0 / 24

Model 54 of 74 · Risk & Compliance

Risk Management Maturity Assessment

Assess how well your organisation identifies, assesses, and manages risk.

Pillars & areas

Discover

Surface the threats

  1. 01Risk Identification & Awareness
  2. 02Risk Assessment & Analysis

Manage

Control & track

  1. 03Risk Treatment & Controls
  2. 04Risk Monitoring & Reporting

Embed

Make it second nature

  1. 05Risk Culture & Ownership
  2. 06Risk Governance & Integration

Levels

  1. 1Hindsight-DrivenDealing with problems
  2. 2SystematicDefined & consistent
  3. 3Risk-IntelligentForward-looking

01 Risk Identification & Awareness

Does the organisation actively and consistently surface the risks that could affect its objectives?

0/4 answered

RI-1How does your organisation discover new risks?

Think about whether risks are identified through a deliberate process, or whether they only become visible when something goes wrong.

RI-2How well does your organisation capture risks from across different parts of the business?

Consider whether risk identification covers all functions (operations, finance, technology, people) or is concentrated in one area.

RI-3How does your organisation identify risks that are slow-moving or emerging?

Think about threats that build gradually — regulatory shifts, market changes, talent pipeline issues, technology obsolescence.

RI-4How confident are staff that they can raise risk concerns without negative consequences?

Consider whether people feel safe flagging potential problems, or whether raising risks is seen as being negative or disloyal.

02 Risk Assessment & Analysis

Does the organisation evaluate risks consistently to understand their likelihood, impact, and interdependencies?

0/4 answered

RA-1How does your organisation assess the severity of identified risks?

Think about whether risk severity is evaluated using a consistent method, or whether it depends on who is doing the assessment.

RA-2How well does your organisation understand the connections between different risks?

Consider whether risks are treated as independent items, or whether the organisation maps how one risk can trigger or amplify another.

RA-3How does your organisation decide which risks require action versus which can be accepted?

Think about whether there are clear thresholds for what level of risk is tolerable, or whether every risk gets the same level of attention.

RA-4How often are risk assessments reviewed and updated?

Consider whether risk ratings stay static once set, or whether they are revisited as circumstances change.

03 Risk Treatment & Controls

Does the organisation take deliberate, proportionate action to reduce risks to acceptable levels?

0/4 answered

RT-1How does your organisation decide what to do about a risk once it has been assessed?

Think about whether treatment options (avoid, reduce, transfer, accept) are explicitly considered, or whether the response is improvised.

RT-2How well does your organisation verify that its risk controls are actually working?

Consider whether controls are tested after they are put in place, or whether the organisation assumes they work because they exist on paper.

RT-3How does your organisation handle risks that cross departmental or functional boundaries?

Think about a risk that affects multiple teams — does anyone own the overall response, or does each team handle its own piece independently?

RT-4How quickly can your organisation implement new controls when a risk changes or a new risk appears?

Consider whether the organisation can respond to a sudden change in risk profile within days, or whether new controls take months to implement.

04 Risk Monitoring & Reporting

Does the organisation track risk exposure in real time and report it in a way that drives decisions?

0/4 answered

RM-1How does your organisation track whether its overall risk exposure is increasing or decreasing?

Think about whether leadership has a current, accurate picture of the organisation's risk profile at any given moment.

RM-2How useful are risk reports to the people who receive them?

Consider whether risk reports lead to decisions and actions, or whether they are tabled, noted, and forgotten.

RM-3How does your organisation detect early warning signs that a risk is about to materialise?

Think about whether there are leading indicators monitored before a risk event occurs, or whether detection only happens at the point of impact.

RM-4How quickly does critical risk information reach decision-makers?

Consider what happens when a significant new risk or a major change in an existing risk is identified — how long before the right person knows?

05 Risk Culture & Ownership

Do people across the organisation see risk management as their responsibility, not just a compliance exercise?

0/4 answered

RC-1Who do people in your organisation believe is responsible for managing risk?

Think about whether risk management is seen as everyone's job, or as something that belongs to a specialist team.

RC-2How does your organisation respond when something goes wrong?

Consider whether the focus is on finding someone to blame, or on understanding what happened and preventing recurrence.

RC-3How well do people across the organisation understand the risks that matter most?

Consider whether staff beyond the leadership team could name the organisation's top risks and explain how their work connects to them.

RC-4How does your organisation ensure risk management does not become a box-ticking exercise?

Think about whether risk registers and assessments are actively used to make decisions, or whether they exist primarily to satisfy audit requirements.

06 Risk Governance & Integration

Is risk management connected to strategy, embedded in decision-making, and governed with clear accountability?

0/4 answered

RG-1How is risk management connected to your organisation's strategic planning?

Think about whether strategic plans explicitly address the risks that could prevent the organisation from achieving its goals.

RG-2How clear is accountability for risk management across the organisation?

Consider whether every significant risk has a named individual who is accountable for managing it, or whether ownership is vague.

RG-3How does your organisation incorporate risk thinking into everyday decisions, not just formal risk processes?

Think about whether risk is considered when approving budgets, launching projects, hiring, or changing processes — or only during formal risk reviews.

