GRC · Guide
GRC maturity model: the five levels and the evidence that proves each one
GRC maturity model: the five levels and the evidence that proves each one
Key takeaways
A GRC maturity model scores how reliably a firm runs governance, risk and compliance, from level 1 (initial) to level 5 (optimising). Each level should be proved by evidence, scored separately for governance, risk, compliance, and evidence and monitoring. Most UK regulated firms with 25 to 250 staff should reach level 3 on every strand first, then reach level 4 through continuous monitoring and automated evidence.
- Origin of the five levels
- The CMMI Institute's maturity levels run from 0 (incomplete) to 5 (optimising), each building on the rigour of the one below; GRC maturity models borrow that shape.
- GRC Capability Model
- OCEG's GRC Capability Model, version 3.5, also called the Red Book, describes the capabilities an integrated GRC system needs rather than a ladder of maturity levels.
- SYSC 4.1.1R
- The FCA's SYSC 4.1.1R requires robust governance arrangements: a clear organisational structure with consistent lines of responsibility, effective risk processes and internal control mechanisms.
- Board reporting
- The Cyber Governance Code of Practice, launched on 8 April 2025, asks boards to require formal reporting at least quarterly, with metrics and agreed tolerances.
The risk committee has asked a simple question: how mature is our governance, risk and compliance, really? The honest answer sits somewhere between "better than last year" and "it depends who you ask". A GRC maturity model turns that answer into a score your board, auditor or FCA supervisor can test.
This guide is for COOs, compliance leads and heads of risk at UK regulated firms and insurers with 25 to 250 staff. It defines each of the five levels by the evidence that proves it, shows how to score four strands in an afternoon, and explains why level 3 is the right first target.
What is a GRC maturity model?
A GRC maturity model scores how reliably a firm runs governance, risk and compliance on a scale, usually from level 1 (initial, or ad hoc) to level 5 (optimising). Each level should be proved by evidence a reviewer can inspect, not described by adjectives. Most small regulated firms should aim for level 3 first.
The five-level ladder comes from process improvement. The CMMI Institute's maturity levels run from 0 (incomplete) to 5 (optimising), and each level builds on the rigour of the one below. GRC models borrowed that shape and usually start at level 1.
GRC also has its own reference model. OCEG publishes the GRC Capability Model, now at version 3.5 and known as the Red Book. It describes the capabilities an integrated GRC system needs, rather than a ladder of levels, so it is a useful reference for what good contains.
This guide reproduces neither model. It takes their shared idea: maturity is how predictably the work happens, and how well you can prove it.
What are the five levels of GRC maturity?
The five levels of GRC maturity are initial, managed, consistent, measured and optimising. At level 1 the work depends on individuals. At level 3 it follows a defined process that repeats across the firm. At level 5 it improves itself from its own results. The table defines each level by what you would see and what proves it.
| Level | What you see | Evidence that proves it | Next move |
|---|---|---|---|
| 1. Initial | Work happens after something goes wrong, and one or two people hold it all | Documents exist, but there is no record of anyone reviewing or using them | Name an owner for each activity and list the firm's top risks |
| 2. Managed | Policies and a risk register exist, and each team runs them its own way | Named owners and a dated register, with review records kept unevenly | Define one method per activity and put it on a calendar |
| 3. Consistent | Defined processes run on a calendar, the same way across the firm | Dated minutes, completed reviews and closed actions, produced by the same method every time | Agree metrics and tolerances, and start collecting evidence automatically |
| 4. Measured | Results are measured against agreed tolerances and reported upwards | Trend data, tolerance breaches and the decisions each breach triggered | Feed results back into controls, priorities and risk appetite |
| 5. Optimising | The system changes itself in response to what the measures show | A record of changes made because the data said so | Keep it proportionate, and re-test the lower levels each year |
Each level includes the ones below it. A strand cannot sit at level 4 if its level 3 evidence is missing.
What evidence proves each level, strand by strand?
