Glossary term
Risk Management Maturity Model
Subject: Risk Management, Risk Fundamentals and Frameworks
Also known as: Risk Maturity
A risk management maturity model rates how developed an organisation's risk practices are, usually on a scale of stages from ad hoc to optimised, and shows what to improve next.
Explanation
Typical models use five levels: initial or ad hoc, where risk is handled informally; repeatable, with basic processes; defined, with standard methods across the organisation; managed, where risk is measured and used in decisions; and optimised, where learning feeds continuous improvement. Assessors score areas such as governance, culture, process, data, tools and reporting, through interviews, document review and surveys. The score is compared with a target set by the board, since the top level is not right for every firm. Results feed a road map of improvements. Models come from professional bodies, consultancies and standard-setters, and they differ, so scores from different models cannot be compared. A maturity model measures capability, not the actual size of the risks. Boards use the score to decide where to spend: the gap against target, not the absolute level, drives the road map.
Example
A regional utility asks an outside reviewer to score its risk practices. Governance and incident reporting reach the defined level, but risk data and the use of risk in investment decisions stay at repeatable. The board's target is managed within three years, so it funds a common data platform and requires every capital project paper to include a risk assessment.
Not to be confused with
- Risk Assessment
- A risk assessment rates the risks an organisation faces; a maturity model rates how well the organisation manages risk.