Risk maturity measure is best described as?

• A. A measure of governance structure strength.
• B. The total capital allocated for risk management.
• C. The sophistication of risk management processes, governance, culture, and integration.
• D. The frequency of risk reporting to senior leadership.

Answer: (C)

Risk maturity measure looks at how advanced and embedded an organization’s risk management capabilities are across people, processes, governance, and culture. The best description captures not just the procedures themselves but how governance supports them, how risk-aware the organization’s culture is, and how risk information is integrated into day-to-day decisions. This holistic view reflects the actual capability and consistency of risk management across the enterprise, which is what maturity aims to assess. The other ideas miss key aspects: governance strength alone doesn’t prove effective practice, capital allocated is about resources rather than capability, and how often risk is reported focuses on communication frequency rather than overall maturity of risk management.