Introduction
An organization may have a risk policy, a risk register, and scheduled risk reports yet still make important plans without considering risk. Another organization may use fewer formal tools but routinely examine uncertainty when setting priorities, approving initiatives, and reviewing results. To assess ERM maturity, the useful question is not simply whether a process exists. It is whether risk thinking is integrated into management practice, and what evidence supports that conclusion.
Maturity is best understood as a pattern of organizational behavior over time, rather than a label earned by completing a checklist. This tutorial develops a practical evidence-based approach: examine how risks enter planning, whether they influence decisions, and whether review practices lead to learning or adjustment. These observations support a measured judgment; they do not, by themselves, establish that an organization’s ERM framework is suitable for every purpose.
Look for Behavior, Not Just Artifacts
An artifact is a visible item associated with ERM: a policy, risk register, meeting schedule, template, or report. Artifacts can show that an organization has designed a process or assigned a formal step. They cannot, on their own, show whether that step is followed, whether its information is useful, or whether it affects management choices.
Evidence of maturity is stronger when it shows a connection between risk consideration and ordinary management activity. For example, a planning paper may describe uncertainty around a strategic objective, compare plausible outcomes, and show how the analysis informed resource choices. Minutes showing that a risk was discussed are weaker evidence if they do not reveal what was considered or whether the discussion mattered. Neither a polished document nor an informal conversation should be treated as conclusive in isolation.
| Area to examine | Developing evidence might show | More integrated evidence might show |
|---|---|---|
| Planning | A risk section is added to plans, but may be generic or completed after priorities are set. | Uncertainty and risk considerations inform assumptions, priorities, and planned responses as plans are formed. |
| Decision records | Decisions mention risk or refer to a register, with little indication of its effect. | Records show how material risks, alternatives, and consequences informed a choice or its conditions. |
| Review practices | Risk information is reported periodically, but follow-up is unclear. | Reviews compare expectations with experience, revisit assumptions, assign follow-up, and adjust plans when warranted. |
| Consistency | Practices depend on a particular individual or isolated project. | Evidence recurs across relevant activities and remains usable as conditions or personnel change. |
These are diagnostic contrasts, not fixed maturity levels. Organizations differ in size, complexity, objectives, and operating context. A proportionate process may be less elaborate than a large organization’s process while still being consistently integrated. Conversely, detailed procedures may coexist with weak decision use. The assessment should explain what the evidence demonstrates and where its limits lie.
A Practical Way to Judge the Evidence
A defensible maturity judgment connects claims to observed practice. First identify the management activity being assessed. Then examine whether risk was considered before or during the activity, whether the consideration was substantive, and what happened afterward. Finally, compare evidence across activities and over time. The purpose is not to award points for documents; it is to decide whether there is a recurring pattern of integration.
State which activities, business areas, and period the evidence covers. A conclusion about one initiative should not automatically be generalized to the whole organization.
For each activity, ask what uncertainty or risk was considered, when it was considered, and whether that information influenced planning, a decision, or a later review.
Compare plans and decision records with review materials and accounts of actual practice. Look for repeated use, exceptions, and examples that challenge the initial impression.
Describe the demonstrated capabilities, their consistency, and important gaps. Identify uncertainty where evidence is incomplete rather than converting an impression into a precise score.
The logic can be stated simply: if the claim is that ERM is integrated, evidence should show more than the existence of a process; it should show that the process connects risk consideration to management activity. Repeated examples across planning, decisions, and reviews make that inference stronger because they reduce the chance that an isolated success or a well-presented artifact is being mistaken for normal practice. Evidence from only one setting supports a narrower conclusion.
Worked Evidence Assessments
Worked Example: Risk Consideration in a Hypothetical Expansion Plan
A hypothetical insurer is considering opening a new distribution channel. The review covers its annual plan, two decision records, and quarterly reviews over one year. The annual plan identifies customer-acquisition uncertainty and technology dependencies. One decision record compares two launch schedules and explains why management chose a slower rollout with a pilot. The other records a decision to proceed with a vendor contract but does not discuss the risks identified in the plan. Quarterly reviews compare actual pilot results with assumptions; after slower-than-expected adoption, managers revise the rollout forecast and assign follow-up on the technology dependency. What maturity conclusion is supported?
Method. Trace whether risk consideration is connected to planning, decisions, and review, and then note both supporting and contrary evidence.
Planning. The plan identifies uncertainties relevant to the objective rather than merely stating that risk exists. This supports evidence of risk consideration in planning.
Decisions. The pilot decision record shows a specific connection: uncertainty about the launch informed the choice of schedule. The vendor decision record is a gap because it does not show whether the identified risks were considered. The evidence therefore does not support a claim that all decisions consistently use risk information.
Review. Reviews compare outcomes with assumptions and lead to a forecast revision and follow-up. This supports evidence that monitoring can inform management response.
Conclusion. The hypothetical insurer demonstrates meaningful integration in planning, at least one consequential decision, and subsequent review. The evidence suggests developing integration with some repeatable practices, but it is not sufficient to claim consistent use across decisions. The conclusion is limited to the activities and year reviewed.
Common mistake avoided. Counting three favorable artifacts and one gap to claim “75% mature” would be invalid. The items are not equal units of capability, and their number does not establish how broadly the practices occur.
Worked Example: When Documentation Overstates Integration
A hypothetical regional insurer has a risk register, a standard risk section in every department plan, and monthly risk reports. A review of three recent investment decisions finds that each decision paper was approved before the department completed its risk section. The monthly reports describe exposures, but the minutes show no discussion of them, and the plans do not explain how risk affected objectives or actions. What does this evidence support?
