A maturity review should identify how decisions, controls and learning operate in practice, not award a high score for documents that happen to look consistent.
Many organizations describe their IMS as mature because policies are centrally managed, audits are scheduled and certificates are maintained. Those elements are important, but they say little about whether a cross functional change is controlled, whether strategic objectives influence operational decisions or whether recurring weaknesses are eliminated. Maturity is best assessed as a pattern of observable capabilities, not a marketing label.
ISO 9004:2018 offers guidance and a self assessment perspective on sustained organizational success. ISO’s integrated management practical guide provides a way to connect systems. Neither establishes a universal, externally certified five level IMS maturity score. An organization may use a transparent internal model as a management tool, provided the criteria are explicit and the evidence is tested.
01Define what maturity means for this organization
Select capabilities that matter to business strategy and exposure: Leadership decisions, risk and obligation integration, process ownership, shared operations, reliable data, assurance and improvement. For each capability, describe the behaviour expected at different levels. Avoid scoring by document count or how attractive a dashboard looks.
Calibrate assessment criteria using actual work. A small organisation may have a mature decision process with a lean set of records, while a large enterprise may have extensive documentation and weak execution. Distinguish process complexity from capability; maturity is not the same as bureaucracy.
ISO 9004:2018 includes an organisational self assessment perspective that can inform a locally defined IMS maturity framework. See the official publication ↗
02Assess governance through real decisions
Sample recent resource allocation, scope changes and unresolved cross disciplinary issues. Look for named decision authority, documented trade offs, specialist consultation, timeliness and verification that the decision worked. Interview people who are expected to act on decisions and compare their understanding with written authorities.
A high level policy alone does not demonstrate integrated leadership. Evidence of consistent governance might include a capital project where energy performance, worker safety, product conformity and environmental impact were considered before approval and where post commissioning results informed further action.
Calibrate assessor expectations before assigning levels. Provide examples of strong and weak evidence for each capability, and test ratings against cases from different departments. A score supported only by policy statements should have lower confidence than one supported by completed changes, interviews and observed controls. If the assessment spans multiple sites, publish the sampling boundary rather than implying that the whole network was examined in equal depth.
03Test risk integration without losing granularity
Review how the organisation identifies and evaluates risks and opportunities across functions. A mature approach connects exposures at the right decision points while preserving specialist criteria. It can explain why a severe hazard cannot be averaged away by low financial consequence or why a security event may have customer and operational effects.
Choose a real risk that traverses two or more disciplines, then examine owners, triggers, controls and escalation. A combined register with identical scoring across all topics may be less mature than coordinated specialist analyses linked by a shared process map.
04Evaluate operational embedding and workforce use
Observe work as performed. Can staff access the current instruction? Do contractors understand site obligations? Are exceptions recognised and escalated? Does the process owner see emerging signals? Compare practice across sites, shifts and functions instead of relying on an annual self rating survey.
Look for an appropriate balance between enterprise consistency and local autonomy. Mature systems enable local experts to add controls where needed, and the enterprise can still identify the same kind of critical exception across every unit. Excessive uniformity may obscure material differences in exposure.
| Dimension | Weak signal | More mature evidence |
|---|---|---|
| Governance | Policy exists but disputed escalation | Consistent approvals and resolved decisions |
| Operations | Template use varies by site | Tested controls and managed exceptions |
| Evidence | Executive totals lack provenance | Traceable data, caveats and reviewed definitions |
| Learning | Actions close but causes return | Repeat issues detected and prevented |
05Check whether evidence is reliable and decision ready
A maturity assessment should inspect record provenance, data definitions and completeness. Can a KPI be traced from executive report to source transaction? Have exclusions and normalization methods been agreed? Are action histories preserved? Can an auditor reperform a selected calculation?
Reliable data include the ability to acknowledge uncertainty. Organisations with mature information discipline flag missing observations, changed definitions and small samples instead of manufacturing confidence. That behaviour strengthens management review and cross unit comparison.
A maturity heat map becomes useful when it explains dependencies between capabilities. Poor supplier governance might be rooted in undefined process authority, not a lack of audit forms. Unreliable data may stem from inconsistent event identifiers rather than inadequate dashboard software. Follow the chain to the earliest controllable weakness and make that the improvement priority. Otherwise the organisation risks investing in visible symptoms.
06Use a transparent 2×2 factor analysis
For management discussion, consider four interacting factors: Decision quality, operational control, evidence reliability and learning capacity. Each factor should be backed by real cases, not impressions. A weakness in one can limit the others: Strong controls without review may stagnate, while rich data without clear authority rarely changes outcomes.
Make the assessment useful by mapping each weakness to a management choice. For instance, poor contractor controls might require a shared onboarding gate; unreliable energy reporting may require metering and normalisation work. The resulting priorities should be few enough to receive meaningful resources.
When repeating the assessment, retain both the criteria and the evidence trace. Review whether improvement survived staff turnover, higher workload and abnormal operating conditions. A capability observed only during a prepared assessment may not be embedded. Leadership should consider whether each priority improves resilience, compliance or customer outcomes, and whether its cost is proportionate to actual exposure.
07Validate findings with cross functional challenge
Have assessors interview people from different disciplines and include a small sample of adverse cases. Ask whether positive evidence survives a change of personnel or location. A polished headquarters view should be challenged by site level evidence. Record disagreement and the reasoning used to settle ratings.
When leadership requests a maturity score, report confidence alongside it. A capability observed at one site should not automatically be credited across a whole group. Consider a baseline review, an improvement period and a repeat assessment against unchanged criteria to demonstrate progress responsibly.
08Turn the assessment into a capability roadmap
Prioritise the bottlenecks that undermine actual outcomes. A programme may first need clearer decision rights, then linked evidence, then deeper performance analysis. Avoid broad claims that every organisation must reach the highest possible level in every domain; the appropriate target depends on risk, complexity and strategy.
Review maturity alongside operational performance and internal audit. Improvement should become apparent in quicker escalation, fewer recurrent breakdowns, credible control evidence and clearer resource decisions, not merely movement from one abstract level to another.
Prioritise capability over scoring
An IMS maturity assessment should end with a small number of changes to real decision and control processes. Ask which weak capability explains the most consequential failures and what evidence will demonstrate improvement at more than one site. Retain the original assessment criteria so progress can be tested without moving the scoring goalposts.
- Score named capabilities using observed operating cases.
- Record the sample scope, evidence quality and confidence.
- Challenge headquarters self ratings with local staff and adverse event cases.
- Tie each improvement priority to an operational failure mode.