Risk Management Maturity
Risk maturity is far wider than AI
Risk Maturity for AI asks ten questions about the parts of risk management that AI tests hardest. It is a quick way in. But it is one question in each of the eleven categories I use when I assess an organisation’s risk management, and the full assessment asks more than sixty.
This page explains what the full assessment covers, how the evidence is gathered, and what the report shows.
Eleven categories
Each category is broken down into between four and eleven parts, and each part is described at four levels, so that a score always means something specific.
- Risk knowledge. How much people know about the risks the organisation faces, and how those risks link to its strategy.
- Risk skills. Whether people can use risk analysis to the organisation’s advantage, from controls to leadership.
- Risk attitudes. How people regard risk management: as a help, a hindrance or a box to tick.
- Systems and processes. How well risk management is woven into planning, projects, change and everyday tools.
- Risk expertise. The technical knowledge and experience of risk management across the organisation.
- Risk culture. Whether people talk about risk, raise concerns safely, and work across silos.
- Risk reporting. Whether the right information reaches the board, the executive and those who need it.
- Risk in decisions. Whether risk shapes real decisions: day-to-day, budgets and long-term strategy.
- Governance over risk. The policy framework, and how involved the board, the executive and regulators are.
- Risk appetite. Whether appetite is defined, measured, understood and used, not just written down.
- Extended enterprise. How risk is managed with suppliers, partners and the wider group: knowledge, power, dependence.
The model is my own, built over many years of maturity reviews and drawing on ISO 31000, COSO and the wider professional literature. It is being updated for current standards, including those on AI.
Four levels
- 1 Rudimentary
- More of a problem than a help: bureaucratic, adding little, largely ignored.
- 2 Engaged
- The basic routines are in place, but they can quickly become a ritual.
- 3 Developed
- People take part willingly, and management relies on the results.
- 4 Sophisticated
- Woven into how the organisation works, every day.
Four levels, not five, so that nobody can settle on the middle. And “don’t know” is always allowed: it is not scored, but it is reported, because not knowing is often the most useful finding.
How the evidence is gathered
A score is only as good as the evidence behind it. Depending on the depth you choose, the assessment draws on:
- Self-assessment by directors and executives, against the full set of descriptions.
- A survey of a wider group, so that the view from the people doing the work is heard.
- Interviews with directors, executives and others, to test the answers against what happens in practice.
- Documents: policies, risk registers, board papers and reports.
Where the sources disagree, the report says so and explains which way the evidence points. That disagreement is often the most valuable finding of all.
What the report shows
The pages below are taken from a sample report for a fictional organisation, with invented answers from 50 people: eight directors, ten executives and thirty-two staff.
Sample · fictional organisation
Where the organisation stands, and how much people agree
The dark line is the median answer in each category. The shaded band covers the middle half of the answers: the narrower the band, the more people agree.
Sample · fictional organisation
The board sees a different organisation from its staff
The same medians, drawn separately for each group. Where the lines part, the people setting the direction and the people doing the work see the organisation differently.
| Category | Board | Staff | Gap |
|---|---|---|---|
| Risk culture | 3.4 | 1.7 | +1.7 |
| Risk reporting | 3.2 | 2.0 | +1.2 |
| Risk knowledge | 3.1 | 2.2 | +0.9 |
Sample · fictional organisation
Each category in depth: risk culture
For every category, the report sets out what good looks like, what we found, and what needs to be done.
What good looks like
People at every level talk openly about risk, with colleagues, their managers and across departments. Raising a concern is expected, safe and acted on, and bad news reaches the people who can act on it quickly.
What we found
The board rates the culture as Developed; staff rate it as Rudimentary. In interviews, several managers said they would raise a problem with their own team but not above it, and two described concerns that had stopped at the second line of management.
What needs to be done
The board and executive should hear directly from staff below management level at least twice a year. Escalation routes should be tested, not just written down, and the next survey should show whether the gap has narrowed.
Ways to work together
- Risk Maturity for AI
- Ten questions, one person, about five minutes. Free, with the result on screen straight away.
- Board and executive team
- Every director and executive answers, and an automated report shows where you stand and where your views differ. Either the parts AI tests hardest, or the full model.
- With interviews
- The same, with my interviews to test the answers against practice, and a written report with my judgement on each score and prioritised recommendations.
- Full maturity assessment
- The whole model, with a survey and interviews across the organisation, and if you wish across the wider group or your key partners.
Each is a one-off assessment for an agreed, fixed fee, with no charge by the day. It can be repeated later to show progress.
Why me
I was principal author of the Institute of Risk Management’s guidance on risk appetite and tolerance, and chaired the Institute from 2011 to 2014. I spent over twenty years, including eight as a partner, at PwC. I have carried out risk management maturity reviews for organisations in energy, major infrastructure and international development, and chaired board risk committees in UK payments and banking.
Start with the free Risk Maturity for AI, or talk to me about a full assessment.
The sample pages use a fictional organisation and invented answers, to show what the report looks like. They describe no real organisation.