Survey

Take our Risk Management Maturity survey below and then let’s discuss the results.

Global Resilience Solutions

How mature is your
Risk Management Program?

Market Research Survey Form (#3)

How would you describe Senior Management's commitment to Risk Management in your company?

Basic - Senior management demonstrates some awareness of the need to manage risk, however does not commit adequate resources to risk management, nor is there clear evidence of formal risk management guiding their decision making.

Developing - Senior management commits some resources to risk management, however these activities are focused on legal and regulatory compliance but are not linked to strategic and operational decision-making. The risk apetite is primarily to avoid risk rather than manage new opportunities.

Established - Senior management promotes the risk management framework across the entity and makes explicit its risk appetite, tolerance to risk and capacity for risk taking. A senior manager owns the risk management function and it is appropriately resourced. There is evidence of risk management being factored into senior management’s decision-making processes, but it is not formally embedded. Risk management processes include the identification of opportunities.

Integrated - Senior management demonstrates ongoing commitment to risk management activities and their ongoing development across the entity. Senior management is proactive in ensuring that risk management is adequately resourced. Senior management encourages managed risk taking associated with innovative approaches to the entity’s activities and to new business opportunities. Senior management considers risk as part of its strategic planning process.

Optimised - Senior management drives the integration of risk management at both strategic and operational levels. Risk is incorporated into all senior management decision making and when setting objectives for the entity. Senior management commits to continual improvement in its approach to risk management and has adopted relevant leading practice.

Which best describes how well your company's responsibility structures support risk management?

Basic - Some staff are aware of the need to assess and manage risk. These staff have basic knowledge of risk management principles. There is no central coordination of risk management for the entity.

Developing - Key staff are provided training and guidance material to assist in the management of risk. A central person/team leads risk management, but there is little input from across the entity more broadly.

Established - Key staff have the skills and knowledge to manage risk effectively and they assign clear responsibility for managing risk across business units, but there is no formal accountability mechanisms to monitor how risk management is being applied.

Intregrated - Risk owners have relevant skills and knowledge to manage risk effectively and regular training is available to staff to enhance their risk management skills. Staff are held accountable for managing risk and their roles in risk management have been clearly articulated to them. A central risk management team has formal risk management responsibilities.

Optimised - All staff have responsibility for risk management and it is embedded in all the entity’s processes. Responsibility for risk management is incorporated into duty statements, performance agreements and annual performance assessments. A central risk management team has developed leading practice methodologies to support ongoing risk management activity.

Which statement best describes the degree of integration of risk management across key business areas?

Basic - Risk assessment processes are ad hoc, stand-alone activities and are not supported by established policy or procedures. Risk management activities are managed manually or in simple tools that are developed in isolation of the entity’s operational context and systems.

Developing - Risk management processes are being developed but they are applied inconsistently across the entity and are not integrated into key business processes and planning.

Established - Risk management processes have been implemented in key areas. Specific risk assessments have been undertaken in areas of potential high exposure (e.g. fraud risk assessments).

Integrated - Standardised risk management processes are an integral part of the entity’s core operations. The entity’s systems have the capacity to meet the ever-changing business and risk environment.

Optimised - Risk management strategies and processes are integrated as part of all business processes. Risk management activities are managed within sophisticated systems that highlight exceptions, report risk events and prompt staff for remedial action when required.

Is there a suitable monitoring system of treatments and does response include a crisis management framework?

Basic - Risk treatments have been identified for some risks but there is no formal mechanism for assessing their effectiveness nor a formal crisis management framework.

Developing - Risk treatments are assessed to ensure that risks are managed in accordance with the entity’s risk appetite and risk framework. A crisis management plan exists but is not exercised nor adequately maintained.

Established - Risk treatment plans include alternative courses of action and cost/benefit analyses of treatments. There is a formal process of monitoring treatments and an effective crisis management framework in place.

Integrated - Responses to risks are commensurate to the level of risk, including risk appetite and tolerances to risk defined across the entity (risks are not under or over controlled). Responses address the root cause of risks and crisis management lessons are learned by the organisation. Treatments are assigned to a specific risk owner.

Optimised - Exception reports highlight instances where risks fall outside the maximum tolerances. There is an independent review of all risks and treatment plans to ensure consistent treatment. The results of an assessment of treatment effectiveness are shared across the entity and remediation is closely managed. Crisis management is independently reviewed annually.

Which statement best describes the extent of ongoing activity to monitor the entity’s risk profile?

Basic - Risk policies and basic risk registers are provided to senior management for review on an ad hoc basis, but no risk performance monitoring reports are provided to senior management. Risk is a standing agenda item for the risk management committee.

Developing - Senior management review and discuss risk as part of management meetings on a regular basis. Risk performance monitoring reports are provided to senior management.

Established - Risk is a standing agenda item for executive management meetings. Concise reports (backed up by more detailed information as required) highlighting exceptions are provided to allow senior management to focus on issues that require attention.

Integrated - Senior management routinely reviews and discusses the risks that could cause the greatest impact on the entity and on achieving its strategic objectives. These discussions are supported by integrated risk, performance and financial information linked to the entity’s objectives. There is a process for monitoring changes to the external environment that may impact the entity’s risk profile, but the process is not systematized.

Optimised - Systems are in place to support the ongoing review of the entity’s risk management strategies, including key risk performance indicators that allow management to monitor the effectiveness of risk management activities. The entity’s risk management framework is regularly benchmarked to external best practice. There is ongoing environmental scanning to identify trends and external factors that may impact the entity.

First Name

Last Name

Phone

Contact Method

Cookie	Duration	Description
cookielawinfo-checkbox-analytics	11 months	This cookie is set by GDPR Cookie Consent plugin. The cookie is used to store the user consent for the cookies in the category "Analytics".
cookielawinfo-checkbox-functional	11 months	The cookie is set by GDPR cookie consent to record the user consent for the cookies in the category "Functional".
cookielawinfo-checkbox-necessary	11 months	This cookie is set by GDPR Cookie Consent plugin. The cookies is used to store the user consent for the cookies in the category "Necessary".
cookielawinfo-checkbox-others	11 months	This cookie is set by GDPR Cookie Consent plugin. The cookie is used to store the user consent for the cookies in the category "Other.
cookielawinfo-checkbox-performance	11 months	This cookie is set by GDPR Cookie Consent plugin. The cookie is used to store the user consent for the cookies in the category "Performance".
viewed_cookie_policy	11 months	The cookie is set by the GDPR Cookie Consent plugin and is used to store whether or not user has consented to the use of cookies. It does not store any personal data.

Survey

Global Resilience Solutions

How mature is your
Risk Management Program?

Global Resilience Solutions

Contact Us For A Confidential Risk Discussion

Request A Callback

Survey

Global Resilience Solutions

How mature is yourRisk Management Program?

Global Resilience Solutions

Contact Us For A Confidential Risk Discussion

How mature is your
Risk Management Program?