STAGES OF RISK MANAGEMENT MATURITY

Stages of Risk management maturity

Organisations generally follow what we refer to as a ladder of Risk management maturity stages: 

Stage 1 – ‘Infancy Stage’  At this stage, Risk is either unmanaged or managed in pockets within the organisation on a best endeavours basis with little or no exposure to best practise. It is undocumented and in flux, the management and taking of risk depends on individual herorics

Stage 2 – ‘Bottom up stage’  At this stage, A risk manager is appointed to manage risks for the business. This is the stage where the risk managers can feel like an uphill struggle, often working in isolation from the business but laying the foundations for best practice. Decision making can be hard to get business buy in and when decisions are made there are often competing priorities.  Risk is defined in different ways but managed in silos.

Stage 3 – ‘Top Down Stage’  At this stage, the risk manager has won the respect of the organisation and has demonstrated the value that a risk function can bring, having built the case for a more organised approach. A common risk assessment/response framework is in place.

An organization-wide view of risk is provided to Executive Leadership and the Board in form of a list of so-called "top" risks. Action plans are implemented in response to high priority risks.

In this stage of maturity, the RM drives the change and risk policy while Governance sets the pace for the firm and makes decisions on their behalf. 

Stage 4 – ‘Integrated and Systemic Stage ’  In the fourth stage of maturity, organisations have established risk management processes, Risk owners have been identified from the business and robust Governance structures have been put in place to oversee and challenge the risk management process.

At this stage, the Risk managers are able to provide timely information to allow the effective allocation of resources across the firm and assist the Governance function to make the right business decisions and give direction.

Risk management activities are coordinated across business areas. Common risk management tools and processes are used where appropriate, with enterprise-wide risk monitoring, measurement, and reporting.

Alternative responses are analyzed with scenario planning and other techniques and process metrics are in place.

But the emphasis remains on managing a list of risks. Discussion of risk at executive committee and board levels is separate from the discussion of strategy and performance.

Stage 5: Optimized: At this stage, the focus shifts from managing a list of risks outside the context of enterprise objectives to managing success: the achievement of objectives.

The consideration of what might happen (where possible, business language is used instead of the technical language of risk) is embedded in strategic planning, capital allocation, and other processes, as well as in daily strategic and tactical decision-making.

There is a reasonable level of assurance that decision-makers are taking the right level of the right risks necessary for success and not just avoiding failure.

Early-warning systems exist to notify board and management both of specific risks above established risk appetite or risk-capacity thresholds – and where the likelihood of achieving enterprise objectives is less than acceptable.

Reporting to management and the board integrates performance reporting (where we are now) and risk (what might happen) to project the likelihood of achieving each enterprise objective.

Discussion of risk at top management and board levels (what might happen) is not separate from the discussion of strategy and performance.

The majority of organizations (based on periodic surveys of auditing and consulting firms) indicate that boards and executive management perceive the management of risk as a compliance activity, something they have to do.

They do not see it as something they want to do because it adds value and helps them be successful. They see it only as something that helps them avoid failure.

But when an organization reaches maturity Level Stage 5, the focus shifts to making daily decisions that take the right risks for success.

The board and top management can understand whether enterprise objectives might or might not be achieved, and why.