VI: Conclusion

In conclusion, maturity models serve as invaluable tools for organizations aiming to enhance their capabilities across various domains, such as risk management, cybersecurity, and project management. These models offer structured frameworks to assess current practices, define clear paths for improvement, and benchmark against industry standards. By progressing through defined stages of maturity, organizations can systematically refine their processes, making informed decisions that align with their strategic goals. The implementation of these models not only aids in achieving operational excellence but also fosters a culture of continuous improvement and proactive management.

The CFIA provides a compelling example of this approach in action. By utilizing the R3M to evaluate and enhance its enterprise risk management practices, CFIA has set a benchmark that other Government of Canada departments can learn from. These departments can adopt similar maturity models to identify strengths and weaknesses, develop comprehensive risk management frameworks, and foster a culture of continuous improvement. Through consistent application and regular assessment, government entities can navigate their journey towards higher levels of maturity, thereby enhancing their overall effectiveness, resilience, and ability to achieve strategic objectives in an ever-evolving landscape.

References

• Albliwi, S. A., Antony, J. and Arshed, N. (2014). Critical Literature Review on Maturity Models for Business Process Excellence, 2014 IEEE International Conference on Industrial Engineering and Engineering Management, Selangor, Malaysia, pp. 79-83.
• AXELOS (n.d.). The Framework for the Management of IT-enabled Services. Available at https://www.axelos.com/certifications/itil-service-management (Accessed 2024)
• Chrissis, M. B., Konrad, M., & Shrum, S. (2011). CMMI: Guidelines for Process Integration and Product Improvement. Addison-Wesley Professional.
• Committee of Sponsoring Organizations (COSO) (2023). Compliance Risk Management: Applying the COSO ERM Framework. Available at https://www.coso.org/erm-framework
• Humphrey, W.S. (1989). Managing the Software Process. Addison-Wesley Professional.
• International Organization for Standardization (2018). Risk Management – Guidelines (ISO Standard No.31000:2018). Available at https://www.iso.org/obp/ui/fr/#iso:std:iso:31000:ed-2:v1:en
• Institute of Internal Auditors (IIA) (2020). The IIA’s Three Lines Model: An update of the Three Lines of Defense. Available at https://www.theiia.org/globalassets/documents/resources/the-iias-three-lines-model-an-update-of-the-three-lines-of-defense-july-2020/three-lines-model-updated-english.pdf
• Institute of Internal Auditors (IIA) (2018). Selecting, Using, and Creating Maturity Models. Available at https://www.theiia.org/en/content/guidance/recommended/supplemental/practice-guides/selecting-using-and-creating-maturity-models/ (Behind a paywall)
• Kerzner, H. (2017). Project Management Maturity Model, Fourth Edition. Wiley.
• LogicManager (2015). ERM Program Audit Guide: Risk Maturity Model: Assessing the Adequacy and Effectiveness of Risk Management. Available at https://www.logicmanager.com/resources/audit/risk-maturity-model-audit-guide/
• Paulk, M.C., Curtis, B., Chrissis, M.B., & Weber, C.V. (1993). Capability Maturity Model for Software, Version 1.1, IEEE Software, vol. 10, no 4, pp.18-27.
• The Risk Maturity Model (RMM) (n.d.). Risk Management Benchmarking and Progress. Available at https://www.riskmaturitymodel.org/risk-maturity-model-rmm-for-erm/#:~:text=The%20Risk%20Maturity%20Model%20(RMM,risk%20management%20(ERM)%20program.
• Röglinger, M., Pöppelbuß, J. et Becker, J. (2012). Maturity Models in Business Process Management, Business Process Management Journal, vol. 18, no. 2, pp. 328-346.
• Treasury Board of Canada Secretariat (2011). Risk Management Capability Model. Available at https://www.canada.ca/en/treasury-board-secretariat/corporate/risk-management/capability-model.html
• Treasury Board of Canada Secretariat (2010). Framework for the Management of Risk. Available at https://www.tbs-sct.canada.ca/pol/doc-eng.aspx?id=19422
• U.S. Department of Defense (2022). Securing the Defense Industrial Base – CMMC 2.0. Available at https://web.archive.org/web/20220125222816/https:/www.acq.osd.mil/cmmc/index.html

Annex

Table 2 - Risk Management Maturity Model: Rating Guidance by Key Area