Count the decisions, not the indicators
Open your last board risk pack and count the key risk indicators (KRIs). Then count how many of them led to a board decision in the past year: a changed limit, a paused product, a budget line, a question minuted with an owner and a date.
In most packs the second number is close to zero. That is not a board failing. It is a design failure. The pack was built to show that risk is being measured, not to put decisions in front of the people who have to take them.
One indicator, one board decision
Here is the position this guide takes. A KRI belongs in front of the board only if crossing its threshold calls for a decision the board itself must take. If the response sits within management’s authority, the indicator belongs in the management risk committee pack. The board sees it only when it escalates.
How many is that? About twelve is a sound starting point, and no Kenyan regulation or international standard sets a number. A forex bureau, a microfinance bank, a payment service provider and a diversified banking group should not carry the same dashboard: fewer indicators for simpler institutions, more where scale and complexity justify them. Twelve is a guide, not a ceiling.
The count is not the test. Each indicator earns its place by showing four things: a material exposure, its direction of travel, how close it sits to an approved tolerance, and the intervention required. Nor is the standing list a filter. Any material exception or emerging exposure reaches the board whether or not it has an indicator. A shorter dashboard helps only if what remains is more consequential and nothing material is hidden.
Over the years, preparing, reviewing and presenting risk reports to executive management and board committees, I have seen KRI dashboards grow more comprehensive without growing more useful. The indicators that have prompted real challenge and action have not been the most numerous or the most elaborate. They have been the ones that clearly exposed a material risk, showed whether it was worsening, and made the required response difficult to ignore. A breached appetite threshold, a deteriorating control trend or a persistent unresolved exposure has carried more weight than pages of routine metrics. The lesson from my practice has been consistent: fewer, decision-linked indicators sharpen oversight, because they move attention from what the numbers say to what management must do, by when, and what the board must challenge.
The rules set expectations, not a format
None of the sources below prescribes a dashboard format. Together they set three expectations: the board approves appetite, receives reporting it can decide on, and sees breaches escalated and acted on. The logic holds for every CBK licensee, and for IRA and CMA licensees answering to their own boards.
| Source | What it says | What it means for the pack |
|---|---|---|
| CBK Risk Management Guidelines (January 2013), 1.2.2 and 1.2.3 | “Every institution shall require a set of management and board reports to support risk-monitoring activities.” Policies should “escalate and address breaches of internal position limits.” | Separate board and management sets, and an escalation route for breaches. |
| Draft CBK Risk Management Guidelines 2026, 1.8.1 (draft, for Banking Act institutions) | The board approves strategy, risk appetite and significant policies, including AML/CFT/CPF, and receives “regular timely and meaningful reporting that enables informed decision making.” | Meaningful means decision-ready. |
| FSB Principles for an Effective Risk Appetite Framework (November 2013), 4.1(e) and (f) | The board should “regularly review and monitor the actual risk profile and risk limits against the agreed levels” and ensure appropriate action is taken on breaches. | An agreed level and an action trail for every indicator. |
| BCBS 239 (January 2013; an international benchmark written for systemically important banks), Principle 9, paras 62 and 64 | “Higher up in the organisation, more aggregation is expected.” The board is responsible for determining its own risk reporting requirements. | The board specifies its own pack. |
| POCAMLA Regulations 2023, reg 7(3) | Institutions must “develop and implement Board approved policies, controls and procedures” based on their risk assessment. | The board owns the AML framework; AML board reporting is your design. |
Building an indicator that passes
- Tie it to appetite. Name the line of the approved risk appetite statement it measures. If you cannot, it is a management metric.
- Set thresholds from appetite, not history. Green is inside appetite, red is outside, and amber sits far enough from red to leave time to act. An amber at “last year’s average plus 10%” measures drift, not risk.
- Agree the response in advance. Beside each threshold, write who acts, by when, and what the board will be asked to decide.
- Name an owner and a traceable source. Internal audit should be able to trace the number to its system. BCBS 239 Principle 7 expects reports to be “reconciled and validated.”
What the page looks like
Page one lists only exceptions: indicators that changed zone or breached since the last meeting, plus any material exposure outside the standing set. Each exception answers three questions in one paragraph. What has gone wrong? What has continued exposure meant for the institution, in shillings or customers where it can be quantified? What decision is required, and what does management recommend?
Page two shows the full set as trends over the last six to eight periods, not as a single red, amber or green dot. An indicator red for three meetings is a different conversation from one that turned red last month. A dot hides the difference.
