What actions can you take to improve your risk maturity and capability?

In my opinion,not a single Model will help to classify the risk maturity level and improve capabilities.COSO ERM 2017 can give good insights on organizational risk related current status ,ISO 31000 can help us on improving capabilities, GRMM can help in assessing the current risk management mechanism with identifying vulnerable areas . OCEG GRC capability model can help in improving further the capability, In a nutshell, 360 degree approach from all the above mechanism can address the issue more effectively as far as maturity level and capability improvement is concerned for an organization!

I think the first thing to do is to locate where you are in terms of risk maturity. You can use Maturity Models like the RIMS Risk Maturity Model or the Hillson Maturity Model etc. Once you identify at which level you fall, you can develop additional strategies to get you to the highest level. You can then update your risk management policy to incorporate the new strategies

Frameworks such as COSO ERM or ISO 31000 do not help with understanding the maturity. These are the frameworks helping to understand the essentials to understand risk management process. Maturity models such GRMM (generic risk maturity model) can help measuring the maturity of risk management

Look objectively at each element of your risk framework. Don't have a risk framework? There's a place to start! The risk framework should be adapted to the nature and complexity of the organization. For example, a start-up would benefit from incorporating risk management at a very high level, but a start-up in a regulated industry like financial services will require a more sophisticated approach although not to the same degree as large, established banks. Identify best practices and expected standards in the relevant industry and perform a gap analysis to establish a benchmark future state. Factor in data from audits and any regulatory exams, as well as internal reviews and incidents. Prioritize issues and actions. Educate & communicate.

Research best practices, benchmark your practices, create an annual action plan with appropriate funding for improvements, assign accountabilities, report and assess regularly.

Risk appetite is amount of risk your organization can take and not you. Defining risk appetite needs that first the type of risks are identified. Afterwards the risk appetite per risk can be defined using relevant stakeholders and the board

It is necessary to write a risk management policy that acts as an integral point between other policies when it comes to integrated risk management. Risk management policy describes an organization risk management process, risk appetite and different responsibilities of 3LoDs.

We need to define our risk appetite and all the employees of the legitimate should have clear idea about the risk management policy. An informed communication will solve 99% issues.

Improving risk management culture requires top management support and tone from the top. Otherwise any risk management program will be subject to failure.

Risk Culture: Create positive culture, engage senior management, train employees, as well the tone at the top. Processes: Implement formal process, use tools, conduct stress tests, less bureaucratic and more disruptive, yet without losing control, for the better. Monitoring: Monitor emerging risks, assess effectiveness, improve processes. Communication: Communicate risks, promote dialogue, be transparent, show the gain on implementing controls. Technology: Invest in tools, use AI and data analysis, automate tasks (less human effort).

The value of a monitoring program is not measured by the number of gaps identified alone; instituting a rigorous and repeatable process is an indispensable element of developing your risk culture, because it sends a clear message to the entire organization that these are things everyone needs to care about.

Consider adopting a comprehensive risk management framework. Foster a risk-aware culture within your team, encouraging continuous learning and adaptability. Periodically review and update your risk management processes to align with evolving organizational goals and external factors. Collaborate with stakeholders to ensure a holistic approach to risk management. By consistently refining your risk management practices, you'll strengthen your organization's ability to navigate uncertainties and improve overall risk maturity.