Why Diagnose a KRI Breach?
A reported breach is a reason to investigate, not a conclusion about what changed. A key risk indicator (KRI) may cross its threshold because the underlying risk worsened, but it may also cross because a source record was duplicated, the calculation used the wrong denominator, reporting dates were misaligned, or the portfolio’s exposure mix changed. The diagnostic task is to trace the alert back to its data and method, then assess what the corrected result means.
The aim is not to dismiss an inconvenient alert or to change a threshold after seeing the result. Keep the approved metric definition and breach rule fixed while testing the data and calculation. If a corrected result still breaches the threshold, treat it as a valid alert even if the cause is understood. If the corrected result does not breach, document why the original alert was unreliable and retain an audit trail of the correction.
Start With the Metric Definition
Before recalculating, write down what the KRI is intended to count or measure. For a frequency KRI, a common form is eligible events per unit of exposure. The numerator must use the stated event definition; the denominator must represent the exposure to which those events relate. Both must refer to compatible periods and populations.
Here, \(N_t\) is the number of eligible events in period \(t\), \(E_t\) is exposure measured in the approved unit, and \(c\) is a scaling factor, such as 1,000. The result is a rate per \(c\) exposure units. A breach rule must also be explicit: for example, a breach may mean \(K_t>T\), or it may mean \(K_t\geq T\), where \(T\) is the approved threshold. Equality matters when the result is at the boundary.
This rate formula is appropriate only when the event definition, exposure unit, and observation period are consistent. It does not make unlike populations comparable automatically. If groups have different underlying rates, an overall rate can change simply because the proportions of exposure in those groups have changed.
A practical diagnosis follows a fixed sequence. Preserve the reported result, then reconcile its inputs before deciding whether it reflects deterioration. Keep the threshold and the approved calculation specification unchanged during that sequence.
Record the numerator, denominator, scaling factor, period, population, threshold, breach rule, and applicable version of the calculation specification.
Trace the numerator to source records. Check for duplicates, exclusions, missing records, incorrect classifications, and events outside the defined population.
Verify the denominator, units, scaling, and formula. Recalculate from the reconciled inputs rather than editing the reported rate directly.
Check that event dates, exposure dates, reporting cutoffs, and any reporting lag are treated consistently across the compared periods.
Compare it with the unchanged threshold and, where relevant, compare segment rates and exposure weights. State what the data support and what remains uncertain.
Worked Examples
Worked Example: Duplicate Records at the Threshold
A hypothetical insurer monitors eligible claims per 1,000 policy-years. The approved threshold is 8.0 claims per 1,000 policy-years, and a breach is defined as a rate strictly greater than the threshold. The dashboard reports 92 claims and 10,500 policy-years. Source-record review finds that 8 of the 92 claim rows are duplicate records. Determine whether the diagnosed KRI breaches the threshold.
Method. Reconcile the event count first, then recompute the rate using the stated exposure and scaling factor. The eight duplicate rows do not represent eight additional eligible claims.
The reported calculation is:
This reported rate is above 8.0. After removing the duplicates, the eligible count is:
The corrected rate is:
The corrected result equals the threshold. Because the approved rule is strictly greater than 8.0, this is not a diagnosed breach. It is exactly at the boundary and should not be described as below the threshold. The check is \(8.0>8.0\), which is false.
Common mistake avoided: Keeping all 92 rows because they appeared in the extract would preserve duplicate events in the numerator. A second mistake would be to call equality a breach without checking the stated rule. Neither is justified here.
Worked Example: Aligning Event Dates and Reporting Cutoffs
A hypothetical claims KRI has a threshold of 7.5 eligible claims per 1,000 policy-years; a breach occurs only when the rate is greater than 7.5. The exposure for the quarter is 13,000 policy-years. A report shows 104 claims. Review finds that 13 claims in the report belong to the prior quarter, while five eligible claims from the current quarter were missing at the report cutoff. Rebuild the current-quarter KRI using the aligned event count.
Method. Assign events to the period defined by their event date, not merely by the date they appeared in the report. Remove prior-period events and add the identified current-period events. The stated five missing claims are the complete set found for this reconciliation; do not extrapolate beyond the information given.
The aligned current-quarter count is:
Using the stated exposure and scaling factor, the corrected rate is:
Since \(7.3846<7.5\), the corrected KRI does not breach. The originally reported count was not a period-aligned measure: it included claims from the prior quarter and omitted claims from the current quarter. The conclusion is limited to this corrected count and the supplied exposure; it does not establish that the underlying risk can never deteriorate.
Common mistake avoided: Dividing the reported count of 104 by current-quarter exposure would give \(104/13{,}000\times1{,}000=8.0\), but that mixes event periods. The correction is to align the numerator with the exposure period before comparing the rate with the threshold.
Worked Example: Separating Segment Rates From Exposure Mix
A hypothetical insurer tracks claims per 1,000 policy-years for two groups. The low-risk group has a rate of 4 claims per 1,000 policy-years, and the high-risk group has a rate of 20. In the earlier period, low-risk exposure is 9,000 policy-years and high-risk exposure is 1,000. In the current period, low-risk exposure is 4,000 and high-risk exposure is 6,000. The overall KRI threshold is 12 claims per 1,000 policy-years, with a breach defined as a rate greater than 12. Determine whether the current alert reflects higher segment rates or a change in exposure mix.
