Congratulations on your working on an article t o assess risk management. I am sure it will be excellent and helpful to all!

I do like the model above.

Here is another model  from HM Treasury. I think it is a bit better because when I read  the terms used to describe the levels, I am easily able to relate this this to the latest risk management framework of ISO 31000, however the above model is also good. Perhaps both models can be combined to create a best in class model

Awareness and Understanding-Level 1-Top management is aware of the need to manage uncertainty and risk and has made resources available to improve

Implementation Planned and in progress- Senior managers take the lead to ensure that approaches for addressing risk are being developed and implemented

Implementation in all key areas-Senior Managers act as role models to apply risk management consistently and thoroughly across the organization

Embedded and Improving-Senior management is proactive in driving and maintaining the embedding and integration of risk management; in setting criteria and arrangements for risk management and in providing top down commitment to well managed risk taking to support and encourage innovation and the seizing of opportunities

Excellent Capability established- Senior managers re enforce and sustain risk capability, organizational and business resilience and commitment to excellence. Leaders are regarded as exemplars

Also see page 16 of the Hydro One Case- there is another example of a capability model

It sounds a good model. I always recommend a five level approach to try to nuance level of maturity achieved within the organisation. I know some consultant have their own model to assess this maturity level. We have used one once and it gives you a level or a sort of diagnostic or even measure of your integrated risk management with a Venn chart to show were weaknesses are identified. I keep thinking it is a good exercise to assess its risk management maturity level which implies the group global risk culture. It also gives you a starting point or a KPI you can then try to overperform and improve. No improvement without measurement I guess. Thanks for this document!

I am the most familiar with the Carnegie Mellon University Capability Model as it seems to be the most widely accepted standard of measurement.  However, I'm yet to find risk assessment guidance and / or modeling that really focuses on the acheivement one's objectives.  In the end, what's the point to risk if you're not measuring the achievement of your goals? 

For example: if your objective is to stay at home and watch TV--than the risk of having a flat tire is not applicable.  Don't spend the time / money to fix your tire, if you really just want to stay home and watch TV! I know this is a very simple example, but the point is most Risk Assessment guidance and modeling does not emphasize the importance of understanding the impact to achieving the organization's objectives. 

I propose the bigger question is: Is there a maturity model that emphasizes the monitoring of risks as it impacts the achievement of the Company's objectives?  Let's take this concpet one step further: Is there guidance that calls for the identification and monitoring of risk patterns as the patterns impacts the achievement of the objectives?  If so, that is where I'd place my vote! 

Norman: Very important area. Thanks for creating a forum to discuss.

Connie: I agree with your perspective that risk management should have a focus on objectives. (implicit and explicit)   I have been working on a way to measure and report on the effectiveness/maturity of an organization's risk management framework now for 15 years.  The current version of what I propose as a tool to measure maturity/effectiveness is now posted on our website home page in the box titled "A better response from our risk experts in a bullet titled "Risk Fitness Quiz".  It can be found at  http://riskoversight.ca/.  It is what I refer to as a "objective-centric" framework. 

I am also lobbying on a number of fronts to see if more debate and discussion can be generated to produce  some "authoritative" definitions of what constitutes "effective risk management processes" . The IIA December practice advisory flirts with it but never offers a solid definition of what constitutes "effective".  I am not a fan of binary opinion on risk managment processes.  

I do agree that there is value in assessing and reporting on risk management maturity.  The RIMS risk maturity framework is probably the most advanced version of a maturity framework.

Norman, because certain types of risk may be managed well in some parts of the business and poorly in others, I would like to see a scorecard solution for identifying this scenario and then a roll up overall that is akin to the model you provided. In other words, an evaluation that shows what a company is doing well and where it has exposure. If in the process of the evaluation you could identify the value of return in the areas where risk is being managed well in contrast to the risk areas not being managed so well, you could conceivably perceive value from making improvements.

Maybe I'm off track here and I'm thinking about a more sophisticated risk assessment of the risk management program, what do you think?

Norman,

I like your model which is consistent with the one I have used before when working for one of the Big 4.

However, one comment i would make is that the jump from level 3 - Defined to Level 4  - Integrated would be great and lengthy.

Have you considered a timeline or level of expected maturity in relation to the existence of Risk Management in an organisation? 

Russell  

To All; My observation, after working with risk  "maturity" models for over 20 years, is that word "maturity" is not really the issue.  Tp date. two alternatives that I think better address the issue are the level of risk management rigor/rigour (U.S. versus UK spelling) and using more everyday language, the level of "risk fitness".  Of the two, I think it is really the level of risk management rigor/rigour that best describes what really needs attention.  I don't believe "rigor" is the same as "maturity" using the common English definitions of the words.

 In the new approach we are promoting management, risk oversight committees and the board must make conscious decisions on the appropriate level of risk assessment rigor that think should be applied to key value creation and potentially value eroding objectives.  Internal audit can, and should, raise concerns in instances where they believe that management's decision on risk assessment rigor isn't appropriate. 

Unfortunatey the majority of internal audit departments today, when they disagree with management's risk assessment rigor decision, elect to complete an assessment of control effectiveness instead.  This is akin to a parent not liking the way a child is approaching a task and, rather than teach them better ways to approach the task, just does it for the child.   This has been a key failing of traditional internal audit IMHO.

Great conversation starter as always.

I find a lot of the labels in maturity models to be benign, and reinforce a culture of mediocrity (going through the motions, looking good on paper, no real results).