This document outlines a risk management maturity model with five levels across several areas of risk management. At level 1, there is little risk management practice and risks are not well identified, analyzed, or planned for. At level 2, some basic risk management processes are used inconsistently. At level 3, standard risk management processes are used but still have some gaps. Level 4 involves thorough and consistent risk management processes integrated with project management. Level 5 represents optimized risk management where processes are tailored to projects and risk information is systematically used, archived and learned from.

1. Risk Management Maturity Model
Areaa Level 1 Level 2 Level 3 Level 4 Level 5
Sponsor and
Management
No involvement or policy,
little/no risk information, no
connection with external
customer; no risk sharing with
customer or suppliers; end
users not involved
Little use of risk info; limited
exposure of risks, very limited
customer involvement, unclear
agrements, supplier risk info
limited; poor contracts & risk
insights, limited end user
involvement
Some management proactive
engagement, reporting risks
but not used well, constrained
risk info to customer, skewed
risk sharing,
Management is proactive;
using risk information regularly
with some gaps; risk sharing is
more balanced with some
holes
Policy in place; information
sought and provided regularly;
RM integral to all decisions;
customer involvement integral
to risk decisions
Identify Risk
Risks are ignored or only
occassionally identified; no use
of formal means to identify
risks; slow or no response to
risks that are newly identified;
surprises
Risks may be identified but are
called issues; term "risk" may
be frowned upon; some limited
top down risk info conveyed;
some formal risk identification
mechanisms used; slow
response when neew risks Ided
Upstream risks are sometimes
passed along from upstream;
risks identifed using more
extensive risk ID mechanisms;
formal meetings to ID risks
used; PM starting to show up in
Iding risk; risk logs may be
created
Risks are passed down and
used in project risk planning;
extensive use of identification
tools and methods; RM is
expected as part of PM team's
role; RM ID methods are
adjusted based on project
lifecycle;
Risk ID done from earliest
stages of investment decisions;
Risk info passed along to
projects; tools, experts,
different methods used to ID
risks as dictated by project;
new risks are rapidly
addressed; RM part of
everyone's job
Analyze Risk
Vague and unhelpful risk
descriptions; Issues tracked,
but not risks; informal and
subjective basis for prioritizing
risks; no contingency
estimates; little or no formal
mitigation
Some better risk desriptions;
standard may exist but is not
consistently applied;
probability and impacts may be
done informally; prioritzation
poor; limited risk synergy;
informal owners
Standard for risks is used but
some gaps; probability &
impact in use; RYG; mitigation
identified; risk owners usually
assigned; risk synergies being
identified but not fully
developed;
Most risk standards are in
place; synergy is important to
ID and done; risk owners
assigned and accountable; RYG
and other mechanisms used to
analyze risks; risk impact nearly
always assessed
Risks standards are in place
and consistently applied;
synergies are always
considered; different views of
the risk information are
considered; risk owners are
always identified and
accountable
Plan Risk
Responses
Risk response planning is
poorly done, if at all; no
ROI/CBA done when
considering responses; no
monitoring of responses; no
project plan adjustment; no
pre- or post mitigation
comparisons
Risk response planning is
informally done; ROI/CBA may
be done from time to time;
monitoring of reponses is left
to individual risk owners; may
do some pre- and post
mitigation analysis
Risk reponse planning is done
but inconsitently; ROI/CBA
done as requested; monitoring
done but not rigorously;
project plans adjusted
someitmes; pre- and post
mitigation analysis done
Risk response planning is
required and done thoroughly
but some lapses; ROI/CBA
integral part of the analysis;
consistent and rigorous
monitoring done; risk response
planning usually part of
stakeholder discussions
Risk response planning is done
well and rigorously and
consistently; ROI/CBA is done
for all risks needing it; risk
triggers/monitoring are
integral to risk management;
customer, suppliers, sponsors
are part of the discussions;
plans are adjusted
Link PM System
RM and PM are disconnected;
RM is one size fits all; no
linkages with proj plans; RM is
"extra"
RM and PM are somewhat
connected; some RM planning
is done with project planning;
informal risk reviews and
reporting; weak linkages to
schedules; no historical data
RM & PM are connnected; RM
is often done once and
reflected in the plans at project
outset; RM is adjusted and
applied intelligently; risk
modeling is done; limited
historical data
RM & PM are strongly linked;
risks are managed across and
beyond project scope standard
reporting done; modeling is
done well; risk information is
captured for use but not
accessed; RM roles are done
per standards
RM & PM are done well and to
standard; RM is adapted to
project drivers; plans are fully
aligned and integrated; risk
modeling is done well;
reporting is done based on
roles/needs; archived info used
Environment &
Principles
People are fearful to identify
risks or stymied in their efforts;
little trust between team and
stakeholders; RM may be
penalized because it is
considered disruptive; RM info
is seldom used; RM role is not
supported
ID-ing risks; RM plans are
developed but not generally
available; RM role weakly
supported; RM used
sporadically and ad hoc; RM
practice sometimes recognized
ID-ing risks is is accepted but
not promoted; RM plans are
made avaiable to team; RM
role is developed and
recognized; RM practice is
acknkowledged; some trust in
place but not consistent
ID-ing risks is expected and
encouraged; RM plans are
updated regularly and briefed
to team; RM practice is
rewarded; RM role is expected
as part of everyone's job;
generally high trust
ID-ing risks is actively sought
out by PM; RM plans are
integrated into roles and
processes; trust is strong and
communications is good; RM
process is seen as suportive of
project success