In vendor risk reporting, how do KRIs differ from KPIs?

• A. KRIs measure performance; KPIs measure risk.
• B. KPIs measure time to recover; KRIs measure cost efficiency.
• C. KRIs measure performance; KPIs measure risk.
• D. KPIs provide operational summaries; KRIs provide strategic insights.

Answer: (D)

In vendor risk reporting, KPIs focus on how well vendor management processes perform on a day-to-day basis, giving an operational snapshot of efficiency and effectiveness. KRIs, by contrast, track indicators of potential risk events or shifts in risk exposure that could affect strategic objectives. This distinction is why KPIs provide operational summaries (such as onboarding cycle time, SLA adherence, or cost per vendor) whereas KRIs offer strategic insights (like critical vendor concentration, cybersecurity risk exposure, regulatory changes, or supply chain disruption potential) that help governance make informed, higher-level decisions. The other statements mix up which metrics reflect performance versus risk, or tie KPIs and KRIs to aspects like time to recover or cost efficiency in ways that don’t align with how these indicators are typically used.