Key Performance Indicators and Key Risk Indicators

1. Why This Topic Matters

An anti-financial crime (AFC) program is only as strong as the organisation's ability to know whether it is actually working. Regulators, boards, and auditors increasingly expect compliance functions to move beyond anecdotal assurance (we have policies and we train people) toward evidence-based oversight (here is measurable proof that controls operate effectively and that risk remains within appetite). Key Performance Indicators (KPIs) and Key Risk Indicators (KRIs) are the primary tools that make this possible.

For the CAMS exam, this topic sits inside the domain of AFC Program Governance and Risk Management. It connects directly to several other heavily tested concepts: the risk-based approach, the enterprise-wide risk assessment, board and senior management oversight, the three lines of defence, independent testing, and management information (MI) reporting. Questions in this area test whether you understand that metrics are not an administrative exercise but a governance mechanism that allows the board to discharge its oversight duty and allows the compliance officer to demonstrate program effectiveness.

In practice, poorly designed metrics are a recurring finding in enforcement actions. Supervisors have criticised institutions for reporting volumes without context, for having no escalation thresholds, for failing to act when indicators breached limits, and for reporting metrics that measured activity rather than outcomes. Understanding this topic therefore has real-world as well as exam value.

2. What KPIs and KRIs Are

Key Performance Indicators (KPIs) measure how well the AFC program, or a component of it, is performing against its objectives. They answer the question: Are we doing what we set out to do, to the standard we expected? KPIs tend to be about efficiency, timeliness, quality, and completeness of control execution.

Key Risk Indicators (KRIs) measure the level of financial crime risk the institution is exposed to and how that exposure is changing. They answer the question: Is our risk profile moving, and is it still within our risk appetite? KRIs tend to be forward-looking signals that risk is building, so that management can intervene before a control failure or regulatory breach occurs.

A simple way to remember the difference:
- KPIs look at how the program is performing (control effectiveness and efficiency).
- KRIs look at how much risk the business is carrying (exposure and emerging threats).

Some indicators can serve both purposes depending on how they are framed. For example, a growing backlog of unreviewed transaction monitoring alerts is a performance failure (KPI) and simultaneously a risk indicator, because unreviewed alerts mean suspicious activity may be going unreported (KRI). The exam may test your ability to see this overlap rather than treat the two categories as rigidly separate.

Typical AFC KPIs include:
- Percentage of transaction monitoring alerts reviewed within the target service level (e.g., within 30 days).
- Average time from alert generation to case closure or SAR/STR filing.
- Percentage of SARs/STRs filed within the statutory deadline.
- Percentage of required staff who completed mandatory AML training on time.
- Percentage of customer due diligence (CDD) files that are complete and current according to the periodic review schedule.
- Percentage of sanctions screening hits dispositioned within the required timeframe.
- Number and age of open audit or regulatory findings and percentage remediated by the agreed date.
- Quality assurance pass rates on sampled alert dispositions or KYC files.

Typical AFC KRIs include:
- Number or proportion of customers rated high risk, and the trend over time.
- Growth in exposure to high-risk jurisdictions, products, or customer types (e.g., money services businesses, politically exposed persons, correspondent banking relationships).
- Volume of alerts generated relative to transaction volume, and unexplained spikes or drops in alert volumes.
- Number of overdue periodic reviews for high-risk customers.
- Number of sanctions screening system outages, missed screening batches, or list update delays.
- Number of regulatory requests, subpoenas, law enforcement inquiries, or negative media events.
- Staff turnover or vacancy rates in the financial crime compliance team.
- Number of transactions processed through a product or channel that was identified as high risk in the enterprise-wide risk assessment.
- Percentage of SARs filed that relate to customers who were onboarded within the last twelve months (potentially indicating onboarding control weaknesses).