Method. Calculate event counts and rates by segment, then aggregate the counts and exposures. This makes it possible to distinguish a change in the group-specific rates from a change in the proportions of exposure in each group.
In the earlier period, the implied low-risk count is \(9{,}000\times4/1{,}000=36\), and the high-risk count is \(1{,}000\times20/1{,}000=20\). Therefore:
In the current period, the low-risk count is \(4{,}000\times4/1{,}000=16\), and the high-risk count is \(6{,}000\times20/1{,}000=120\). Thus:
The current overall KRI breaches the threshold because \(13.6>12\). However, the low-risk rate remains 4 and the high-risk rate remains 20 per 1,000 policy-years. The group-specific rates have not increased in the supplied data. The high-risk share of exposure has changed from \(1{,}000/10{,}000=10\%\) to \(6{,}000/10{,}000=60\%\), so the overall rate rises because the current portfolio contains more high-risk exposure.
Conclusion. This is a valid aggregate threshold breach, but the figures indicate exposure-mix change rather than deterioration within either segment. That distinction matters: the aggregate risk measure has increased, even though neither underlying segment rate has worsened.
Common mistake avoided: Comparing only the overall rates and concluding that claim frequency deteriorated within the groups confuses a change in weights with a change in segment rates. Conversely, dismissing the alert because the segment rates are stable would ignore the higher share of high-risk exposure in the aggregate.
Interpreting the Diagnostic Result
A diagnosis should state both the calculation result and the reason for any difference from the reported alert. The explanation should be specific enough that another reviewer could reproduce the corrected result from the cited source records and calculation steps. Where a data issue is found, preserve the original alert and document the corrected inputs rather than silently overwriting the record.
| Finding | What it means for the KRI | Diagnostic conclusion |
|---|---|---|
| Duplicate, missing, or misclassified events | The numerator may not represent eligible events. | Reconcile the source records and recalculate. |
| Wrong exposure unit or calculation | The reported rate may use an invalid denominator or scaling factor. | Apply the approved formula and verify units. |
| Misaligned event and reporting periods | The numerator and denominator may describe different populations or time windows. | Align periods and apply a consistent cutoff. |
| Stable segment rates but changed weights | The overall rate may change because the exposure mix changed. | Report the aggregate breach and identify the mix effect. |
| Corrected, comparable result remains above threshold | The alert survives the data and method checks. | Treat it as a valid breach and describe the evidence-supported interpretation. |
A KRI diagnosis does not, by itself, prove why a risk changed or establish that a change is statistically significant. It establishes whether the reported measure is supported by its defined data and calculation, and whether a comparison is like-for-like. Avoid claiming more than the evidence shows.
Common Exam Trap: Correcting the Wrong Thing
A tempting response to an unexpected breach is to change the threshold, denominator, event definition, or period until the alert disappears. That is not a diagnosis. The approved metric specification should be the reference point; corrections should address demonstrable data or implementation errors. If the specification itself is unsuitable, record that as a separate governance issue rather than retroactively changing the definition for a single period.
For example, suppose a dashboard reports 70 claims over 8,000 policy-years against a threshold of 8 claims per 1,000 policy-years. The incorrect calculation might divide the event count by 8,000 and report \(70/8{,}000=0.00875\) claims per policy-year, then conclude that the KRI is far below the threshold. That result is not on the threshold’s stated scale. The correctly scaled rate is:
The corrected result is above 8. The scale factor is part of the metric definition, not a cosmetic choice. Likewise, do not treat a count as a rate, compare different reporting maturities as if they were equivalent, or assume that an aggregate rate change proves every segment deteriorated.
Check Your Understanding
For each hypothetical case, apply the stated definition and breach rule before interpreting the alert.
- A KRI counts eligible events per 1,000 exposure units. The threshold is 6.0, with a breach only above 6.0. The report has 54 event rows and 8,500 exposure units; source review confirms that 3 rows are duplicates. Calculate the corrected rate and state whether it breaches. (Answer: \(51/8{,}500\times1{,}000=6.0000\); it does not breach because the rule is strictly above 6.0.)
- A quarterly KRI has a threshold of 8.5 events per 1,000 exposure units, with breach defined as greater than 8.5. The report lists 73 events and 9,000 exposure units. Reconciliation removes 6 prior-quarter events and adds 4 eligible current-quarter events. Calculate the corrected rate and conclusion. (Answer: \(73-6+4=71\); \(71/9{,}000\times1{,}000=7.8889\), so it does not breach.)
- A portfolio has two segments. Segment A has a rate of 3 events per 1,000 exposure units, and segment B has a rate of 18. Current exposure is 2,000 units in A and 5,000 in B. The aggregate threshold is 12. Calculate the aggregate rate and state what can be concluded about the mix. (Answer: counts are 6 and 90; aggregate rate is \(96/7{,}000\times1{,}000=13.7143\), a breach. The greater exposure weight in B can raise the aggregate; without earlier segment rates, deterioration within segments cannot be concluded.)
- A monthly report records 3 eligible events over 2,400 vehicle-months. The threshold is 12 events per 1,000 vehicle-years, with breach defined as greater than 12. Convert exposure to vehicle-years, calculate the rate, and determine whether there is a breach. (Answer: \(2{,}400/12=200\) vehicle-years; \(3/200\times1{,}000=15.0000\), so the KRI breaches.)