watch here. First, one company objective can sit with several departments, and that is fine. Second, every department objective must trace back up. If a department has an objective that connects to nothing above it, either the strategy is missing something or the department is working on the wrong thing. Both are worth a conversation.

Step 4: Pick the measures for each department objective

Now attach KPIs and KRIs to each department objective. One or two KPIs and one or two KRIs per objective is usually enough.

Department objective	KPI	KRI
Grow online share	Online share of sales
Customers buy again	Repeat customer rate, NPS
Right stock, less cash tied up	Shelf availability, inventory days	Share of purchases from top supplier
Protect margin and cash	Gross margin	Receivables over 90 days, months of cash cover
Keep staff longer	Staff turnover	Key roles vacant over 60 days
Keep systems safe		Critical patches overdue, phishing test click rate
Close control gaps on time		Audit actions past due date

Notice that some objectives only have KRIs. That is normal. "Keep systems safe" is mostly about stopping bad things, so it is measured by risk signals rather than performance.

Then do the reverse check. Every measure on your list should point to an objective. If you find a KPI that does not, ask why you are tracking it. Sometimes there is a good reason (a regulator wants it). Often it is just a number someone started reporting in 2019 and nobody stopped.

The toolkit does this check for you. Any department objective with no measure linked to it shows "No measure" in red, and any KPI or KRI that points to an objective that does not exist shows "Check objective".

Step 5: Set targets and limits

For KPIs, set two numbers:

• Target (green): where you want to be this year. Make it a step towards the end-of-strategy target, not the whole jump at once.
• Lowest acceptable (amber): below target, but not a crisis. Below this is red.

For KRIs, the words change but the idea is the same:

• Appetite (green limit): the level of risk the company is comfortable with.
• Tolerance (amber limit): the most it will accept before someone has to act. Past this is red.

Risk appetite should come from the board, not from the person who owns the KRI. If the CFO sets the limit for the CFO's own KRI, you will find the limit is always just above the current number. That is human nature, not dishonesty, but it defeats the purpose.

Also decide, in advance, what happens when a KRI goes red. Who gets told, and what they do. "Stop new credit to the top ten overdue accounts and review collections weekly" is an action. "Monitor closely" is not.

Step 6: Test the data once before you rely on it

This is the auditor in me. Before a measure goes into the monthly pack, pick one month and rebuild the number yourself from the source. Does the report actually calculate what the definition says? Is anything filtered out? Does the data come from a system, or from a spreadsheet someone fixes by hand every month?

You only need to do this properly once per measure, then again if the source or the formula changes. It saves a lot of awkward meetings later.

Monitoring: the rhythm that keeps it alive

Setting KPIs and KRIs is a project. Monitoring them is a habit, and the habit is where most companies fall off. The trick is to match the rhythm to the level.

Who	How often	What they look at
Team leads and managers	Weekly	Their own operational measures, mostly leading ones
Department heads	Monthly	Their KPIs and KRIs, with comments and actions
Executive committee	Monthly	The company-level set, only what is amber or red in detail
Board or Audit and Risk Committee	Quarterly	Strategic KPIs, every KRI past tolerance, and any changes to targets or limits
Board and leadership	Once a year	Whether the measures still fit the strategy

How to run the monthly review

I have sat through a lot of these. The good ones all work roughly the same way:

1. Start with what is red, then amber. Do not walk through every green line. The dashboard in the toolkit lists only the amber and red items for exactly this reason.
2. For each one, the owner answers three questions. What happened? What are we doing about it? When will it be back to green?
3. Write the action down with a name and a date. Next month, start by checking last month's actions.
4. Look at the trend, not only the colour. An amber that has worsened three months in a row needs more attention than a red that is clearly recovering.

Keep the comments short and specific. "Two large accounts are behind. Credit stopped on 4 July. CFO reviewing weekly." is useful. "Team is working on it" tells you nothing.

Adjusting: when to change a target, and when not to

Strategies change, markets change, and some measures turn out to be badly chosen. So you will need to adjust. The risk is adjusting for the wrong reasons.

Good reasons to change a target or limit:

• The strategy itself changed (new market, acquisition, a product line closed).
• Something outside your control changed the ground, like a new regulation or a big shift in the market.
• You set the first target with no real baseline and now you have data.
• You are beating the target easily, and have been for several months. Raise it.

Bad reasons:

• The number is red and the quarter-end pack is due tomorrow.
• The owner does not like how it looks.
• "It was always going to be hard."

Signs a measure itself is broken, not just the target:

• Always green. Either the target is too easy or the measure does not test anything.
• Always red and nothing happens. People have stopped believing it. Fix it or drop it.
• Gamed. When a number becomes a target, people find ways to hit the number without improving the thing behind it. Economists call this Goodhart's law. If call centre staff are measured on call length, calls get shorter, and customers call back. Pair measures to stop this, for example call length with first-call resolution.
• Nobody acts on it. If a measure has never once changed a decision, it is decoration.

Whatever you change, write it down: what changed, the old and new value, why, and who approved it. The toolkit has a review log sheet for this. When an auditor or a board member asks why a target dropped from 6% to 4% in May, you want the answer on one line, not in someone's inbox.

