Forum

Replies

• 

  M S Venkata Chalapathi February 28, 2011 17:42

  The maturity of an organisation's Risk Management processes should be tracked from no formal process to organisations where Risk Management is fully integrated into all Business aspects of the Organisation and this should be able to cover all types of Organisations.

   

  Normally there are 4 levels of Risk Management processes as given below depending on the stage of maturity. Risk Management culture is best at Level 4.

   

  Level 1 - Adhoc

  Level 2 - Initial

  Level 3 - Repeatable

  Level 4 - Managed

   
• 

  Urs Fischer February 28, 2011 16:33

  Stef,

  
  

  In ISACA's Risk IT Framework you find maturity models for each of the three domains:

  • Risk Governance
  • Risk Evaluation
  • Risk Response

  Boards and executive management need to consider how effective their enterprises are at managing IT risk and should be able to answer these related questions:

  
  

  • What are the enterprise's peers doing to manage IT risk, and how does the enterprise compare to them?
  • What are the proven good practices in IT risk management, and how does the enterprise compare to them?
  • Based on these comparisons, is the enterprise doing enough?
  • How does the enterprise identify what it needs to do to reach the level of IT risk management that is sought?

  It can be difficult to obtain meaningful answers to these questions. Management is constantly looking for benchmarking and self-assessment tools in response to the need to know what to do to achieve the best results. One such tool is maturity modelling, which can enable the enterprise to rate itself from the least mature level (having non-existent or unstructured processes) to the most mature (having adopted and optimised the use of good practices).

  When modelling maturity, it is useful to identify a limited number of levels. A larger number would render the system difficult to use and suggest a precision that is not justifiable. In general, the purpose is to identify where enterprises are for certain activities and suggest how to set priorities for improvements.

  The Risk IT maturity levels are designed as profiles in which an enterprise can identify symptoms or descriptions of its current and possible future states. Each enterprise will recognise that many of its processes are at different maturity levels; for example, some processes may be at level 1, some at level 3 and others at level 4. In this way, the maturity models are designed to enable management to focus on key areas needing attention, rather than on trying to get all processes stabilised at one level before moving to the next.

  Using the Risk IT maturity models, management can identify:

  
  

  • The actual performance of the enterprise - Where the enerprise is today
  • The enterprise's target for improvement - Where the enterprise wants to be

  In ISACA's Risk IT Framework for each domain, both high-level and detailed versions of the maturity model are provided. The detailed versions are built around the following attributes, each of which evolves through the categories:

  • Awareness and communication
  • Responsibility and accountability
  • Goal setting and measurement
  • Policies, standards and procedures
  • Skills and expertise
  • Tools and automation

  The maturity model scales can help management understand where shortcomings exist and set targets for where they need to be. The most appropriate maturity level for an enterprise will be influenced by the enterprise’s business objectives, the operating environment and industry practices. Specifically, the level of IT risk management maturity will depend on the enterprise’s dependence on IT, its technological sophistication and, most important, the future role its executives and management foresee for information technology.

  Best regards

  Urs
• 

  Alex Hindson February 28, 2011 14:58

  I have used risk management maturity models for some time. Happy to compare notes. They are very useful for setting a risk management strategy and happy to exchange ideas over email.
  alex.hindson@amlin.co.uk
• 

  Antoine PIERRE February 28, 2011 14:36

  In my research center we use the ISO 15504 maturity model.

  Some of my colleagues applied them to Basel II requirements.

  It may interest you.

  http://www.cssf.lu/en/info-kits/grif-project/

   
• 

  Vladimir PULCHART February 28, 2011 14:30

  Try www.rims.com - they have very good one.

   

  Vladimir

  http://www.rims.com/
• 

  Masatoshi Kajimoto, CISA, CRISC February 28, 2011 14:22

  ISACA material "Risk IT Framework" is useful.

  http://www.isaca.org/Knowledge-Center/Research/Documents/RiskIT_FW_...

   

  more detail is available from

  http://www.isaca.org/Knowledge-Center/Research/ResearchDeliverables...

  (ISACA members only)