Comprehensive diagnostic · 16 saved modules
Does your risk system change decisions, or document them?
Sixty-four questions examine governance, strategy, culture, capability, identification, estimating, qualitative and quantitative analysis, models, appetite, controls, reserves, monitoring, resilience, and learning. Every question names the evidence a serious review would inspect.
64 questions
Four per capability
About 20 minutes
Progress saves in this browser
Evidence-oriented
Say so when you cannot see the evidence
Private by default
Nothing is transmitted to us
Method boundary: this diagnostic is independently developed and aligned to recognized practice. It is not an ISO, COSO, RIMS, NIST, GAO, IIA, AACE, or Federal Reserve certification, audit, or endorsed instrument. Scores identify where to investigate and improve; evidence and outcomes determine whether the capability actually works.
You are allowed not to know. Every item offers “I cannot see the evidence” alongside the five ratings, and that answer is counted as coverage rather than averaged as a low score. It is a different answer from “not applicable”, which means the practice is genuinely out of scope. Below 65% evidenced, the profile reports its score and withholds the maturity band, because a maturity level read off what nobody could see is a claim about an organization made from an absence.
Reference architecture
What the 64 questions were checked against
No single framework covers enterprise governance, risk culture, program estimating, quantitative analysis, model risk, continuity, and organizational conditions equally well. This instrument uses each source only where it is authoritative or especially useful, then joins the practices through the Four A's.
ISO 31000:2018
Principles, leadership, integration, context, process, monitoring, and improvement.
IEC 31010:2019
Selection, application, verification, and validation of risk-assessment techniques.
COSO ERM
Governance, culture, strategy, objective-setting, performance, review, and reporting.
RIMS Risk Maturity Model
Cross-check against its seven attributes, 25 competency drivers, and 68 readiness indicators.
IIA Three Lines Model
Accountability, management responsibility, specialist support and challenge, and independent assurance.
GAO Cost and Schedule Guides
Estimate basis, data, ranges, sensitivity, uncertainty, schedule credibility, contingency, and actuals.
NIST RMF and IR 8286 Rev. 1
Control lifecycle, continuous monitoring, risk registers, appetite, tolerance, and enterprise aggregation.
Federal Reserve SR 11-7
Model inventory, development, implementation, use, validation, governance, and performance monitoring.
ISO 22301:2019
Critical outcomes, continuity, disruption tolerance, exercises, recovery, and improvement.
Alignment means the question architecture was cross-checked against the cited public framework descriptions and guidance. It does not reproduce proprietary assessment content, confer compliance, or replace an audit, specialist review, or sector-specific obligation.