Leading versus lagging indicators. A lagging indicator reports what has already happened (number of SARs filed last quarter). A leading indicator signals what is likely to happen (rising alert backlog predicts late SAR filings). Strong programs use a mix, but the governance value of KRIs comes mainly from leading indicators that give management time to act.

3. How KPIs and KRIs Work in Practice

Step 1: Derive indicators from the risk assessment and program objectives. Indicators should not be chosen because the data happens to be available. They should flow from the enterprise-wide AML/CFT risk assessment (which identifies where inherent risk is highest and which controls matter most) and from the stated objectives of the AFC program. If the risk assessment identifies correspondent banking as the highest-risk business line, there should be KRIs tracking that exposure and KPIs tracking the controls that mitigate it.

Step 2: Define each indicator precisely. Good indicators share recognised characteristics, often summarised as SMART: Specific, Measurable, Achievable, Relevant, and Time-bound. Each indicator should have a written definition, a data source, a calculation method, an owner, and a reporting frequency. Ambiguity in definition leads to inconsistent reporting and makes trend analysis meaningless.

Step 3: Set thresholds, tolerances, and escalation triggers. This is the step most often tested and most often done badly in real life. An indicator without a threshold is just a statistic. The institution should define, in line with its risk appetite statement, the acceptable range for each indicator. A common approach is a Red-Amber-Green (RAG) scheme: green is within tolerance, amber is a warning zone requiring management attention, red is a breach requiring escalation and remediation. Thresholds should be approved by appropriate governance bodies and documented, so that a breach triggers a predictable response rather than a debate.

Step 4: Collect, validate, and aggregate data. Data typically comes from transaction monitoring systems, case management tools, KYC platforms, sanctions screening systems, HR systems (for training), and issue-tracking tools. Data quality controls are essential; a metric built on incomplete or inaccurate data can create false assurance, which is arguably worse than no metric at all. The second line of defence usually owns the aggregation and interpretation, while the first line often owns the underlying data.

Step 5: Report to the right audience at the right level. Reporting should be tiered. Operational teams need granular daily or weekly metrics. The compliance officer and senior management need monthly or quarterly dashboards with trends and commentary. The board or board risk committee needs a concise view focused on indicators that breached or are approaching appetite, together with the actions being taken. Reports should include trend analysis over multiple periods, commentary explaining movements, and clear identification of items requiring a decision. Raw numbers without interpretation do not meet regulatory expectations for effective oversight.

Step 6: Act on the indicators and close the loop. When an indicator breaches a threshold, there must be a documented response: root cause analysis, remediation plan, owner, and target date. Metrics that are reported but never acted upon are a governance failure. The results of KPI and KRI monitoring should also feed back into the next risk assessment, into the design of controls, into resourcing decisions, and into the independent testing plan.

Step 7: Periodically review the indicators themselves. Business models, products, regulations, and typologies change. Indicators that were relevant two years ago may no longer capture the main risks. The indicator set should be reviewed at least annually, and whenever the risk assessment is updated, to retire indicators that no longer add value and add new ones for emerging risks.

4. The Governance Context

KPIs and KRIs are the connective tissue between day-to-day AFC operations and board-level accountability. The board of directors is ultimately responsible for approving the AFC program and ensuring it is effective, but directors cannot review individual alerts or customer files. Metrics give them a basis on which to challenge management, allocate resources, and satisfy themselves that the program is operating as intended.

Within the three lines of defence, the first line (business units) generates much of the underlying data and owns many operational KPIs (for example, completeness of onboarding documentation). The second line (compliance and risk) designs the indicator framework, sets or recommends thresholds, aggregates and interprets results, and escalates breaches. The third line (internal audit) independently tests whether the indicators are accurate, whether thresholds are appropriate, and whether management actually responds to breaches.

Metrics also support the culture of compliance. When senior management visibly reviews and acts on AFC metrics, it signals that financial crime risk is taken seriously. Conversely, when metrics are tolerated in red status for extended periods without consequence, it signals the opposite.

