Ask any organization where its KPIs live and where its KRIs live, and you will usually get two different answers: KPIs in the indicator system, KRIs in the risk matrix — two catalogues, two owners, two cadences, and quite often the same number computed twice.
The Dexon BPM methodology makes a decision that contradicts that practice on purpose: the KRI is not a checkbox; it is a relationship. A measurement element becomes a KRI when it is linked to a risk in the register. The same element can also carry a target — and therefore be a KPI. There is nothing to duplicate and no artificial choice to force between the two catalogues, because there are no two catalogues.
From early-warning signal to indicator
For that relationship to mean anything, the risk has to be an object, not an annotation. In the register, every entry runs a full cycle with its three stages declared separately:
Inherent risk — type, impact and probability before any treatment — → treatment — avoid, reduce, transfer or accept, with its countermeasure — → residual risk — impact and probability after treatment.
A register that keeps a single rating cannot tell whether the current level is the result of a decision or of luck.
Each entry also declares its early-warning signals: what you observe before the risk materialises. That is the seedbed of KRIs: every signal that can be quantified is a candidate for a measurement element linked to the risk. If the risk is regulatory non-compliance on a citizen procedure, the early signal may be the ageing backlog at a given stage; that backlog, measured on a cadence and linked to the risk, is a KRI — and the very same number, given a target, is the process’s flow KPI.
The uncomfortable rule that follows: a risk register with declared signals and no indicators measuring them is describing, without saying so, the work still missing.
Why it matters that it is a relationship
Because relationships can be queried, and checkboxes can only be read.
- A risk’s impact includes its KRIs. Before changing or retiring a risk, the platform shows what depends on it: the processes whose design it conditions, the portfolio analysed against it, and the indicators that anticipate it. Hence an integrity rule that sounds severe and is simply hygiene: an entry that is in use is not deleted — its uses are unlinked first, leaving a trace.
- The KRI inherits the measurement element’s context. An anchor to a concrete object, a declared source, a cadence, a history. It is not a number pasted into the risk matrix: it is the same governed object that feeds the alignment boards.
- The conversation with the auditor changes in kind. “How do you monitor this risk?” stops being answered with a slide: it is answered by showing the link risk → indicator → process, with the indicator’s history next to it.
What this is not
It is not a separate GRC module, and it does not pretend to be. It is the consequence of a metamodel where the risk, the process, the data and the indicator are objects of the same repository with real relationships between them. The risk management that follows — the full cycle, risk as a design condition of the process, the register’s integrity — is developed on the risk management page, and the mechanics of alignment-as-relationships in the article on total alignment.
The full formal treatment — the register as a governed object (§8.4) and measurement alignment (§15.8) — is in the Dexon BPM V8 methodology, downloadable without registration.