There is a range of risk maturity models but are they assessing what really matters? How high do you think the banks scored their risk maturity prior to the finance sector Royal Commission?

I know first-hand that there were many who thought they were highly ranked. The problem is, they probably were, using a poor ranking system.

When we talk about Fundamental, Developed, Systematic, Integrated, Advanced or Ad Hoc, Fragmented, Defined, Integrated, Optimized, what are we focused on? The process, not the outcome. Many will cry out, “No, to be optimised, you have to be focused on the outcomes.” I agree, however, the language is all process orientated, which means, your audience – the business – are thinking about the process, not about the outcome.

The more you can get the business to focus on the outcome you want, the more they will design their world to deliver it, rather than “follow a process” and fail to have the incredibly important conversations required to truly connect strategy and risk as two sides of the same coin.

Does your maturity model give you confidence that leaders and their teams are having those important conversations?