Take the survey

How mature are your risk management and internal control oversight processes? Answer these 12 questions based on the UK Corporate Governance Code (Provision 29) to find out.

Section 1: Board Oversight & Risk Appetite

1. Risk Appetite Definition: To what extent has the board formally defined, documented, and communicated the company's risk appetite, ensuring it aligns with strategic objectives and is regularly reviewed?(Required)

1. Risk appetite is undefined, inconsistent, or purely implicit. No formal link to strategy.

2. Basic understanding exists, possibly discussed informally or documented minimally, but not formally approved, communicated, or linked clearly to strategy.

3. Risk appetite is formally defined, documented (e.g., in a statement), approved by the board, and communicated to senior management. Reviewed periodically (e.g., annually).

4. Appetite is clearly defined with qualitative/quantitative elements, well-communicated, actively considered in strategic planning, and reviewed regularly with evidence of updates.

5. Appetite is dynamic, embedded in decision-making frameworks (capital allocation, M&A, etc.), uses tolerances/limits, tested via scenarios, actively monitored, and shapes organizational culture.

Mark your response (1 = Low Maturity, 5 = High Maturity) using the detailed scoring guide below each question.

Section 1: Board Oversight & Risk Appetite

2. Principal Risk Determination: How systematic and forward-looking is the board's process for identifying and evaluating the company's principal risks (including emerging risks)?(Required)

1. Risk identification is ad hoc, reactive, focused only on past events or obvious operational issues. No formal board review.

2. Some informal or inconsistent risk identification occurs, perhaps departmentally. Board receives limited, potentially outdated risk information.

3. A formal, documented process exists (e.g., annual workshops/surveys) to identify principal risks across key categories. Board reviews and approves the list.

4. Systematic process using multiple inputs (internal/external), considers likelihood/impact, explicitly includes emerging risks, and is reviewed/updated more frequently than annually.

5. Continuous environmental scanning, horizon scanning, scenario analysis, and stress testing used. Risk velocity/interdependencies assessed. Fully integrated with strategy cycle. Data analytics utilized.

Mark your response (1 = Low Maturity, 5 = High Maturity) using the detailed scoring guide below each question.

Section 1: Board Oversight & Risk Appetite

3. Board Engagement: How actively and frequently does the board (and relevant committees like Audit/Risk) engage in discussions and challenge management regarding risk exposures, mitigation strategies, and control effectiveness?(Required)

1. Board passively receives risk reports with minimal discussion or challenge. Risk is rarely a substantive agenda item.

2. Board occasionally discusses major risks, usually prompted by management or events. Limited probing or questioning of assumptions.

3. Risk is a regular agenda item. Board receives structured reports, asks clarifying questions, and discusses key mitigations. Focus primarily on known principal risks.

4. Board actively probes management reports, challenges assumptions constructively, requests evidence of mitigation effectiveness, and discusses risk appetite implications.

5. Deep dives into specific risks, strategic discussions integrating risk/reward, independent challenge, reviews effectiveness trends/metrics, ensures alignment with culture and incentives.

Mark your response (1 = Low Maturity, 5 = High Maturity) using the detailed scoring guide below each question.

Section 2: Risk Management Framework

4. Framework Formality: How formally established and comprehensive is the company's risk management framework (policies, procedures, roles, responsibilities)?(Required)

1. No formal framework exists. Risk management is informal, undocumented, and relies on individual knowledge.

2. Basic, fragmented policies or procedures exist for some risk areas. Roles and responsibilities are partially defined but may overlap or have gaps.

3. A documented framework (e.g., policy, key procedures) exists covering major risk categories. Roles (e.g., risk function, owners) are defined. Generally understood by relevant staff.

4. Comprehensive framework aligned with a standard (e.g., ISO 31000, COSO ERM), regularly updated, well-communicated. Includes clear methodologies (assessment, reporting).

5. Fully integrated framework, actively used and embedded in processes, supported by technology, continuously improved, and fosters a strong risk-aware culture.

Mark your response (1 = Low Maturity, 5 = High Maturity) using the detailed scoring guide below each question.

