Risk Maturity Models

How to Assess Risk Management Effectiveness

Domenic Antonucci

• Publisher: Kogan Page
• Year: 2016
• Print ISBN:
  9780749477585
• Edition: 1
• eBook ISBN:
  9780749477592
• Topic: Business
• Subtopic: Decision Making
• Index: Business

This book offers a practical solution for every organization that needs to monitor the effectiveness of their risk management. Written by a practising Chief Risk Officer, Risk Maturity Models enables you to build confidence in your organization's risk management process through a tailored risk maturity model that lends itself to benchmarking. This is a management tool that is easy to design, practical and powerful, which can baseline and self-improve the maturity capabilities needed to deliver ERM benefits over time. This book guides the reader through comparing and tailoring a wealth of existing models, methods and reference standards and codes (such as ISO 31000 and COSO ERM). Covering 60 risk-related maturity models in clear comparison format, it helps risk professionals to select the approach best suited to their circumstances, and even design their own model.

Risk Maturity Models provides focused messages for the risk management function, the internal audit function, and the Board. Combining proven practice and insight with realistic practitioner scenarios, this is essential reading for every risk, project, audit and board professional who wants to move their organization up the risk maturity curve.

03

Comparing risk maturity models against each other

---

This chapter covers:

• Dealing with biases
• Approach to comparing models
• Tiering the models
• Directory of 77 models compared
• Results and analysis
• Summary

---

Introduction

Megan’s confidence was growing. She wanted the right information at hand to either select the risk maturity model most suited to her organization, or, if she was going to design her own, to survey the field and understand what type of models were out there. This would also back her investment case as long as she avoided overbias.

There is no better way to understand existing working risk maturity models than by comparing the field against each other to some standard criteria and quickly analysing the results. The intention here is not to rate one better than another but to illuminate their features, benefits, claimed advantages, potential disadvantages and tier them into style types.

The directory of maturity models in this chapter also acts as excellent reference material. It can help the reader to define their needs and select one or more existing models, define capabilities and approaches to start your first risk maturity model design or upgrade the design of an existing model. But before we start, let us understand how to look out for potential bias in the marketplace.

Dealing with biases when comparing risk maturity models

Dealing with bias when comparing, selecting, tailoring or designing your own risk maturity model will be a challenge. Bias becomes an issue for risk practitioners when they are pressured to understand and defend the investment case and why one model or aspect of a model is favoured over another.

Biases are tendencies with negative or positive consequences. Whilst bias can be an emotive and pejorative word, this is just something to be managed and not an insurmountable issue. Almost without exception, all risk and capability maturity models exhibit varying degrees of natural bias. The sources or root causes of this bias usually relate back to who designed the model and for what purpose (commercial, scholastic, educational and so forth).

Recognizing bias can be difficult. Biases are mostly helpful but can be an issue if they result in a negative consequence by not being a ‘fit’ to the organization. They are rarely explicit and can be all too subtle. Content quality, purpose and biases are often intertwined. Spot the biases in this introduction by one technology vendor: ‘Technology is not the only component of developing an effective ERM process, but without good technology the process will never mature beyond a very basic approach’ (vendor name and website withheld, 2013).

It is easy to miss the misleading assumptions in just this one sentence above. The vendor makes three false assumptions: ERM is just a ‘process’; technology primarily delivers effectiveness; and that technology can be an absolute maturity progress-blocker (‘never mature’). Whilst technology may deliver efficiency and speed benefits, it is not necessarily a key driver of effectiveness. Think of your family car – it might get you to A from B quicker and in more comfort today (efficiency) as a later model than the ‘beat-up’ VW you used to drive but that VW still got you to B (effectiveness).

Bias can also be difficult to spot because it typically involves underlying factors and historical legacies removed from day-to-day activities. Let us revisit the McKinsey historical view we began with in Chapter 1 when McKinsey pointed to how different sets of capabilities between the financial and non-financial sectors naturally developed (Pergler, 2012). McKinsey believes that the non-financial sector takes both a linear and discrete (eg oil price-tipping points) risk approach; that it is dominated by data-poor risks (eg strategic, reputation, operations, supply chain); and, its risk management system focus is on risk-related decision making and processes combined with risk appetite and strategy. McKinsey contrasts this with the financial sector that has a so...

Table of contents

• Cover
• Praise for Risk Maturity Models
• Title Page
• Contents
• List of contributors
• About the author
• Foreword by Kevin Knight
• Foreword by Norman Marks
• Acknowledgements
• List of abbreviations
• Introduction
• 01    Background to risk maturity models
• 02    The case for a risk maturity model
• 03    Comparing risk maturity models against each other
• 04    Tailoring and benchmarking a risk maturity model
• 05    Designing a tailored risk maturity model
• 06    How risk, audit and board functions benefit from risk maturity
• 07    Summary of risk maturity models from practitioner perspectives
• Glossary
• References
• Further reading
• Index
• Copyright