5. Common Pitfalls

- Measuring activity instead of outcomes. Reporting that 10,000 alerts were generated says nothing about whether the right alerts were generated or whether they were handled well. Pair volume metrics with quality and timeliness metrics.
- No thresholds or no escalation. Without a defined tolerance and a defined response, the indicator cannot drive action.
- Too many indicators. A dashboard with 150 metrics obscures what matters. The word key is deliberate; focus on the few indicators that genuinely reflect program health and risk exposure.
- Static indicators. Failing to update the indicator set as risks evolve.
- Poor data quality. Metrics derived from unreliable data give false assurance.
- Reporting without commentary. Numbers without explanation of trends, causes, and actions do not enable effective oversight.
- Interpreting changes naively. A sharp drop in alert volumes is not automatically good news; it may indicate a system failure, a scenario that was switched off, or thresholds set too high. A sharp drop in SAR filings may indicate under-reporting rather than reduced criminal activity. The exam frequently tests this kind of counterintuitive interpretation.

6. How to Answer Exam Questions on KPIs and KRIs

CAMS questions in this area are typically scenario-based. You may be given a description of a compliance program, a set of metrics, a dashboard, or a board report, and asked what the most significant concern is, what the compliance officer should do next, what should be reported to the board, or which indicator best measures a given risk. The following approach will help.

Identify what the question is really asking. Is it asking you to distinguish a KPI from a KRI? To spot a design weakness (no threshold, wrong owner, wrong audience)? To interpret a trend? To choose the appropriate escalation? Read the final sentence of the question first, then read the scenario with that purpose in mind.

Anchor to governance principles. The correct answer will almost always align with these principles: indicators are derived from the risk assessment; thresholds reflect risk appetite; breaches are escalated and remediated; the board receives meaningful, trend-based information; indicators are reviewed periodically; and the compliance officer acts on what the metrics reveal rather than merely reporting them.

Prefer outcome and quality over volume. If answer options include a pure volume metric and a metric that captures timeliness, quality, or risk exposure relative to appetite, the latter is usually the better indicator.

Treat unexpected changes as something to investigate, not celebrate or panic about. If a scenario describes a sudden drop in alerts, SARs, or high-risk customers, the best response is typically to investigate the root cause (system change, data feed failure, scenario tuning, business change) before drawing conclusions.

Match the report to the audience. If the question involves board reporting, favour concise, trend-focused, exception-based information with commentary and proposed actions, not granular operational detail.

7. Exam Tips: Answering Questions on Key Performance Indicators and Key Risk Indicators

Tip 1: Know the definitions cold. KPI = measures program or control performance against objectives. KRI = measures the level and direction of risk exposure, ideally as an early warning. If a question asks which indicator would best alert management to increasing risk, look for a KRI (e.g., growth in high-risk customers or exposure to high-risk jurisdictions). If it asks which indicator best shows whether a control is operating effectively, look for a KPI (e.g., percentage of alerts cleared within SLA).

Tip 2: Link metrics to the risk assessment. When asked how indicators should be selected or why a particular indicator set is inadequate, the right answer usually references alignment with the institution's risk assessment and risk appetite. Indicators chosen because data is convenient, or copied from another institution without tailoring, are wrong approaches.

Tip 3: Look for the missing threshold. If a scenario describes metrics being reported but there is no mention of tolerances, triggers, or escalation, that absence is likely the key weakness the question wants you to identify.

Tip 4: Recognise the false-comfort trap. A metric that looks good on the surface may hide a problem. One hundred percent of alerts closed on time could mean analysts are closing alerts superficially to meet the deadline; check for a quality assurance metric. Zero SARs filed from a high-risk business line is a red flag, not a success. A decline in alert volume after a system change should prompt validation of the system.