RG-4How does your organisation ensure its risk management approach keeps pace with changes in the business and its environment?

Consider whether your risk framework, tools, and processes are reviewed and updated, or whether you are using the same approach from five years ago.

Self-assessment report

Risk Management

Answer the questions above and your report builds here: an overall score, a score and target for each area, and the three changes that matter most.

About this model

About the Risk Management maturity model

Every organisation faces risk — but the difference between organisations that thrive and those that are blindsided lies in how deliberately they look for, evaluate, and act on it. This model assesses how well your organisation identifies, analyses, treats, and monitors risk, and whether risk thinking is genuinely embedded in how decisions are made or exists only as a compliance exercise.

This is not about whether you have a risk register. It is about whether your risk management practices actually change behaviour, inform decisions, and protect the organisation from foreseeable harm. The best organisations do not just manage known risks — they build the capability to anticipate and adapt to risks they have not yet encountered.

24 questions across 6 key areas, assessing your organisation's ability to identify, assess, treat, monitor, and govern risk. Takes approximately 10-15 minutes to complete.

Scoring is based on 3 maturity levels per question. Your overall score reflects the average maturity across all areas, giving you a clear picture of where your risk management capability is strong and where it needs attention.

Who this assessment is for

  • Board members and executives with risk oversight responsibilities
  • Chief Risk Officers and risk management professionals
  • Operational managers who own risks in their area
  • Internal auditors and compliance professionals
  • Project and programme managers responsible for risk in delivery
  • Anyone seeking to understand how mature their organisation's approach to risk is

The three maturity levels

  • Level 1 — Hindsight-Driven: Risk management is informal and inconsistent. Risks are discovered when they materialise as incidents, not before. There is no shared language for risk, no consistent assessment method, and no aggregated view of the organisation's risk exposure. Individual teams may manage their own risks in isolation, but there is no coordinated approach. Decisions are made without considering risk data, and the same types of incidents recur because root causes are not addressed.
  • Level 2 — Systematic: Risk management follows a defined process. Risks are identified through scheduled activities, assessed using a common framework, and tracked in a central register. Ownership is assigned for high-priority risks, and regular reporting provides leadership with visibility. Risk is considered in major decisions such as project approvals and strategic planning. The approach works, but coverage is uneven — some areas of the business engage deeply while others treat it as a formality.
  • Level 3 — Risk-Intelligent: Risk management is forward-looking and embedded in how the organisation operates. Emerging risks are actively sought through horizon scanning, scenario analysis, and external intelligence. Risk appetite is clearly defined and directly influences strategic choices. Controls are tested, not assumed. Risk data drives decisions at every level, and continuous improvement of the risk approach itself is standard practice. The organisation does not just respond to risk — it builds resilience against risks it has not yet seen.

The 6 areas assessed

  1. Risk Identification & Awareness — Does the organisation actively and consistently surface the risks that could affect its objectives?
  2. Risk Assessment & Analysis — Does the organisation evaluate risks consistently to understand their likelihood, impact, and interdependencies?
  3. Risk Treatment & Controls — Does the organisation take deliberate, proportionate action to reduce risks to acceptable levels?
  4. Risk Monitoring & Reporting — Does the organisation track risk exposure in real time and report it in a way that drives decisions?
  5. Risk Culture & Ownership — Do people across the organisation see risk management as their responsibility, not just a compliance exercise?
  6. Risk Governance & Integration — Is risk management connected to strategy, embedded in decision-making, and governed with clear accountability?

How this model relates to other frameworks

  • ISO 31000 (Risk Management Guidelines)
  • COSO Enterprise Risk Management Framework
  • IRM (Institute of Risk Management) Risk Management Standard
  • Orange Book (HM Treasury Risk Management Framework, UK Government)
  • AS/NZS 4360 (Risk Management Standard, Australia/New Zealand — predecessor to ISO 31000)

Frequently asked questions

What is the Risk Management maturity model?

Assess how well your organisation identifies, assesses, and manages risk. It is an original, simplified model with three maturity levels (Hindsight-Driven, Systematic and Risk-Intelligent), assessed through 24 questions across 6 areas: Risk Identification & Awareness, Risk Assessment & Analysis, Risk Treatment & Controls, Risk Monitoring & Reporting, Risk Culture & Ownership and Risk Governance & Integration.

How long does the Risk Management assessment take?

Most people finish in 10–14 minutes. Each of the 24 questions has three concrete answer options. Your progress is saved in the page URL, so you can bookmark it and come back later.

How is the score calculated?

Each answer scores 1 (Hindsight-Driven), 2 (Systematic) or 3 (Risk-Intelligent). An area's score is the average of its answered questions, and the overall score is the average of the area scores, so every area counts equally. Scores run from 1.0 to 3.0.

Is my data stored or shared?

No. Your answers are never sent to a server. They are stored only in the page URL, which you control. Copy the link to share results with colleagues, or export a PDF or CSV report.

How should I use the results?

Start with "Where to focus" in your report. It lists the questions with the biggest gap to the target you set for each area, and shows what the next level looks like in practice. For a fuller picture, ask several people from different teams to complete the assessment and compare their links. Differences in perception are often as revealing as the scores themselves.