Key Control Indicators (KCIs) are quantitative or qualitative measures that signal whether a control is functioning as intended, distinct from Key Risk Indicators that measure risk exposure itself. KCIs might track control execution frequency, timeliness, exception rates, or quality metrics to detect deterioration before control failure occurs. An example is monitoring the percentage of access reviews completed on schedule as a KCI for identity and access management controls. Organizations set thresholds and tolerance ranges for KCIs, triggering escalation and remediation when performance falls outside acceptable bounds.