Your risk framework is mature - but is it actually working?

Most risk teams can answer the question "is it in place?" with confidence. The framework exists. The policies are documented. Roles and responsibilities are defined, governance is established, training has been rolled out and reporting is running on schedule.

But when boards and audit and risk committees ask a different question - "is it actually working?"- the answer is often harder to give.

This distinction, between risk maturity and risk effectiveness, has become one of the most active conversations across Risk Leadership Network. Through recent member discussions, pulse checks and benchmark research, a consistent theme has emerged: foundational maturity assessments remain valuable, but they don't tell you whether your frameworks, controls and governance structures are being applied, influencing decisions and helping to manage risk in practice.

"You still need to measure the fundamentals, but you also need to look at how they're used."

RLN member

ASX 100 organisation

1. Maturity asks 'is it in place?' Effectiveness asks 'is it working?' 

A mature framework can still sit on the shelf. A risk register can be beautifully structured and completely stagnant. Training completion rates can hit 100% while risk is never invited into a single decision-making conversation.

This is why organisations, including many listed entities responding to requirements such as ASX Principle 7 in Australia or UK entities looking to demonstrate risk and control effectiveness to their boards to satisfy Provision 29 requirements, are now running risk effectiveness assessments alongside their maturity work. The goal is to give boards, committees and executives confidence that risk management is embedded, understood and genuinely working, not just documented.

One approach shared within the network separates the assessment into two distinct parts:

By anchoring the effectiveness review to material risks rather than the framework itself, the assessment shifts from paperwork to performance - and produces something a board can actually act on.

2. The tell-tale signs a framework isn't working

3. What effective organisations do differently 

The strongest approaches shared across our network don't rely on a single measure. They combine several lenses (e.g. framework use, behaviour and culture, business performance, and assurance) to build a rounded picture. Crucially, they translate risk into the vernacular of the business, linking it to the drivers and indicators leaders already use, rather than asking the business to think only in risk language.

And when it comes to the board, less is more. Effectiveness reporting doesn't need to be a checklist. It needs to demonstrate that a structured assessment has been completed, material issues have been surfaced, and management can form a defensible view on whether the risk management system is working.

Go deeper with Risk Leadership Network

This is a high-level summary from recent collaborations in our network. To speak directly with peers who have tackled the same challenges as you, on risk effectiveness or another priority, book a 15-minute exploratory call.