Score GRC maturity across four strands, because firms rarely mature evenly: governance and ownership, risk, compliance, and evidence and monitoring. Each strand has its own proof at each level. The table below gives the evidence a board, auditor or supervisor would accept, from level 1 to level 4, for each one.
| Strand | Level 1 | Level 2 | Level 3 | Level 4 |
|---|---|---|---|---|
| Governance and ownership | No named owners | Owners named in a document | Owners meet in a regular forum, with minutes and tracked actions | The board receives metrics against agreed tolerances and acts on breaches |
| Risk | Risks known informally | A register exists, reviewed when someone remembers | The register is reviewed on a calendar, appetite is agreed and actions close | Risk indicators are tracked against appetite between reviews |
| Compliance | Obligations met when someone asks | Obligations listed | Obligations mapped to controls and owners, and checked on a schedule | Control results are tested continuously and reported as trends |
| Evidence and monitoring | Evidence gathered in a rush before an audit | Evidence kept in one place | Evidence collected on a schedule, by the same method each time | Evidence collected by the systems themselves, with gaps flagged automatically |
Level 5 is left out on purpose. For firms of this size it describes a direction of travel, not a state you would be asked to evidence.
If someone has asked you for a risk maturity model or a compliance maturity model, the matching row is a self-contained version of one. Scoring all four rows on the same scale keeps them comparable, and shows the board where the weak strand is.
How do you assess GRC maturity in an afternoon?
Assess GRC maturity in an afternoon by scoring each strand separately against evidence, not opinion. Put the owners of each strand in one room, ask to see the proof each level requires, and record the highest level whose evidence everyone can see today. The result is a profile of four scores, not one number.
- Book the right people. The COO or equivalent, the compliance lead, the risk owner and whoever pulls evidence together for audits.
- Work one strand at a time. Start at level 1 and move up. Stop at the first level whose evidence you cannot produce in the room.
- Ask to see, not to hear. For each level claimed, open the artefact: the last risk review minutes, the latest board report, the dated evidence for one control.
- Record a profile. Write the result as four numbers, for example governance 3, risk 2, compliance 3, evidence and monitoring 1.
- Choose one next move per strand. Take it from the level table, and start with the lowest strand.
- Re-score on a schedule. We recommend once a year, and after any major change such as a new regulated activity or an acquisition.
The discipline is the same one behind an ISO 27001 gap analysis: compare what happens with what is required, and write down the proof. If you already run one, its findings feed the compliance and evidence strands directly.
Why is level 3 the right target for most small regulated firms?
Level 3 is the right target for most regulated firms with 25 to 250 staff because it proves what boards and supervisors test first: that governance, risk and compliance run the same way every time, with records to show it. Levels 4 and 5 add measurement and self-improvement, which pay off once level 3 holds.
The FCA's SYSC 4.1.1R asks firms for robust governance arrangements. That includes a clear organisational structure with consistent lines of responsibility, effective processes to identify, manage, monitor and report risks, and internal control mechanisms. For common platform firms, SYSC 4.1.2R adds that these must be proportionate to the nature, scale and complexity of the risks in the business. Other firms take account of it as guidance.
Consistent is the word that does the work. A level 3 firm can show each of those arrangements running on a calendar, with an owner and a record.
We recommend reaching level 3 on every strand before pushing any single strand to level 4.
What does level 4 change, and how do you reach it?
Level 4 changes how you know GRC is working. Instead of confirming that a review happened, you measure results against agreed tolerances and see drift as it happens. For a small firm, level 4 comes from engineering, through continuous monitoring and automated evidence, not from hiring more people to check more often.
Three things mark the shift:
- Metrics with tolerances. Each strand has a small set of measures, each with an agreed tolerance and an owner who acts on a breach. If you run ISO 27001, clause 9.1 already asks you to decide what to monitor and measure, and ISO/IEC 27004 gives guidance on how.
- Continuous monitoring. Controls are checked as they run, not sampled once a year. NIST SP 800-137 is the reference guide to information security continuous monitoring.
- Automated evidence. The systems that operate a control record that it ran, on a schedule, so nobody has to assemble the proof before an audit.
A metric compiled by hand each quarter tends to stop the quarter its owner is busy. That is why engineering, not headcount, is the route to level 4 for a lean firm.
If the evidence needs a person to assemble it, the control is still at level 3.
How does GRC maturity map to UK expectations?
GRC maturity maps to three UK reference points. The Cyber Governance Code of Practice sets out what boards should oversee, SYSC 4.1.1R sets the FCA's governance requirement, and the NCSC Cyber Assessment Framework shows how to assess outcomes rather than documents. None of them uses maturity levels, but each shows what evidence counts.
