Which KPI is used to measure the effectiveness of risk mitigation strategies over time?

• A. Reduction in exposure
• B. Trend of incidents
• C. Resilience metrics (recovery times, downtime)
• D. Cost-benefit over time

Answer: (B)

Tracking how often incidents occur over time directly shows whether risk mitigation efforts are truly reducing real events, not just altering other factors. The trend of incidents provides a clear, ongoing signal of effectiveness: a downward trend indicates that the measures are successfully cutting the number of events, while a flat or rising trend signals gaps or changes in risk that need attention. This longitudinal view captures the dynamic nature of risk as strategies are implemented and as conditions evolve across the organization and its geographies.

Other options can be informative but are more indirect. Reducing exposure measures potential risk sources or activities but doesn’t guarantee fewer incidents if incidents still occur in other areas or if exposure metrics aren’t aligned with actual events. Resilience metrics like recovery times and downtime show how quickly operations recover after incidents, but they don’t directly reflect how often incidents happen. Cost-benefit over time assesses financial value, which can be influenced by costs and revenues independent of incident frequency.

So, the trend of incidents over time best reflects whether risk mitigation strategies are effectively reducing actual risk events across the period considered.