How do we set target maturity levels without aiming for the top everywhere?

Start

Each domain needs a target before the assessment

A target is the level management decides a domain should reach, with the reason for it. Without one, every gap looks equally urgent. Setting Managed as the target everywhere is a common mistake: Managed costs measurement, a check by someone other than the person who does the work, and a record of improvement.

• Then: Has any evidence been scored in this assessment yet?

Decision

Has any evidence been scored in this assessment yet?

Targets come first. A target set after the results are known tends to settle at or just below the level found, which hides the gap. The dated approval is the evidence that this did not happen. If you are not sure whether scoring has started, treat it as started.

• Yes, or not known: Keep this cycle's targets; a change applies next time
• No: Does the domain apply to the organisation at all?

Outcome

Keep this cycle's targets; a change applies next time

A target changed after scoring has started is a new target for the next assessment, never for this one. The lead takes the request to the sponsor on that basis. If the sponsor has not approved targets before fieldwork, fieldwork waits until they have.

Decision

Does the domain apply to the organisation at all?

A practice can be Not applicable only for a reason the sponsor approves and the report states, never because it is weak. A domain whose practices are all Not applicable is left out of the result. If you are not sure, treat it as applying.

• No: Leave it out, with a reason the sponsor approves
• Yes, or not known: Does an obligation, an outside-appetite risk or a need rest on it?

Outcome

Leave it out, with a reason the sponsor approves

Record the reason in the assessment plan and the report's scope section. For example, a practice about notifying a regulator is Not applicable only where no notification duty applies.

Decision

Does an obligation, an outside-appetite risk or a need rest on it?

Look in your registers, not your instincts: an obligation that applies to you, a risk recorded as outside appetite, or a stated business need. A domain someone merely thinks is important has no reason yet. If you do not know, answer yes; the next question tests whether the reason asks for more than Defined.

• Yes, or not known: Does that reason need measurement and independent checking?
• No: Set Defined, naming any reason that rests on it

Decision

Does that reason need measurement and independent checking?

Managed adds three things to Defined: a measure with a target that is reported, a check by someone other than the person who does the work, and a record of an improvement made because of them. Ask whether the obligation or risk really needs those. Most obligations and auditors look for Defined. If the reason does not clearly need them, answer no.

• Yes: Set Managed, with the reason written beside it
• No, or not clear: Set Defined, naming any reason that rests on it

Step

Set Defined, naming any reason that rests on it

Defined is the default target: a written, agreed way of working, done routinely and leaving records. Where an obligation or risk rests on the domain, name it beside the target anyway. It decides which actions take priority later.

• Then: Does every Managed target name a reason that needs it?

Step

Set Managed, with the reason written beside it

Name the obligation or risk from the registers. Expect it to take time: a practice moves up one level per action, and Managed can be claimed only after it has run at Defined, with records, for the pack's default of six months. A practice far below Managed needs several steps across the roadmap.

• Then: Does every Managed target name a reason that needs it?

Decision

Does every Managed target name a reason that needs it?

Look at the set as a whole. A Managed target with no reason that needs measurement and independent checking goes back for review. In the pack's worked example, thirteen domains have the default, Defined, and one has Managed, for a named risk and obligation.

• No: revisit: Does an obligation, an outside-appetite risk or a need rest on it? (back to an earlier step)
• Yes: The sponsor approves every target, in writing and dated

Step

The sponsor approves every target, in writing and dated

The sponsor approves every target before any evidence is scored, and the approval is dated. If that has not happened by fieldwork, fieldwork waits. The targets then go with the report to the approver, who depending on how you are governed is the board or a board risk committee it has delegated to, the management board in a two-tier structure, or executive management where there is no board.

• Then: Once scored, is the domain below its target?

Decision

Once scored, is the domain below its target?

The gap is the target minus the domain's level, counted in levels: none when the target is met, up to three. Never turn it into points, a percentage or an average across domains. A count such as 'domains at target' describes the result without scoring it.

• Yes: Below target: each practice short of it gets an action
• No: At or above target: say so, and spend less effort there

Outcome

At or above target: say so, and spend less effort there

A domain at or above its target has no gap. The result says so, and the sponsor may lower the effort spent on it.

Outcome

Below target: each practice short of it gets an action

Every practice below its domain's target gets an action that moves it one level. Those resting on an obligation not met or a risk outside appetite go first. Turning the actions into a plan the budget can carry is the next question.