Ask a board how well its risks are managed and you get a photograph taken from the top. Like most photographs taken from a height, it flatters. The policies are in place, the register is up to date, the reports arrive on time.
Take the same photograph from lower down and it nearly always looks different. Not worse in every respect, but different in ways the board cannot see from where it sits. If you don’t understand the full picture, you will never have risk properly managed.
Move the slider to change where you look from.
That is what a risk maturity assessment is for. It asks how well an organisation manages risk, not in the policy manual, but in the way people actually work, at every level.
The benefits
The whole picture, not just the flattering one. Done properly, an assessment asks the same questions of the board, the executive team and the people doing the work. The answers rarely match. The gap between them is usually the most important finding, because it shows where the board is relying on something it has not seen.
A shared language. Most boards have a loose sense that their risk management is “fine”. Four defined levels, from Rudimentary to Sophisticated, turn that into something directors can discuss and disagree about. A score means something specific, so the argument is about the organisation, not the words.
Knowing where to put the effort. Departments differ. Sales and finance rarely look the same in their attitudes to risk management, and they don’t need to. That is fine, so long as you know where the differences are and where extra effort is needed to compensate.
A baseline. An assessment can be repeated. The second one shows whether anything has changed, and whether the effort went where it was needed.
Where it goes wrong
When the risk team assesses itself. An assessment done by the risk department, or only within it, never picks up the reality in the wider organisation. It measures the risk process, not risk management.
Self-assessment flatters. People generally know what the acceptable answer is. Asked whether risk is discussed openly, few managers will say no. A survey alone also draws the people who want to make a point.
The average hides the story. A single overall score is easy to report and easy to misread. If the board scores the culture highly and the staff score it poorly, the average looks respectable and tells you nothing.
There is no absolute standard. Every score is a judgement. That is unavoidable, but it means the evidence behind each score has to be visible, and conflicts between sources explained rather than smoothed over.
It becomes the thing it measures. An assessment run as a compliance exercise, with forms to complete and boxes to tick, is itself a sign of Rudimentary risk management.
How I do it
I have a range of tools and techniques, from a very simple teaser to a comprehensive exercise. They share one model: eleven categories of risk management, each described at four levels.
- A teaser. Seven Questions takes two minutes and asks whether a board sees its AI risk the same way. Risk Maturity for AI takes five, with one question from each part of the model that AI tests hardest.
- The board and executive team. Everyone answers the same questions, and the report shows where their views differ.
- With interviews. I test the answers against what happens in practice, and write up my judgement on each score.
- A comprehensive exercise. The whole model, with a survey and interviews across the organisation, and a review of the documents.
Whatever the depth, three principles hold. I look for the gaps between levels and departments rather than the average. Where the sources disagree, I say so and explain which way the evidence points. And I ask whether risk management helps people do their jobs, not whether the paperwork exists.
When the full exercise is worth it
The teaser suits anyone who wants a quick look. A comprehensive exercise is a bigger commitment, and it earns its place when:
- You are regulated, or applying to be. Regulators judge risk management by how it works in practice, and it is better to know first.
- You are in the chrysalis, changing from a scrappy start-up into a robust scale-up. The informal habits that worked with twenty people stop working with two hundred.
- Risk management is the lifeblood of your success, as it is in banking, insurance or safety-critical industries.
- A big corporate event is coming, or has just happened. Before an acquisition or merger, it shows what you are buying or joining. After one, it shows whether two ways of managing risk have become one.
- There is a new chair, chief executive or chief risk officer, who wants an honest picture before setting a course.
- Something has gone wrong, or nearly did, and the board wants to know whether it was bad luck or a sign of something deeper.
- You are about to take on a new kind of risk: a new market, a major programme, or a technology such as AI.
- You are preparing for a listing or a major fundraise, where investors will ask how well risk is managed.
Where to start
Start with the photograph you have, then take another from lower down. Risk Maturity for AI takes five minutes. Risk Management Maturity shows what a full assessment covers, with sample pages from a report.
The question for any board is not whether its risk management looks good from the top. It is whether it looks the same from everywhere else.