Your risk management might be fine, but is your risk maturity holding up?

What happens when the person in charge of managing risk leaves, and nobody takes their place? Nothing good.

Back in 2022, rising interest rates started draining the value of a mid-sized US bank's investments. The board noticed and reacted, nearly doubling its risk meetings that year, to almost one every three weeks.

It looked good to the outside, but for eight of those months, the one role actually responsible for owning risk day to day was empty.

The board could see the warning signs. It just wasn't ready to act on them the way a dedicated risk officer would have.

Weeks after finally hiring someone into the role, the bank collapsed, making it one of the largest bank failures in the country's history.

What is a risk maturity model?

A risk maturity model is like a scorecard that tells you how good your organization actually is at managing risk, not just on paper, but in practice. It scores risk practices against a defined scale, usually running from ad hoc and reactive, to structured and proactive.

Think of it like a fitness level for your risk management: You might know all the right exercises, but a fitness test doesn't care what you know. It measures what your body can do under effort.

Most companies already do some form of risk management. But a maturity model asks a different question: how consistent, embedded, and forward-looking is all of that, really?

This isn't just a compliance nicety either. Research tracking publicly traded companies found that firms with higher risk maturity scores carried meaningfully higher firm value, tied to a premium of up to 25%.

The 5 levels of risk maturity explained

Every major risk maturity model runs on some version of the same five-stage ladder, rooted in the Capability Maturity Model (CMM) framework:

The five levels of risk maturity

Reactive levels (1–2):

• Level 1: Ad hoc - At level 1, risk management barely has a name. Processes are ad hoc and sometimes chaotic. There's no consistent process, no clear owner, and no register. Risks get handled individually, usually by whoever's closest to the problem when it surfaces.

• Level 2: Repeatable - This a step up from level 1, but it’s still fragile. Some practices exist, maybe a spreadsheet or a basic risk management plan, but they live in silos. One department tracks risk carefully, while another doesn't track it at all.

The standardized baseline (3):

• Level 3: Defined - By level 3, risk management has a name, a process, and usually a policy behind it. Organizations here run on a defined risk management framework that applies across departments, not just the teams that happen to care most.

Proactive levels (4–5):

• Level 4: Managed - Level 4 organizations don't just have a process, they make decisions before risks materialize. Risk data feeds strategic planning, and leaders ask about exposure the same way they ask about revenue.

• Level 5: Optimized - Level 5 is where risk management becomes self-improving, being refined continuously using incident data, near misses, and outside benchmarks. Few companies operate consistently at this level, and that's by design. Optimization takes years of disciplined practice, not a policy rewrite.

How do you measure it though?

Knowing the five levels conceptually is one thing, but figuring out where your organization actually stands is the harder part.

This is where the Risk and Insurance Management Society (RIMS), a professional association for risk management practitioners, comes in. They’re in charge of publishing research and running the RISKWORLD conference.

RIMS built its risk maturity model to score an organization's enterprise risk management (ERM) program. It grades an organization against five weighted pillars:

• Strategy alignment: How closely an organization's risk decisions connect to its actual strategic goals

• Culture and accountability: How everyone in the organization takes ownership of identifying and managing risk in their own work

• Risk management capabilities: How well an organization can actually carry out the core mechanics of risk management, from identification through response, not just whether it has a policy for them

• Risk governance: How clearly risk oversight roles, reporting lines, and decision rights are defined and followed, from the board down

• Analytics: How much an organization relies on real data and evidence to make risk decisions, rather than gut feel

How to assess and improve your risk maturity

Knowing your current level only matters if you use it. These four moves will turn your maturity score into an actual improvement plan.

Use the RIMS model

RIMS' own free assessment works well when you want to know your risk maturity, since it walks through the scoring automatically.

But try to let other teams use the model too, because a risk team assessing its own program is like someone grading their own work. Bringing in operations, finance, and frontline managers usually surfaces the gaps that are normally missed, because they're the ones working on the ground.

When paired with a risk register, you could easily track how individual risks shift as maturity improves.

Fix the weakest pillar first

RIMS scores each of the five pillars separately, not as one blended number, so an organization can see exactly which one is dragging the score down. Maybe governance is solid but analytics is weak, or culture and accountability lags while risk management capabilities holds up fine.

Trying to fix all five at once spreads resources thin and slows progress everywhere. The faster path is picking the lowest-scoring pillar and putting real effort there before moving to the next one.

Moving from a reactive to a proactive risk posture

The jump from level 2 to level 3 mostly involves documentation and consistency. The jump from level 3 to level 4 is harder, because it requires leadership to actually use risk data when making decisions, not just collect it.

Organizations that make this shift connect risk reporting to real decisions, like budget approvals or project sign-offs, instead of treating it as a box-ticking exercise on the side.

Building a business case for risk maturity improvement

Improving risk maturity costs time and money, so leadership needs a reason to say yes, like anything else. The strongest reason points to real, avoidable costs: a costly incident that a level 4 organization would have caught earlier, the audit finding that consistent documentation would’ve prevented.

Leadership rarely funds “better risk management” as a concept. It funds the version tied to a number leadership already cares about, and it stays funded when leadership sees the score improve year over year.

That's ultimately the point of measuring maturity in the first place: not to earn a score, but to know exactly where an organization stands and what it will take to move.