Board oversight. The government's Cyber Governance Code of Practice, launched on 8 April 2025, sets out the governance actions boards and directors are responsible for. It covers five areas: risk management; strategy; people; incident planning, response and recovery; and assurance and oversight. It was designed for medium and large organisations, and says small organisations should seek to apply its principles. Its assurance and oversight actions ask boards to require formal reporting at least quarterly, with metrics and agreed tolerances. That is level 3 discipline with a level 4 ingredient.
Robust governance. SYSC 4.1.1R, set out in the level 3 section above, is the requirement most FCA-regulated readers will be judged against. Because it describes outcomes rather than documents, evidence of practice matters more than a policy library.
Outcome-based assessment. The NCSC Cyber Assessment Framework, now at version 4.0, is written for organisations operating essential services, so most firms reading this will not be assessed against it. It is still the clearest UK example of assessing outcomes. Each contributing outcome is judged achieved or not achieved, some also allow partially achieved, and the NCSC says its indicators of good practice are not a checklist.
Borrow the method, not the scope: score what happens, not what is written.
What are the common mistakes with a GRC maturity model?
The common mistakes with a GRC maturity model are averaging the strands into one number, scoring documents instead of practice, and aiming for level 5. Each one makes the score look better than the firm really is, which is the opposite of what a board or supervisor needs from a maturity assessment.
- Averaging the strands. A profile of 4, 4, 3 and 1 averages to 3. The 1 is where the next incident or audit finding will come from.
- Scoring documents, not practice. A policy that exists but is not followed proves nothing. Ask for the record of the activity, not the document that describes it.
- Aiming for level 5. For a firm of 25 to 250 people, the cost of optimising every strand rarely matches the risk it removes. Proportionality is part of good governance, not a shortcut around it.
- Letting owners score alone. People rate their own strand generously. A second person who asks to see the evidence keeps the score honest.
- Treating the score as the goal. The score is a way to choose the next move. A firm that games it learns nothing from it.
A policy nobody follows is a level 1 control with level 3 formatting.
Frequently asked questions
Initial, managed, consistent, measured and optimising. Names vary between models: some call level 3 "defined", after CMMI, and CMMI itself adds a level 0 for incomplete work. Before you compare scores from two sources, map each one to the same ladder so a 3 means the same thing in both.
Score each strand against evidence you can see, with a second person challenging each score. Keep the list of artefacts you checked, because next year's re-score is only comparable if it tests the same things. A score without its evidence list is an opinion with a number attached.
Raise the lowest strand first, one level at a time. Choose improvements that produce their own evidence, such as a review that writes its own minutes or a control that logs its own results. Skipping a level rarely holds, because the level above depends on the routine below it.
It depends on the strand and how often its activities run. A level is only proved once its evidence exists for at least one full cycle: a quarter of board reports, or a complete annual review. We recommend planning each step in quarters rather than weeks.
No. An audit tests against a standard and gives an opinion or findings from someone independent. A maturity assessment is your own structured judgement of how reliably the work runs. It is a useful input to the board and to an audit plan, but it gives no assurance on its own.
Domain engine
GRC reference directory.
Every guide in this domain, grouped by level — fundamentals, intermediate and advanced. Open any entry for its core practices, implementation steps and the evidence it produces.
01Fundamentals9 guides
Policy vs procedure: the difference between policy and procedure, and where standards fitGRC vs IRM: what integrated risk management adds, and whether a smaller regulated firm needs itGRC career path: roles, skills and certifications from analyst to head of GRCGRC roles and responsibilities: who owns what in a lean GRC teamIn-house, consultant or compliance as a service: which GRC model fits a 25 to 250-person tech firmGRC, financial services and the UK rulebook: what the FCA, PRA and DORA expect of a smaller regulated firmSaaS compliance for B2B tech firms selling into regulated industries: what your customers' regulators push down to youWhat GRC costs: a cost model for a 25 to 250-person UK firmGRC framework: how to structure one in a regulated firm
02Intermediate1 guide
GRC Programme Accelerator
Ready to run GRC as one system, not three spreadsheets?
Work with a Trust Architect to design a GRC programme that fits a 25 to 250-person firm: scoped, owned and built to run all year rather than in a scramble before each audit.