Risk Management maturity

Part A. Integrating risk management into business activities and decision making

Test how well risk management is integrated into decision making, planning and performance management. Completing this test honestly will help your organization set the right priorities and develop a roadmap for risk management 2.

Question Title

* 1. Integration into planning and budgeting

Risk management is integrated directly into planning and budgeting processes. Goals, objectives and annual budget are set based on the risk analysis

The results of the risk analysis are considered by the management when setting goals / forming the budget, however this is done ad-hoc and not formalized

Risks related to the achievement of strategic goals or budget are not analyzed or analyzed after the strategy or the budget have been approved

Question Title

* 2. The effect of risk analysis on objectives and budgets

There is a regular risk assessment process (annual, semi-annual, quarterly or monthly). Risk assessments are initiated and carried out on time, however the outcomes of risk assessments are not directly linked to the actualization of strategic goals and budgets.

The outcomes of risk analysis directly affect the revision of strategic goals and budgets

Strategic objectives and budgets are usually updated after risk events happen and loses are incurred, rather than preventively

Question Title

* 3. Integration into the decision-making processes

Significant strategic, budget or investment decisions are made by management only after conducting thorough risk analysis, alternatives are analysed and mitigation actions are discussed

Strategic and investment decisions are made by top management throughout the year without any systematic, structured or transparent risk analysis

The risk analysis is conducted only for some significant decisions, however this is done ad-hoc

Question Title

* 4. Discussing risks at the Board meetings

Issues related to risk management are discussed as part of each significant decision instead of as a separate agenda item. Risks are presented in a systematic, consistent and complete manner. In situations of high uncertainty risk management professionals are invited to the Board meeting to participate in the actual decision-making process

Issues related to risk management are discussed at the Board on a quarterly basis, once every six months or at least on an annual basis

Issues related to risk management are not regularly included on the Board’s agenda

Question Title

* 5. Documenting the outcomes from risk analysis

Some risk analysis is carried out, but the outcomes are not always documented

The outcomes of risk analysis are documented and included in the materials accompanying each significant decision

Risk analysis is informal and not documented at all

Question Title

* 6. Integration into core operational processes

Risk management is fully integrated into core operational processes, risks are analysed not at a given frequency, but as an integral part of the operating activities

Risks associated with the core operational processes are identified, assessed and managed at a given frequency (quarterly, semi-annually or on an annual basis)

The organization identifies, analyses and manages only those types of risks, which are regulated by law

Question Title

* 7. Risk management tools used

Risk assessment results are not documented

Risk assessment results are documented as heat maps and / or risk registers

Risk assessment results are documented in the form of business indicators or key performance indicators based on risk (CF@Risk, Earnings@Risk, RAROC, KPI@Risk, Schedule@Risk), which shows the effect of risks on the company's objectives

Question Title

* 8. Integration into the back-office processes (procurement, finance, IT, legal, etc)

Risk assessments on back-office processes and supporting functions are done informally or post factum

Risk management is fully integrated into back-office processes, risks are analysed not at a given frequency, but as an integral part of the operating activities

Risks associated with the back-office processes are identified, assessed and managed at a given frequency (quarterly, semi-annually or on an annual basis)

Question Title

* 9. Risk management disclosure in management reporting

Risk management information is not covered in financial or management reporting

Information on the existence of a systematic and integrated risk management approach, risk management procedures and the outcomes of the risk analysis are presented in the financial and management reporting in line with the ISO31000:2018 principles. Actions aimed at developing risk management culture are also covered

Organisation discloses risk management information in line with the minimum requirements for the preparation of annual reports and financial statements

Question Title

* 10. Interaction with Internal Audit

All internal audit and internal control activities (audit plan, structure of reports, scope of work) are based on risk information. Information about control weaknesses and internal audit findings are used by risk managers to perform quantitative risk assessments to support executive and Board decision making

Risk management processes are not linked to internal audit or internal control activities

Risk management professionals provide information about risks to the internal audit department to create a risk-based audit plans and to the internal control department to optimize the internal control system within the organization