Appendix 6: Risk Maturity Models

Abstract

This appendix should be read in conjunction with Section 8.7.2. As discussed in Section 8.7.2, risk maturity models are useful tools in understanding the degree of sophistication of a business risk management process, its reliability and effectiveness in identifying, assessing and managing risks and opportunities. Hillson (1997) proposes a risk maturity model and provides guidance to organisations wishing to develop or improve their approach to risk management, allowing them to assess their current level of maturity, identify realistic targets for improvement and develop action plans for increasing their risk capability. The model is composed of four levels, which are described in ascending order as "na¨ıvena¨ıve", "novice", "normalised" and "natural". The levels are defined as shown in Box A6.1. Box A6.