Section 2: Risk Management Framework

5. Integration with Strategy: To what extent is risk management integrated into strategic planning, decision-making, and performance management processes?(Required)

1. Risk management is a separate compliance exercise with little or no influence on strategy or key business decisions.

2. Risk is considered superficially or inconsistently in strategic planning. Major projects might have basic risk assessments, often late in the process.

3. Formal requirement to consider principal risks during the strategic planning cycle. Risk assessments inform some operational decisions.

4. Risk appetite and key risk exposures actively inform strategic options analysis, investment decisions, and target setting. Risk metrics are part of performance reviews.

5. Risk management is fully embedded ('risk-aware decision making'). Strategy explicitly balances risk/reward. Risk considerations drive resource allocation and innovation choices.

Mark your response (1 = Low Maturity, 5 = High Maturity) using the detailed scoring guide below each question.

Section 3: Internal Control Framework

6. Control Environment: How well-established and communicated are the company's internal control policies and procedures covering material financial, operational, and compliance areas?(Required)

1. Controls are ad hoc, undocumented, or rely solely on individuals. Little awareness or communication.

2. Some key financial controls are documented, but operational/compliance controls are patchy or informal. Communication is inconsistent.

3. Documented policies/procedures exist for significant financial, operational, and compliance controls. Accessible to relevant staff. Training occurs periodically.

4. Comprehensive control framework (e.g., based on COSO), clearly documented (narratives, flowcharts), regularly updated, effectively communicated through multiple channels. Control ownership is clear.

5. Control environment strongly emphasizes integrity/ethics ('tone at the top'). Controls are integrated with processes, continuously improved, and reinforced through training and performance management.

Mark your response (1 = Low Maturity, 5 = High Maturity) using the detailed scoring guide below each question.

Section 3: Internal Control Framework

7. Control Monitoring: How effectively are internal controls monitored for ongoing effectiveness, including regular testing and identification of deficiencies?(Required)

1. No formal monitoring. Issues identified only when failures occur or by external parties.

2. Some basic monitoring or checklists used inconsistently for key controls. Testing is infrequent or lacks rigor.

3. Regular management monitoring and/or periodic internal audit testing of key controls. Deficiencies are identified and tracked, but remediation may be slow.

4. Risk-based monitoring program covering financial, operational, compliance controls. Mix of ongoing monitoring and independent testing. Timely reporting and remediation tracking.

5. Continuous Controls Monitoring (CCM) using technology where feasible. Data analytics used for testing/monitoring. Proactive identification and root cause analysis of deficiencies. Metrics used to assess overall control health.

Mark your response (1 = Low Maturity, 5 = High Maturity) using the detailed scoring guide below each question.

Section 4: Annual Review & Assurance

8. Effectiveness Review Process: How rigorous and comprehensive is the board's *annual* review process for assessing the effectiveness of the risk management and internal control systems?(Required)

1. Review is a tick-box exercise, purely accepting management assertion without evidence or discussion.

2. Basic review occurs, perhaps focused only on financial controls or based on limited management reporting. Lacks clear scope or depth.

3. Formal annual review process documented. Considers management reports and internal audit summaries covering key systems for the period. Board discussion occurs.

4. Rigorous process using defined criteria for effectiveness. Considers multiple assurance sources, assesses design and operating effectiveness, covers financial, operational, compliance controls, and identifies areas for improvement.

5. Evidence-based review, explicitly links control effectiveness to principal risks, considers trends and forward-looking factors, challenges assurance providers, informs future strategy/investment.

Mark your response (1 = Low Maturity, 5 = High Maturity) using the detailed scoring guide below each question.

Section 4: Annual Review & Assurance

9. Assurance Sources: How effectively does the board leverage different sources of assurance (e.g., management attestations, internal audit, external audit, compliance reviews) to inform its annual effectiveness review?(Required)

1. Relies almost entirely on management self-assessment with little or no independent validation.

2. Primarily uses management information, with some limited input from internal or external audit focused on specific areas (e.g., finance).

3. Considers reports from management, internal audit (key findings), and external audit (financial control related). Understands the scope of each.

4. Actively seeks and integrates assurance from multiple lines (management, risk/compliance functions, internal audit). Understands limitations and overlaps. Assurance mapping may be used.

