Module Overview
The KPI & Strategy module is the cornerstone of StrataGRC's risk-aware auditing approach. It enables organizations to define strategic objectives, track performance metrics, and automatically trigger risk assessments when performance deviates from targets.
Why Start Here?
This module should be your starting point because it establishes the strategic context for all other GRC activities. By linking risks, controls, and audits to strategic goals and KPIs, you ensure that your GRC efforts are aligned with business objectives and focused on what matters most.
Implementation Tip
Start with 5-10 strategic goals and 15-20 KPIs. Don't try to measure everything at once. Focus on the metrics that truly drive business value and risk exposure.
The Problem We Solve
Traditional Challenges
- Strategy disconnected from operations
- Manual KPI tracking in spreadsheets
- No early warning for performance issues
- Risk assessments done annually
- Audit planning not risk-based
- No link between KPIs and risks
- Reactive instead of proactive
StrataGRC Solution
- Strategy-to-execution alignment
- Automated KPI data collection
- Real-time threshold monitoring
- Continuous risk assessment
- Risk-based audit triggers
- KPI-to-risk automatic mapping
- Proactive alert system
Key Features
Strategic Goal Setting
Define and track strategic objectives with milestones, timelines, and progress monitoring
KPI Management
Create KPIs with targets, frequencies, owners, and links to strategic goals
Performance Tracking
Enter actual values, auto-calculate variance, track trends over time
Threshold Alerts
Set warning/critical thresholds, automatic email notifications when breached
Risk Scenario Simulation
What-if analysis to model impact of risks on KPIs and strategic goals
Strategy-Risk Mapping
Automatic linkage between KPIs, risks, and audit universe items
Risk Appetite
Define organizational risk tolerance levels with color-coded definitions
Auto Risk Scoring
Configurable rules to convert KPI variance into risk scores (20-100)
Getting Started Guide
Access the Module
Navigate to KPI Management from the main menu (requires
admin_settings_edit permission). The system will automatically
create all required database tables on first access.
Define Strategic Goals
Click "Add Strategic Goal" to create your organization's strategic objectives. Assign categories (Financial, Customer, Operational, etc.) and priority levels (Low, Medium, High, Critical).
Create KPIs
For each strategic goal, define 2-3 KPIs that measure progress. Set target values, measurement units, and frequency. Link KPIs to strategic goals with impact weights.
Configure Thresholds
Set warning and critical thresholds for each KPI. Choose direction (above/below) and tolerance bands. These will trigger automatic alerts.
Enter Performance Data
Click "Enter Data" for each KPI to record actual performance. The system auto-calculates variance, variance percentage, and trend direction.
Monitor & Respond
The system automatically monitors thresholds and sends email alerts when breached. Audit triggers are created for linked audit units, enabling risk-based auditing.
Strategic Goals Setup
Creating Your First Strategic Goal
Strategic goals are the foundation of your organization's strategy. They represent high-level objectives that drive business value and require monitoring.
| Field | Description | Example |
|---|---|---|
| Goal Title | Clear, concise statement of the objective | "Increase Market Share to 25%" |
| Description | Detailed explanation of the goal | "Expand presence in West African markets..." |
| Category | Goal classification | Financial, Customer, Operational, etc. |
| Priority Level | Importance ranking | Critical, High, Medium, Low |
| Start Date | When work begins | 2024-01-01 |
| Target Date | Expected completion | 2024-12-31 |
Best Practice
Involve senior leadership in goal definition. Ensure goals are SMART: Specific, Measurable, Achievable, Relevant, and Time-bound. Limit to 5-10 strategic goals to maintain focus.
KPI Configuration
KPI Best Practices
Key Performance Indicators (KPIs) are measurable values that demonstrate how effectively your organization is achieving key business objectives.
Link to Strategic Goals
Each KPI should directly measure progress toward a strategic goal. Use impact weights to show relative importance.
Balanced Metrics
Include leading indicators (predictive) and lagging indicators (outcome-based) for comprehensive coverage.
Assign Owners
Every KPI should have a clear owner responsible for performance and data accuracy.
Threshold Configuration
Thresholds define when performance requires attention. Configure both warning and critical levels for early intervention.
Performance Tracking
Entering Performance Data
Regular data entry ensures accurate monitoring and timely alerts. The system supports multiple entry methods:
- Manual Entry: Enter data directly in the KPI Management interface
- Bulk Upload: Import multiple periods via CSV (coming soon)
- API Integration: Connect to source systems for automatic data feed
Auto-Calculated Metrics
The system automatically calculates:
Data Entry Frequency
Match data entry frequency to KPI frequency setting (Daily, Weekly, Monthly, Quarterly, Annual). Enter data within 5 days of period end for timely monitoring.