Tip 5: Escalation follows the governance structure. When an indicator breaches a red threshold, the expected action is escalation to senior management and, where significant, to the board or its designated committee, with a remediation plan. Answers that suggest adjusting the threshold to make the indicator green, delaying reporting, or handling the matter informally are incorrect.

Tip 6: The compliance officer acts, not just reports. If a question asks what the AML compliance officer should do when metrics reveal a problem, the best answer typically involves investigating root cause, taking or recommending corrective action, and ensuring appropriate reporting, rather than simply noting the result in the next report.

Tip 7: Favour trend analysis and context. A single data point rarely tells the story. Answers that mention comparing against prior periods, against thresholds, and against expected business changes are stronger than answers that treat a number in isolation.

Tip 8: Remember the role of independent testing. Internal audit or an independent reviewer should validate that indicators are accurate, complete, and acted upon. If a question asks who should verify the integrity of the metric framework, the third line of defence is the usual answer, not the team that produces the metrics.

Tip 9: Watch for distractors that confuse quantity with quality. Options such as increase the number of metrics reported to the board or report all operational metrics to directors are typically distractors. Effective board reporting is selective and exception-focused.

Tip 10: Eliminate answers that are reactive, cosmetic, or that ignore the risk-based approach. Any option that proposes removing an inconvenient indicator, lowering standards to achieve a green rating, or applying identical thresholds to all business lines regardless of risk is almost certainly wrong.

8. Worked Examples

Example 1. A bank's quarterly compliance dashboard shows that transaction monitoring alert volumes fell by 60 percent compared with the prior quarter. The business has not changed materially. Senior management is pleased that workload has reduced. What should the compliance officer do first?

Reasoning: An unexplained sharp drop in alerts with no corresponding business change is a potential KRI breach signalling a system, data feed, or rule configuration problem. The correct action is to investigate the root cause and validate that the monitoring system is functioning correctly before accepting the result. Options such as reducing analyst headcount or reporting the reduction as a program success are distractors.

Example 2. Which of the following would be the most useful indicator for the board to assess whether the institution's exposure to money laundering risk is increasing?
(a) Total number of transactions processed.
(b) Number of training sessions delivered.
(c) Percentage change in customers rated high risk and in exposure to high-risk jurisdictions over the past four quarters.
(d) Number of policies updated during the year.

Reasoning: Option (c) is a KRI that directly reflects risk exposure and includes a trend over time, which is exactly what a board needs. Options (a), (b), and (d) are activity or volume measures that do not indicate risk level.

Example 3. An institution reports 98 percent of alerts dispositioned within SLA, but a recent quality assurance sample found that 35 percent of closed alerts lacked adequate rationale. What does this suggest?

Reasoning: The timeliness KPI is being met but the quality KPI is failing, suggesting analysts may be prioritising speed over substance. The institution should treat the quality finding as the more significant concern, investigate causes (training, workload, incentives), and ensure both quality and timeliness metrics are reported together. This illustrates why volume or timeliness metrics must be paired with quality metrics.

9. Summary Points to Memorise

- KPIs measure how well the AFC program performs; KRIs measure the level and direction of financial crime risk exposure.
- Both should be derived from the enterprise-wide risk assessment and aligned with the risk appetite statement.
- Every indicator needs a clear definition, owner, data source, frequency, and threshold with defined escalation.
- Reporting should be tiered by audience, trend-based, and accompanied by commentary and proposed actions.
- Breaches must be escalated and remediated; metrics must drive action and feed back into the risk assessment and control design.
- Unexpected improvements in metrics should be investigated, not assumed to be good news.
- Independent testing should validate the accuracy of indicators and management's response to them.
- The indicator set must be reviewed periodically to remain relevant as risks and the business evolve.

Mastering this topic means being able to look at any metric in a scenario and ask three questions: What is it actually telling me about performance or risk? Is there a threshold and a response? And what should a competent compliance officer or board do with this information? If you can answer those consistently, you will handle CAMS questions on KPIs and KRIs with confidence.