Loading page…
Six dimensions, five levels, and observable criteria at each — so the rating is based on what you can point at rather than how the programme feels.
CISOs, heads of risk, compliance managers and internal audit leads establishing a baseline before designing or rebuilding a GRC programme.
For each dimension, find the highest level where you can evidence every statement. You are at the level below the first one you cannot fully evidence. Rate honestly — an inflated baseline produces a plan that fails at the first review.
Maturity levels describe capability, not adequacy. A level 3 programme may be entirely appropriate for one organisation and insufficient for another — the required level follows from your obligations and risk profile, not from a scale.
Whether accountability is encoded or described. Most programmes overstate here because a documented structure is mistaken for an operating one.
Responsibility for security and compliance sits with individuals by convention. No committee, no terms of reference, no recorded decisions.
A governance forum exists with documented terms of reference and membership. It meets, but agendas are reactive and decisions are not consistently recorded.
The forum meets to a schedule with a standing agenda. Decisions and actions are recorded with owners and tracked to closure. Delegated authority is documented.
Governance effectiveness is itself measured — attendance, decision latency, action closure rates — and reported. Delegation is reviewed and exceptions are tracked.
Governance structure is reviewed against organisational change and adjusted deliberately. Decision quality is reviewed retrospectively after material incidents.
Whether risk informs decisions or documents them after the fact. The clearest test is whether anyone outside the risk function has raised a risk in the last quarter.
Risks are discussed but not recorded consistently. No agreed scoring method. The register, where one exists, is a spreadsheet updated before meetings.
A register exists with a defined scoring method. Risks have owners on paper. Assessment happens on a project or annual basis rather than continuously.
Risk owners maintain their own entries. Treatment plans have owners and dates. Anyone in the organisation can raise a risk through a defined route, and some do.
Risk appetite and tolerance are defined and monitored. Key risk indicators are tracked against thresholds. Breaches escalate for formal acceptance, recorded with rationale and review date.
Risk data informs investment and change decisions before they are made. Assessment quality is reviewed against incidents and near misses, and the methodology adjusted.
Whether compliance status is a query or a project. The test is how long it takes to answer 'are we compliant with X' truthfully.
Obligations are addressed when an audit or customer question forces the issue. No consolidated view of what applies.
Applicable obligations are listed somewhere. Ownership is unclear or held centrally. Evidence is gathered when requested.
Obligations have named owners, review cadence and mapped controls. A compliance calendar drives review. Evidence accumulates as controls operate.
Compliance status is reportable at any point without a data-gathering exercise. Non-conformities are tracked with corrective actions to verified closure. Regulatory change is monitored and routed.
New obligations are assessed for overlap with existing controls before implementation is planned, so adoption is a mapping exercise rather than a fresh programme.
Whether the same control is implemented once or repeatedly. This dimension drives more wasted effort than any other.
Controls exist per standard. The same underlying control is implemented, tested and evidenced separately for each framework adopted.
A control list exists. Overlaps between frameworks are recognised informally but not mapped, so duplication persists.
A canonical control set is mapped to requirements from every adopted framework. One control satisfies multiple requirements, and the mapping is recorded.
Coverage is visible: which requirements are mapped, which are not, and where gaps genuinely exist. Control testing produces evidence linked to the requirements it satisfies.
Control design is reviewed against test failure patterns and incidents. Adding a framework is estimated in mapping effort, not implementation effort.
Whether findings close or recur. Re-raised findings are the strongest single indicator of assurance maturity.
Assurance comes from external audit alone. Internal testing is informal or absent.
An internal audit programme exists and runs, largely to satisfy a standard. Coverage is calendar-driven rather than risk-driven.
An audit universe exists and the plan is risk-based. Fieldwork produces workpapers. Findings have owners and dates.
Findings are tracked to verified closure with evidence of effectiveness. Repeat findings are analysed. Independence is documented where the same firm implements and audits.
Assurance activity is coordinated across internal audit, control testing and external assessment to avoid duplicate testing of the same control.
Whether the board pack is derived or assembled. If preparing it takes more than a day, it is assembled.
Reporting is a written update. Numbers, where present, are produced manually and are not consistently comparable between periods.
A consistent report template exists. Data is collated manually from several sources ahead of each meeting.
Reporting is produced from operational records rather than assembled. Metric definitions are documented and stable across periods.
KPI and KRI thresholds are defined; breaches surface between reporting cycles rather than at them. Owners see their own outstanding work continuously.
Leading indicators are tracked alongside lagging ones, and reporting supports decisions about where to invest rather than only recording what happened.
Next step
Send us what the assessment surfaced and we will give you a view on which items are genuine blockers, which matter less than they look, and what closing them realistically takes.