The table below is a generic illustration. The indicators and thresholds are invented to show the structure. They are not benchmarks; set yours from your own appetite statement.
| Indicator (illustrative) | Appetite line it tests | Amber | Red | Board decision at red |
|---|---|---|---|---|
| Headroom over the regulatory liquidity minimum | Liquidity stays well above the minimum under stress | Under 8 points | Under 4 points | Activate the contingency funding plan; restrict asset growth |
| Non-performing loans in the largest sector exposure | No single sector can impair capital | 8% | 12% | Tighten the sector limit or approve a time-bound exception |
| Unplanned downtime of critical systems, hours per quarter | Customers can transact when they need to | 4 hours | 8 hours | Approve remediation spend or a vendor change |
| Transaction monitoring alerts open past the written review timeline | Suspicion is identified and escalated promptly | 10% of open alerts | 20% of open alerts | Approve resourcing, or accept the risk with an expiry date |
| High-risk customers with an overdue EDD review | High-risk relationships are reviewed on schedule | 5% | 10% | Pause new high-risk onboarding until cleared |
| STRs filed more than two days after documented escalation | No late reporting | None | Any | Commission an independent review of the escalation process |
Note the last row. Where the law sets a hard duty, there is no amber. Any late suspicious transaction report is a breach of POCAMLA s.44(2). The useful board indicator is the one upstream that warns before the breach: the alert backlog in the row above it.
When a red stops alarming anyone
A red indicator does not create urgency by itself. Reds that sit in the pack quarter after quarter do so for one of three reasons, and only two are defensible.
| Status of a standing red | What the board should see | Defensible? |
|---|---|---|
| Credible remediation | A dated plan, a named owner, progress against milestones, and evidence the fix is working | Yes, while the milestones hold |
| Accepted risk | A risk acceptance approved at the right governance level, with its rationale, compensating controls and an expiry date | Yes, until it expires |
| Drift | The same explanation as last time, a moved deadline, and no decision named | No |
Some remediation legitimately takes longer than a quarter. The board should still be able to tell, for every red, which of the three it is looking at. Drift is how unresolved exposures become familiar features of the pack.
A practical rule: when a red returns with substantially the same explanation and nothing changed, it leaves the dashboard and goes on the agenda as a decision item. The board then funds the fix, accepts the risk with an expiry date, or directs an exit from the activity.
Where financial crime indicators go wrong
Financial crime is where boards most often get activity instead of exposure: alerts generated, screening hits, KYC reviews completed, STRs filed. Those counts rise and fall with system tuning. They describe work done, not whether the institution has been protected.
What gives a board something to challenge is exposure: high-risk relationships operating with overdue due diligence, material gaps in transaction monitoring coverage, STRs filed late, and serious control weaknesses open past their agreed deadline. Each invites the questions that matter. Why has the gap persisted? What business remains exposed? Who owns the corrective action? What intervention is required? The same drift test applies here: a financial crime red explained the same way twice has lost its force.
If your clock for STRs starts at documented escalation, as our STR guide argues, the board can see whether that clock is kept. If beneficial ownership verification is a known weakness, the count of corporate files without a verified owner belongs on page two (see beneficial ownership in practice).
Kenya has been under FATF increased monitoring since February 2024 and was retained in June 2026, so supervisors will ask what the board saw. For what a breach can cost by license type, see preparing for a CBK AML inspection.
Questions for the next board risk committee
- If this indicator turned red tomorrow, what would come to us for a decision? If nothing, why is it in our pack?
- Which line of our appetite statement does it measure?
- Is this red under credible remediation, accepted with an expiry date, or neither?
- What did we decide the last time it was red, and did it work?
- Who set the amber threshold, and on what basis?
- What material exposure is not on this dashboard, and how would we hear about it?
- Has internal audit traced this number to its source?
Before the next pack goes out
Sit down with the chair of the board risk committee and test every indicator in the current pack together. Does it show a material exposure, its direction, its distance from tolerance and the decision it would require? Move what fails to the management committee, with a written rule for when it comes back up. For what remains, reset the thresholds against the appetite statement, write the response at amber and red, and label every standing red as remediation, accepted risk or drift.
Riskill’s KRIs and board reporting toolkits include an indicator register with thresholds, owners and responses already laid out: riskilled.com/toolkits. If you want a second opinion on your current pack before the next meeting, send it to us.