Quantitative Risk Analysis Maturity Model

What a maturity model is

Maturity models are a familiar idea borrowed from process improvement (the original CMM for software is the ancestor). The pattern is always the same: a small number of named levels, each describing how an organization typically behaves, arranged as a ladder from worst to best. You locate yourself honestly, then climb deliberately.

Five levels of QRA maturity

RP 122R-22 lays out a progression of capability. The exact wording varies, but the shape is a five-rung climb from ad-hoc to optimized:

• Initial / ad-hoc — Risk is handled informally and inconsistently — gut feel, no defined process, a flat percentage for contingency. Results depend entirely on the individual.
• Repeatable / basic — Some process exists — a risk register, qualitative matrix — applied on bigger projects but not standardized. Quantitative analysis is rare or simplistic.
• Defined / standardized — A documented, consistent QRA process used across projects — Monte Carlo or similar applied with standard methods, templates, and trained people.
• Managed / integrated — QRA is integrated with cost and schedule, fed by historical data, quality-checked, and used to drive decisions — risk analysis informs how the business is run.
• Optimized / continuously improving — The practice is measured against outcomes and refined over time — calibrated against actual results, with lessons feeding back to sharpen future analysis.

Using the maturity model

Assess honestly against the levels — where does your organization actually operate, not where you'd like to be? Identify the gap to the next rung and the specific changes that close it (process, tools, data, training, integration). Then improve incrementally: maturity is climbed one level at a time, and the jump from each level to the next is its own project. Reassess periodically to confirm progress and reset the target.

Nine things to remember

1. A QRA maturity model grades how advanced a risk practice is.
2. It's a ladder of named levels from ad-hoc to optimized.
3. You can't improve what you can't grade — locate yourself first.
4. Level 1 ad-hoc, 2 basic, 3 defined, 4 managed, 5 optimized.
5. Higher levels integrate QRA with cost, schedule, data, and decisions.
6. Most organizations sit lower than they think — assess honestly.
7. Improve incrementally — climb one level at a time.
8. The value is the conversation — turning "do better" into a concrete path.
9. Methods only pay off inside a practice mature enough to apply them.