DESCRIPTION While incident management and risk and control self-assessment tools are fairly well embedded in most organizations, many companies either have poorly developed or no key risk indicator (KRI) capabilities in