Automated Threshold Alerts
How Alerts Work
The system continuously monitors KPI performance against configured thresholds. When a threshold is breached, multiple actions are triggered automatically:
Threshold Breach Detected
System compares actual value against warning and critical thresholds. Supports both "above" and "below" threshold directions.
Risk Score Calculated
Based on variance percentage, the system calculates a risk score (20-100) using configured risk scoring rules.
Email Alert Sent
Formatted HTML email sent to KPI owner with breach details, risk score, and link to take action.
Audit Trigger Created
For KPIs linked to audit units, an audit trigger is created in the audit_triggers table with status "New".
Alert Frequency
To prevent alert fatigue, the system implements smart deduplication:
Configuration
Alerts are generated by kpi_threshold_monitor.php which can be
run manually or scheduled via cron (recommended: hourly).
Risk Scenario Simulation
What-If Analysis
The scenario simulation engine allows you to model the potential impact of risk events on your KPIs and strategic goals. This helps in:
- Risk Assessment: Quantify potential impact before events occur
- Contingency Planning: Prepare response strategies in advance
- Resource Allocation: Prioritize risk mitigation efforts
- Board Reporting: Demonstrate risk awareness to stakeholders
Running a Simulation
Impact Levels
| Avg Risk Score | Impact Level | Color | Action Required |
|---|---|---|---|
| 75-100 | Critical | Red | Immediate action from top management |
| 50-74 | High | Orange | Senior management attention required |
| 25-49 | Medium | Yellow | Management attention needed |
| <25 | Low | Green | Monitor and track |
Module Integrations
How KPI & Strategy Connects to Other Modules
The power of StrataGRC comes from the interconnected nature of modules. Here's how KPI & Strategy integrates with other components:
Risk Register
KPIs automatically linked to risks. When KPI thresholds are breached, linked risks are reassessed with updated scores.
Audit Management
Audit triggers created from KPI breaches automatically suggest audit engagements for affected audit units.
Control Library
Controls linked to KPIs can be automatically tested when KPI performance indicates potential control failure.
Audit Universe
Audit units mapped to KPIs receive risk scores based on KPI performance, enabling risk-based audit planning.
Data Flow
KPI Breach → Risk Score Update → Audit Trigger → Control Test → Finding Creation → Remediation Tracking
This automated flow ensures that performance issues are quickly identified, assessed for risk, audited if necessary, and remediated.
Best Practices
Implementation Guidelines
Start Small, Scale Fast
Begin with 5-10 strategic goals and 15-20 KPIs. Once the process is established, gradually expand to cover more areas. Quality over quantity.
Engage Leadership
Secure executive sponsorship for goal definition. Their buy-in ensures organizational alignment and resource commitment.
Define Clear Owners
Every KPI must have an owner accountable for performance and data accuracy. Review ownership quarterly.
Set Realistic Thresholds
Base thresholds on historical performance and industry benchmarks. Avoid setting targets too high (demotivating) or too low (not challenging).
Review Regularly
Conduct monthly KPI review meetings. Discuss variances, trends, and corrective actions. Update goals annually.
Integrate with Risk
Always link KPIs to risks. A KPI breach should trigger risk reassessment. This is the core of risk-aware auditing.
Compliance Standards Alignment
COSO ERM Framework:
• Performance Management: KPIs measure strategy execution and business performance
• Risk Response: KPI thresholds trigger risk responses and mitigation actions
• Information & Communication: KPI dashboards communicate performance to stakeholders
ISO 31000 Risk Management:
• Monitoring & Review: KPIs provide ongoing monitoring of risk parameters
• Recording & Reporting: KPI reports document risk management effectiveness
• Integration: KPIs integrate risk management into organizational processes
Balanced Scorecard:
• Financial Perspective: Revenue, cost, profitability KPIs
• Customer Perspective: Satisfaction, retention, market share KPIs
• Internal Process: Efficiency, quality, cycle time KPIs
• Learning & Growth: Employee, innovation, capability KPIs
King IV Report on Corporate Governance:
• Governing Body: KPIs provide oversight of organizational performance
• Strategy & Performance: KPIs link strategy to measurable outcomes
• Risk Governance: KPIs monitor risk exposure and risk appetite
Additional Resources
For more detailed guidance, refer to the StrataGRC Implementation Guide or contact our support team for personalized assistance.