Risk Maturity: Beyond Systems, Scores and Safety

A map for conversation, not a measure of certainty…

Have you ever heard someone say, “We need to improve our risk culture”? It sounds sensible, but what do we mean by maturity, and whose understanding of risk establishes whether an organisation is mature?

My background is in work health and safety, where maturity is often framed as movement from being reactive and compliance-focused towards being proactive. Yet risk does not belong to the safety function, nor does it sit neatly inside a risk register. Risk is present whenever people make decisions amid uncertainty. It lives in governance, strategy, finance, technology, workforce, safeguarding, service delivery, reputation and relationships with community.

Perhaps risk maturity is therefore less about how well an organisation administers risk and more about how well people collectively make sense of uncertainty.

The Risk Maturity Matrix

Patrick Hudson’s maturity model describes five broad cultural orientations: pathological, reactive, calculative, proactive and generative. Dr Robert Long further developed this thinking through the Human Dymensions Risk and Safety Maturity Matrix (copy below, shared with permission), emphasising that mature organisations move beyond mechanistic systems towards risk intelligence, learning, relationships and an understanding of the social arrangements that shape judgement.

Figure 1 – Risk and Safety Maturity Matrix as Developed by Dr Robert Long

The matrix matters because it shifts our attention from hazards and objects towards people and culture. An organisation can have polished policies, dashboards and assurance systems while remaining immature in how it listens, questions and responds.

• Pathological: Risk is neglected, concealed or treated as somebody else’s problem.
• Reactive: Attention intensifies after failure, loss or crisis.
• Calculative: Systems, measures, controls and compliance dominate.
• Proactive: People seek weak signals, emerging concerns and opportunities to learn.
• Generative: Risk intelligence is woven into everyday relationships, decisions and work.

The seduction of the calculative

Systems are necessary. They provide consistency, clarify expectations and allow many routine activities to occur without constant conscious effort. The problem is not that organisations have systems, but that systems can become substitutes for thinking.

The calculative organisation can count incidents, complaints, staff turnover, audit findings, financial variances and overdue actions. It can colour risks red, amber and green. Yet does a green dashboard mean that risk is understood, or simply that nothing has disrupted the measures being reported? Does a low number of reports indicate success, or silence?

Risk is not only objective. People interpret uncertainty through experience, values, relationships, social pressures and feelings. A matrix score cannot tell us why someone may place a hand near an unguarded opening, stay silent about a concern, accept an optimistic financial assumption or work around a cyber control to complete an urgent task.

Numbers can inform a conversation. They cannot replace one.

Meeting people, not merely requirements

Earlier in my own learning about risk from a social psychological lens, I wrote that mature organisations focus on ‘meeting’ people rather than merely ‘meeting’ legislation. That idea remains central to the Risk Maturity Matrix. Compliance may tell us what ought to be in place; conversation helps us understand how work is actually experienced and enacted.

This means noticing risk iCues[1]: distraction, rushing, overload, silence, workarounds, repeated frustration or the quiet withdrawal of people from conversation. None of these cues proves that something is wrong. They are invitations to pause, listen and inquire.

It also means balancing tightly coupled systems with sufficient looseness for adaptation. Mature organisations do not abandon controls. They understand when standardisation matters and when people need discretion, local expertise and room to improvise. This calls for relationships strong enough to discuss workarounds rather than drive them underground.

Beyond WHS

The same maturity lens applies across the organisation. A board may be calculative in governance, proactive in finance and reactive in psychosocial risk. A service team may be generative in responding to clients but constrained by rigid organisational systems. Culture is not a single score, nor is maturity a permanent label.

Across governance, people, technology, finance, reputation and service delivery, maturity involves movement from knowing, fixing and defending towards noticing, listening, questioning and learning. It asks not only, ‘What controls do we have?’ but also, ‘How do people live within them, and what by-products do they create?’

A map, not the territory

There is a risk in the Risk Maturity Matrix itself. We can turn it into another audit, assign a level and announce that the organisation is proactive or generative. But culture is messier than that. It shifts across teams, risks, pressures and relationships.

The matrix is better understood as a map for conversation and a metaphor for understanding risk maturity. It helps us orient ourselves, but cannot capture every hidden path, local story or changing condition. Its value lies less in locating the organisation in a box and more in the questions it enables us to ask.

• What happens when someone raises uncomfortable news?
• Which risks are easy to discuss, and which remain unspoken?
• Do our systems support judgement, or substitute for it?
• What trade-offs and workarounds are people making?
• Whose expertise is heard when uncertainty emerges?
• What might our measures be concealing?
• Are we learning, and how would we know?

A more mature place to begin

A generative organisation is not one without failure. Nor has it controlled every uncertainty. It has developed a more mature relationship with uncertainty: making space for bad news, dissent, weak signals, reflection and learning.

Risk flows through the whole organisation because uncertainty flows through the whole organisation. Perhaps maturity begins when we stop treating risk as the responsibility of a function and recognise it as something we discern together.

The Risk Maturity Matrix does not give us certainty. It may, however, help us meet people, notice more and ask better questions. And perhaps that is a more mature place to begin.

[1] A term developed by Dr Robert Long from the Centre of Leading and Learning in Risk (CLLR)