Why assess risk and compliance maturity?
Every organisation manages risk, but not always on purpose. In less mature organisations, risks are discussed after something goes wrong, compliance is a scramble before each audit, and obligations live in the heads of a few specialists. In mature ones, risk information shapes decisions, obligations are tracked and owned, and people know what's expected of them without having to look it up.
The models in this domain assess whether risk and compliance are built into how the organisation operates. Is there a shared picture of the most significant risks, with owners and actions? Can you show how personal data is handled, end to end? Would a new regulation be spotted, assessed and implemented in time? Are contracts managed after they're signed? Is safety owned by everyone, or by the safety team?
Where to start
- For a foundation, start with Risk Management. It shows how risk is identified, assessed and acted on across the organisation.
- If you handle personal data, which most organisations do, use Privacy & Data Protection.
- For regulated sectors, Regulatory Readiness assesses how you track, interpret and meet changing obligations.
- For legal and physical risk, use Legal & Contract Management and Health & Safety.
- For assurance and financial crime, use Internal Audit & Assurance to assess the independence and impact of your assurance, and Fraud & Financial Crime to assess prevention, detection and response.
These self-assessments help you prioritise improvement. They're not audits and don't demonstrate compliance with any specific law or standard.