5. Coordinates assurance activities strategically (Combined Assurance model). Board critically evaluates the quality and scope of each assurance source. Synthesizes findings for a holistic view of effectiveness.

Mark your response (1 = Low Maturity, 5 = High Maturity) using the detailed scoring guide below each question.

Section 4: Annual Review & Assurance

10. Internal Audit Alignment: How well does the scope and focus of the internal audit function align with the principal risks identified by the board?(Required)

1. No internal audit function, or its plan has minimal connection to principal risks (e.g., purely compliance/financial checks).

2. Internal audit plan acknowledges principal risks but coverage is limited or resources primarily focus elsewhere (e.g., legacy audit areas).

3. Internal audit plan is developed with consideration of principal risks; key risks receive some audit attention during the year.

4. Risk-based internal audit plan clearly prioritizes principal risks (current and emerging). Audit activities provide direct assurance on mitigations for these risks.

5. Dynamic audit plan, continuously updated based on changing risk profile. Internal audit provides strategic insights on risk management effectiveness and anticipates future challenges.

Mark your response (1 = Low Maturity, 5 = High Maturity) using the detailed scoring guide below each question.

Section 5: Reporting & Technology

11. Annual Report Disclosure: How clear, comprehensive, and transparent is the company's disclosure in the annual report regarding its principal risks, risk management, internal control oversight, and the board's effectiveness review?(Required)

1. Disclosures are missing, minimal, generic ("boilerplate"), or fail to meet basic Code requirements.

2. Disclosures cover required elements superficially. Risk descriptions are vague; confirmation of review lacks detail on the process.

3. Meets Code requirements. Principal risks listed with brief mitigation descriptions. Confirms review occurred and covers key control areas (Fin, Ops, Comp).

4. Clear, entity-specific disclosures. Explains how principal risks are managed/mitigated, describes the review process, and states the board's conclusion on effectiveness (and any significant failings).

5. Highly transparent, insightful disclosures. Provides context on risk trends/changes, details the review scope/approach, explains linkage to viability statement, potentially uses graphics/metrics.

Mark your response (1 = Low Maturity, 5 = High Maturity) using the detailed scoring guide below each question.

Section 5: Reporting & Technology

12. Technology Enablement: To what extent does the company utilize technology (e.g., GRC software like Corporater) to support and streamline risk management, control monitoring, assurance activities, and board reporting?(Required)

1. Processes rely entirely on manual methods, standalone spreadsheets, email, and Word documents. Data is fragmented and hard to aggregate.

2. Some basic tools used in silos (e.g., a risk register spreadsheet, separate issue tracker). Limited automation or integration.

3. Point solutions used for specific tasks (e.g., risk assessment tool, basic control documentation repository). Some automation of reporting exists.

4. Dedicated GRC software or modules used for core processes (risk, controls, audit). Provides workflow, central repository, and improved reporting capabilities.

5. Integrated GRC platform (like Corporater) used strategically across multiple lines of defense. Enables continuous monitoring, data analytics, automated workflows, dynamic reporting, and provides a single source of truth.

Mark your response (1 = Low Maturity, 5 = High Maturity) using the detailed scoring guide below each question.

Enter your details below to receive your survey results on risk management and internal controls readiness in alignment with the UK Corporate Governance Code.

First Name(Required)

Last Name(Required)

Email(Required)

Organization(Required)

confirmation

Wondering how your approach compares to others? Talk to a Corporater specialist to discuss your results confidentially, learn how your programme score compares to your peers, and receive a complimentary copy of recommended internal controls list for UK CGC Provision 29.

CAPTCHA

Provision 29 Maturity Assessment

Take the survey

How mature are your risk management and internal control oversight processes? Answer these 12 questions based on the UK Corporate Governance Code (Provision 29) to find out.

Section 1: Board Oversight & Risk Appetite

Section 1: Board Oversight & Risk Appetite

Section 1: Board Oversight & Risk Appetite

Section 2: Risk Management Framework

Section 2: Risk Management Framework

Section 3: Internal Control Framework

Section 3: Internal Control Framework

Section 4: Annual Review & Assurance

Section 4: Annual Review & Assurance

Section 4: Annual Review & Assurance

Section 5: Reporting & Technology

Section 5: Reporting & Technology