Method. Distinguish process presence from process timing and use. Ask whether risk information was available and considered while management could still act on it.
Step 1: Identify formal capability. The register, templates, and reports show that formal ERM mechanisms exist. This is evidence of process design, but it does not establish decision integration.
Step 2: Test the sequence. The decision papers were approved before the risk sections were completed. In those cases, the documentation could not have informed the decisions at the recorded time. The timing is evidence against the claim that risk consideration is embedded in those approvals.
Step 3: Test substantive use. The reports contain exposure information, but there is no evidence in the reviewed minutes or plans that it prompted discussion, changes, or follow-up. Absence in these records does not prove that no discussion ever occurred, but it limits what can be concluded from the evidence reviewed.
Conclusion. The insurer has formal ERM infrastructure, while the reviewed evidence indicates weak integration into the sampled planning and investment decisions. A fair assessment would describe that distinction and seek further evidence before making a broader organizational claim.
Common mistake avoided. The wrong conclusion is “the organization is mature because every department completes the required risk section.” The correction is to examine timing and decision use: a section completed after approval cannot demonstrate that risk informed the approval.
Worked Example: Interpreting Improvement Over Time
A hypothetical mutual insurer reviews one product initiative in two consecutive planning cycles. In the first cycle, a project team lists three risks, but the plan contains no related assumptions or actions and the year-end review does not revisit them. In the second cycle, the team documents two material uncertainties, explains how each affects the projected launch schedule, records a contingency in the plan, and reviews the trigger for that contingency every quarter. No other business areas are included in the review. How should the change be described?
Method. Compare the same activity across periods, distinguish an improvement in demonstrated practice from organization-wide maturity, and keep the conclusion within the review’s scope.
First cycle. Listing three risks shows identification activity. Because the risks are not linked to assumptions, actions, or review, the evidence of integration is limited.
Second cycle. The uncertainties affect a planning assumption, inform a contingency, and are revisited quarterly. This shows a clearer connection from risk consideration to planning and ongoing review.
Comparison. The evidence supports improvement in this initiative’s risk integration between the two cycles. It does not establish that the practice is repeatable across the mutual insurer, because no other business areas were examined. The difference between three listed risks in the first cycle and two in the second does not indicate decline: the relevant evidence is how the risks were used, not how many were listed.
Conclusion. State that integration improved in the reviewed product initiative and describe the demonstrated links to planning and review. Do not infer enterprise-wide maturity from this single case.
Common mistake avoided. Comparing the number of risks listed would confuse volume with quality of use. The correction is to compare the decision and review connections demonstrated in each cycle.
Common Diagnostic Traps
Maturity assessments can become overconfident when they favor visible documentation over evidence of behavior. They can also become unfair when a missing record is treated as proof that an activity never happened. A careful assessment distinguishes what was observed, what was not documented, and what remains unknown.
- Scoring artifacts as if they were outcomes. A policy or template supports a claim that a process was designed, not necessarily that managers use it.
- Inferring consistency from one success. One well-managed initiative demonstrates capability in that instance; it does not establish a recurring organization-wide practice.
- Treating every gap as equal. A missing risk discussion in a routine activity may have different implications from a missing discussion in a material strategic decision. Explain why a gap matters in context.
- Ignoring timing. Risk analysis completed after a decision may support later monitoring, but it does not show that the analysis informed the original decision.
- Claiming too much from silence. If a record does not mention a discussion, report that the record provides no evidence of it. Seek corroborating information before stating that it did not occur.
- Using an unexplained maturity label. “Advanced” or “weak” is not informative unless the assessment names the practices observed, the scope examined, and the limitations.
A useful conclusion is specific: for example, “In the sampled planning and review activities, managers consistently linked identified uncertainties to assumptions and follow-up actions; the reviewed decision records provide less evidence of that connection.” This is more informative than a single score because it tells a reader what is working, where evidence is thinner, and how broad the claim is.
Check Your Understanding
For each hypothetical case, state what the evidence supports and keep the conclusion within its scope.
- A hypothetical insurer requires a risk register for each new initiative. In a review of two initiatives, one team used the register to change a launch sequence; the other filed it after approval. Identify one demonstrated capability and one limitation. (Answer: The first case demonstrates risk-informed decision use; the second shows a timing gap, and two initiatives do not establish organization-wide consistency.)
- A hypothetical pension administrator’s annual plan identifies investment liquidity uncertainty, but quarterly reviews only report total return and do not revisit liquidity assumptions. What does the evidence say about planning and review integration? (Answer: Liquidity is considered in planning, but the reviewed evidence does not show that it is carried into subsequent review.)
- A hypothetical insurer has five risk policies and eight templates. Interviews from one business unit describe recurring risk discussions before major purchases, but no records or other units are reviewed. State a balanced conclusion. (Answer: Formal artifacts exist and the interviews suggest decision integration in the sampled unit; corroboration and broader evidence are needed before claiming enterprise-wide consistency.)
- In a hypothetical product review, the first year’s plan lists four risks without action, while the second year’s plan lists two risks linked to assumptions and quarterly triggers. Is this evidence of improvement or deterioration, and why? (Answer: It supports improvement in integration in the reviewed product process; the smaller count is not evidence of deterioration because use and follow-up matter more than the number listed.)
- A hypothetical insurer’s minutes contain no risk discussion for a major decision, but an interviewee says the executive team considered risk informally. What can an assessor responsibly conclude, and what should be checked next? (Answer: The minutes provide no recorded evidence, while the interview is a separate claim that requires corroboration; check decision materials, other participants’ accounts, and subsequent review records before concluding whether risk informed the decision.)