A risk-maturity evidence matrix is a structured assessment record linking criteria, observed evidence, confidence and improvement decisions.
The assessment example below shows how to keep evidence strength separate from a judgement about the underlying process. It records what was seen, what remains uncertain and who should decide the response, without presenting invented results as an institutional finding.
Establishing qualitative assessment criteria and evidence baselines
The operation of internal control systems is the responsibility of the relevant line managers.
— National Treasury Internal Audit Framework2009, section1.3.2.5, page8
Constructing a risk-maturity evidence matrix requires establishing qualitative evaluation criteria before gathering operational evidence. Assessors examine how an organisation identifies, assesses, and manages operational and strategic risks across business units.
Evaluating risk maturity involves assessing the degree to which risk management processes are entrenched within daily management routines. Criteria must be practical, specific, and grounded in approved governance policies or professional standards.
Rather than applying rigid numerical scoring schemes, assessors establish qualitative baselines describing expected risk management behaviours and control practices. These baselines provide an objective benchmark for evaluating observed operational conditions.
Setting clear criteria ensures that evaluation conclusions rest on verifiable facts rather than subjective impressions. This qualitative approach supports meaningful governance dialogue across executive leadership and audit committees.
Tracing interview claims to records and resolving contradictions
A critical requirement during risk maturity evaluations is tracing verbal statements made during management interviews to physical or digital records. Inquiries with risk owners provide valuable context, but verbal assertions alone do not constitute sufficient audit evidence.
Assessors corroborate interview claims by examining risk registers, incident logs, meeting minutes, and operational reports. Corroboration verifies whether asserted risk management practices are actively performed in routine operations.
When physical records contradict interview statements, assessors must investigate the underlying cause of the discrepancy. Contradictions often highlight gaps between documented policy intentions and actual administrative execution.
Documenting evidence contradictions in the assessment artefact ensures transparency and prevents unverified claims from distorting maturity evaluations. Resolving data discrepancies strengthens the overall credibility of the assessment.
Differentiating lack of evidence from process ineffectiveness
Assessors must maintain a strict distinction between a lack of available evidence and a proven ineffective process. A lack of evidence occurs when operational records are missing, incomplete, or unretrievable during the evaluation window.
A process-effectiveness conclusion concerns whether the process achieved its intended purpose within the reviewed scope. A risk event alone does not establish control failure; investigate the design, execution and evidence. Conflating missing documentation with control failure leads to inaccurate assessment conclusions.
Where records are unavailable, explain the evidence limitation and seek alternative corroboration. Separately assess whether missing documentation itself breaches an applicable requirement; uncertainty about execution does not excuse a verified documentation failure. Where evidence confirms control failure, assessors document specific process breakdowns and recommend targeted control enhancements.
Separating low evidence confidence from confirmed process failure protects institutional ownership and ensures remediation plans address genuine operational root causes.
Contextualising institutional frameworks and standard expectations
Evaluating risk maturity requires properly contextualising local municipal frameworks and global internal audit standards. The uThukela District Municipality Enterprise Risk Management Framework 2021-2022 represents a dated, institution-specific municipal framework example.
While the uThukela framework provides useful local context on municipal risk roles, it does not constitute nationwide binding law or a universal national mandate. Assessors must avoid treating local municipal frameworks as universal standards applicable across all entities.
Similarly, Domain IV of the Global Internal Audit Standards, issued in January 2024 and effective from January 2025, requires the chief audit executive to understand organisational risk processes under Standard 9.1. Standard 9.1 directs internal auditors to gather information on risk maturity to inform audit strategy, but does not prescribe a mandatory maturity grade or certification scale.
To ensure risk-maturity evaluations remain practical, assessors should implement several core operational routines:
- Agree on qualitative evaluation criteria and scope boundaries with leadership prior to collecting evidence.
- Corroborate all interview statements against verified physical or digital operational records.
- Explicitly distinguish low evidence confidence due to missing records from confirmed process ineffectiveness.
- Record assessment limitations, sample boundaries, and evaluation timeframes in the final report.
- Differentiate mandatory standard requirements ("must") from advisory implementation considerations ("should" or "may").
Annotated four-column risk-maturity evidence matrix
| Evaluation Criterion | Observed Operational Evidence | Evidence Confidence & Limitations | Improvement Decision & Ownership |
|---|---|---|---|
| Risk identification processes cover strategic and operational exposures across all divisions. | Management interviews assert quarterly risk reviews; strategic risk register includes operational exposures. | Moderate confidence; risk register is updated, but divisional meeting minutes lack documented risk discussions. | Agree which risk decisions need to be recorded, establish the owner and document any applicable recording requirement. |
| Risk assessment methodologies evaluate likelihood and impact using credible operational data. | Sampled risk assessments show qualitative impact ratings; loss data logs examined for financial exposures. | High confidence for financial risks; low confidence for operational risks due to incomplete historical loss records. | Risk manager to implement standardised operational loss recording tools across all departments. |
| Risk response plans assign specific controls and named owners to key exposures. | Action plans list mitigation steps and department heads as designated owners. | High confidence that the plan was approved; implementation has not yet been demonstrated. | Management to agree appropriate review points and evidence of actual implementation; an approved plan alone does not establish operation. |
| Risk monitoring and reporting inform executive decision-making and oversight. | Quarterly risk reports presented to audit committee; key risk indicators tracked. | Low confidence; interview claims of monthly monitoring contradicted by gaps in quarterly tracking files. | Risk owner to investigate the missing records, define proportionate reporting controls and reconcile indicator data before submission. |
Sources
- Uthukela municipal2021/22 framework: institutional example of local-governmentrisk/maturity, NOT nationwide currentlaw or universalassessmentscale — Uthukela
- IIA2024 standards issued2024-01-09 effective2025-01-09 — Institute of Internal Auditors
- National Treasury Internal Audit Framework, second edition2009 — National Treasury
Frequently Asked Questions
How does evidence confidence differ from the maturity judgement?
Evidence confidence concerns the reliability and completeness of the material reviewed. A maturity judgement considers the process against agreed criteria. Keep the two separate so a confident interview or a well-presented file does not automatically become a favourable process assessment.
What should an assessor record when interviews and documents conflict?
Record both accounts, their dates and the specific discrepancy. Seek corroboration and consider whether the records cover the same period and process. Explain unresolved contradictions in the conclusion rather than choosing the most convenient account.
Does an approved improvement plan prove the process operates effectively?
No. Approval demonstrates a decision to act, not execution. The matrix should distinguish evidence of approval, implementation and subsequent operation, with the limits of each conclusion made clear.
Can missing records themselves support a finding?
They can where a relevant documentation requirement applies and the evidence supports a breach. Separately, missing records may limit what can be concluded about operation. State which finding is supported instead of treating all missing evidence as either harmless or proof of complete process failure.
How should an institution adapt this assessment example?
Agree its own criteria, mandate, evidence requirements and decision owners before use. The Uthukela2021/22 framework is a dated municipal example, not a universal national scoring system. Record the scope, period and limitations so readers do not mistake this illustrative matrix for a certification or permanent assurance rating.
For wider context, read the risk maturity overview.