Ten dimensions. Four levels. One view of protection.
For each statement, choose the description that best reflects how work happens today. Don’t choose where you want to be. Choose what you can show.
Practice is inconsistent, unclear or largely dependent on individuals.
The foundations are being put in place, but practice and evidence still vary.
There is a clear approach that is consistently applied and supported by evidence.
Critical risk is part of how work is run. Information about exposure, controls and changing conditions influences decisions.
How clearly the organisation understands serious-harm risk, chooses the controls that matter and defines what those controls need to do.
- 01
Understand the Risk
Do we understand how serious harm could happen?
- 02
Choose the Controls That Matter
Have we identified the controls we genuinely rely on?
- 03
Define What Good Looks Like
Is it clear what each critical control needs to do?
How well critical controls work in practice, how their performance is verified and what happens when protection weakens.
- 04
Make It Work in Practice
Do critical controls work in the conditions people actually face?
- 05
Know the Controls Are Working
Can we demonstrate that critical controls work when they are needed?
- 06
Respond When Protection Is Weakened
What happens when a critical control isn't working as intended?
How effectively the organisation learns, leads, assures and uses information to keep critical risk under control.
- 07
Learn and Improve
Do we learn before someone gets seriously hurt?
- 08
Lead and Govern the Risk
Can the people accountable for the risk see it and act on it?
- 09
Challenge What We Think We Know
Do we test whether protection is as strong as we think it is?
- 10
Use Data to Make Better Decisions
Does CRM information help people understand where protection is strong and where it is weakening?