This is why you should switch up criteria you give bonuses by on a bi-annual basis. People who game your system only get 6 months of time to enjoy it. You’re left with people who can game every metric or people who are just so good they look good no matter what metric you pick. The first group is hard to deal with, but they would be hard to deal with anyways.
Or you could keep the metrics secret before evaluation. Except secrets are hard to keep and non-transparent.
One also has to consider whether the people who define the KPIs are themselves properly incentivized. How are they evaluated? Could there be some perverse incentive to set gameable KPIs that get hit easier? Maybe the KPI setter is in some sense in on the game and complicit? Very complicated stuff. What if the business gets destroyed in the process? Who does that hurt in reality and how much?