Why this matters for the organisation

It is easy to treat all this as reporting admin. It is not. When it works, a few things change:

• Everyone can see how their work connects to the strategy. A store manager who knows why repeat customer rate matters makes different choices from one who just sees a number.
• Problems surface early. KRIs exist so the board hears "receivables over 90 days have doubled since March", not "we have a cash problem".
• Meetings get shorter and more useful. Talking about four reds is a better use of an hour than reading through sixty greens.
• Accountability is clear. One owner per measure means there is always someone to ask.
• Resources follow the strategy. When a KPI is off track and linked to a real objective, it is much easier to argue for budget or people to fix it.
• Governance and audit get easier. Boards, regulators and auditors increasingly expect to see risk connected to strategy. A clean cascade with a change log is exactly that evidence.

Common mistakes I keep seeing

• Too many measures. 10 to 15 KPIs and 8 to 12 KRIs at company level is plenty. Departments can keep longer lists for themselves.
• Measuring what is easy, not what matters. The data that is easiest to get is rarely the most useful.
• No owner, or a shared owner. "Finance and Operations" owns nothing.
• KRIs that are just KPIs turned upside down. "Revenue below target" is not a KRI. It is a missed KPI. A KRI should move before the damage, not report it.
• Targets set once and never looked at again.
• Definitions that drift. Someone changes the report filter, the number jumps, and nobody notices for a quarter.
• No link to the risk register. KRIs invented in a workshop with no connection to the risks the company has already identified.

What internal audit looks at

If your audit team reviews this area (and it should, every couple of years), these are the things I would check:

• Does every company-level KPI and KRI trace back to an approved objective or a recorded risk?
• Does each measure have a written definition, a source and one owner?
• Can we rebuild a sample of reported numbers from the source data?
• Were KRI limits set or approved by the board or a committee, not by the owner alone?
• When a KRI went past tolerance, did the agreed action actually happen?
• Is every change to a target or limit logged and approved?

If you can answer yes to all six, you are ahead of most organisations I have seen.

The right tools for each stage

You do not need expensive software to start. Plenty of companies run this well on a spreadsheet for years. Here is how I would think about it.

Stage	Start with	Move up to when you outgrow it
Strategy map and cascade	Excel or Google Sheets (the toolkit has a Strategy and a Cascade sheet), or a simple diagram in PowerPoint or Miro	Strategy software such as ClearPoint Strategy, Cascade or Spider Impact
KPI and KRI register	Excel or Google Sheets	The KPI module of your strategy tool, or the risk module of a GRC platform
Collecting the monthly numbers	One shared sheet, owners fill in their own row	Pull directly from source systems (ERP, CRM, HR system) into a data model
Dashboards	The dashboard sheet in the toolkit	Power BI, Tableau or Looker Studio
KRIs, risk appetite and escalation	Excel with clear limits and actions	GRC platforms such as ServiceNow IRM, Archer, MetricStream, AuditBoard or LogicGate
Sharing and reminders	SharePoint or Google Drive with one master file, and a monthly calendar reminder	Power BI app or Teams channel for the pack, Power Automate or similar for reminders to owners
Change log and evidence	The review log sheet in the toolkit	The audit trail built into your GRC or strategy tool

A few practical points on tools:

• One master file, not twenty copies. The fastest way to break this process is everyone emailing their own version.
• Move to Power BI or Tableau when the data collection hurts, not before. If owners are copying numbers out of a system into the sheet every month, that is the sign to connect the system directly.
• Buy GRC software for the workflow, not the dashboard. What you pay for is escalation, approvals, reminders and an audit trail. Most of these tools look similar on a demo. Ask how they handle a KRI breach from start to finish.
• Check pricing and fit yourself. Every tool on this list is used by serious companies. Which one is right depends on your size, your systems and what you already pay for.

Get the free toolkit

The Strategy to KPI and KRI toolkit is an Excel file that follows this guide from top to bottom. Everything in it is linked: measure to department objective to company objective, and every action to the measure it is meant to fix.

• Setup: company name, departments and heads, and the reporting month. Change the month and the whole file moves with it.
• Strategy and Cascade: company objectives broken into department objectives, each with a health score that rolls up from its measures, and a check that flags anything not linked or not measured.
• Measures: one register for KPIs and KRIs, with the full definition card for each. It warns you about duplicate IDs, missing limits and limits set the wrong way round.
• Tracker: type each month's result and it works out green, amber or red, and whether the measure is getting better or worse.
• Dashboard: headline numbers, every strategic objective and every department rated On track, Watch or Off track, month-by-month charts, and a list of only what needs attention, reds first.
• Department view: pick a department and see just its objectives, measures, 12 months of history and open actions. Good for each head's own monthly meeting.
• Actions, Heatmap and Review log: actions with due dates and overdue flags, every measure across every month in one grid, and a record of every change to a target or limit.

It comes filled in with the retail example from this article, January to September, so you can see how it works before you overwrite it with your own.

A short checklist to finish

• 3 to 6 company objectives, each with a measurable end target
• Every objective broken into department objectives with one owner
• Each department objective has at least one KPI or KRI
• Every measure has a definition, source, owner, frequency and limits
• KRI appetite and tolerance approved by the board or a committee
• An agreed action for every KRI that goes red
• A monthly review that starts with the reds
• A log of every change, with the reason and who approved it

If you try this in your own organisation and something does not fit, I would like to hear about it. You can reach me through the contact page.