The State-of-The-Art of Enterprise Risk Management Maturity Models: A Review

Abstract

The risk management maturity model (RMMM) has the purpose of helping the firms in assessing their risk management practices and effectiveness in managing risks for various sectors, and yet there is a lack of studies in tracking the progress and status of RMMM at the enterprise level. Following this issue, the purpose of this research is to list and synthesize the RMMM and map their similarities and differences to determine and identify the state-of-the-art of the existing enterprise RMMM. The synthesizing process of the enterprise RMMM uses the approach of literature review on the existing RMMM established after the introduction of the ISO 31000 standard in 2009. Moreover, the enterprise RMMM of interest are the models that emphasize practicality instead of theoretically. The findings show that enterprise RMMM has its level of complexity and characteristics, indicating that not all maturity models are suitable for every firm, and the aspect of technology has an increase of importance within the current state-of-the-art of enterprise RMMM. Therefore, firms are recommended to select a RMMM that matches their risk management capabilities and effectiveness and capitalize on the advancement of technology to enhance their risk management maturity.