Topics in this domain
- IT Governance vs. IT Management
- Board and Senior Management Roles
- IT Steering Committee
- IT Strategy and Business Alignment
- Balanced Scorecard
- COBIT
- ITIL
- ISO 27001/27002
- COSO: ERM and Internal Control
- Policies, Standards, Procedures, Guidelines
- IT Organizational Structure and Key Roles
- Segregation of Duties in IT
- Enterprise Architecture (Zachman, TOGAF)
- Risk Management Process
- Qualitative vs. Quantitative Risk Assessment
- Risk Responses: Mitigate, Transfer, Avoid, Accept
- Risk Appetite and Residual Risk
- Maturity Models (CMMI)
- KPIs and KGIs
- Outsourcing: Benefits and Risks
- Vendor Selection, Contracts, SLAs, Right to Audit
- Cloud and Offshore Governance
- Portfolio and Resource Management
- HR: Hiring, Training, Termination
- Legal and Regulatory Compliance
- Quality Management
KPIs and KGIs
Three questions, three indicators
Think about a marathon runner. The finishing time is the result: a goal indicator. The weekly training distance shows whether they’re on track: a performance indicator. A sore knee is an early warning that something could go wrong: a risk indicator.
IT governance uses the same three kinds of measure.
| Indicator | Measures | Timing | Example |
|---|---|---|---|
| Key goal indicator (KGI) | Whether a goal was achieved | Lagging: after the fact | Share of projects delivering their expected benefits |
| Key performance indicator (KPI) | How well a process is working, and whether the goal is on track | Leading: during | Share of projects with an approved business case before funding |
| Key risk indicator (KRI) | Changes in risk exposure | Early warning | Number of privileged accounts with no owner |
The KGI/KPI split comes from COBIT’s goals and metrics approach: the KGI tells management what was achieved; the KPI tells it how well the process is doing along the way.
What makes a metric useful
- Specific and measurable: a clear formula and data source
- Linked to a goal: it supports a business or IT objective
- Timely: available soon enough to act on
- Owned: someone is responsible for the result
- Targeted: it has a target and, for KRIs, thresholds that trigger escalation
- Worth collecting: the effort is justified
Outcome measures usually beat activity counts. “Training sessions delivered” says little about behaviour. “Phishing simulation click rate” says much more.
Example. IT’s headline monthly number is “500 incidents closed”. That’s activity. A better set: a KGI of availability of critical services against target, a KPI of incidents resolved within target time, and a KRI of repeat incidents with no problem record raised.
Auditing metrics
The auditor checks that metrics link to goals, the data behind them is reliable (calculation and source are controlled), targets are set, results reach the right people, and action follows when targets are missed.
How the exam asks about it
| If the question asks… | The answer is usually… |
|---|---|
| Indicator measuring whether a goal was achieved | KGI |
| Indicator measuring process performance towards a goal | KPI |
| Indicator giving early warning of rising risk | KRI |
| Best metric for awareness training effectiveness | A behaviour or outcome measure, not attendance |
| What makes a metric actionable | A target or threshold, an owner, and timely reporting |
In short
- A key goal indicator (KGI) measures whether a goal was achieved: an outcome, measured afterwards (lagging).
- A key performance indicator (KPI) measures how well a process is working, and whether the goal is likely to be met (leading).
- A key risk indicator (KRI) signals that risk exposure is changing, giving early warning.
- Good metrics are specific, measurable, linked to goals, timely, and owned by someone.
- Metrics need targets or thresholds, and someone who acts when they're missed.
Exam traps
- KGI = did we achieve the goal? KPI = how well is the process working towards it?
- Counting activity (training sessions delivered) is weaker than measuring outcomes (fewer phishing clicks).
- A metric with no target or owner rarely leads to action.
- KRIs need thresholds that trigger escalation.
Slides
Click the slide and use the arrow keys. F toggles full screen.
KGI, KPI and KRI