Now that Navigatus has applied the Risk Management Maturity Model (RM3) to several major industrial and construction sites, it’s timely to take stock of the lessons learned.

The lessons learned can be summarised under the headings of scope, rigour, effort, and insights.

RM3 Risk Management Maturity Model
RM3 2019 Risk Management Maturity Model

Comprehensive Scope

The first thing to notice about RM3 is that it has a comprehensive scope. With 25 maturity criteria plus culture the assessment forces the assessment to evaluate every facet of the organisation’s health and safety system. RM3 comes from UK rail origins. Despite evidence of successful application across a range of industries we had some initial questions about whether the RM3 would apply to more general sites. We have been impressed with how well it does apply to a wider range of industries.

Rigorous assessment

The assessment requires that a discerning view is formed of risk management maturity against each criterion, backed by evidence. A broad overall judgement is required, looking at higher and lower maturity levels and reaching a broad judgement of the description that best matches safety performance.

Higher Level of Effort

A higher amount of effort is required to complete the assessment to the required level of rigour. For the assessment team there is nowhere to hide. In our first outing of the assessment we apportioned the criteria between two teams based on seniority of the personnel being interviewed. We found that there were many overlaps between the teams and in subsequent assessments have applied a single team which has delivered greater efficiency.

Actionable Insights

A product of the assessment is that it delivers very clear and actionable insights. The organisation is provided with a map identifying exactly what needs to be done to lift risk management maturity to the next level. To help organisations focus on the most important opportunities for improvement, we only


In general we have found management and auditing to be consistently less mature in New Zealand enterprises than other aspects of risk management. Opportunities for improvement typically include investigating incidents to a more consistently high standard to find and address the root causes. In summary it’s about using incidents to develop and applying a continuous learning culture.

The evidence is that change is a causal factor in many safety incidents. Accordingly the management of change becomes increasingly important in attaining higher levels of risk management maturity under the RM3 level. Some organisations may struggle to show that they have the systems in place to enable them to manage change consistently well.

In summary RM3 works very well and has wide applicability. The client gets a thorough and rigorous assessment that gives clear benchmarking and is loaded with actionable insights. For the assessment team RM3 is more challenging to apply than other forms of assessments as it is more comprehensive and demands rigour.

About the Author – Kevin Oldham

Kevin Oldham is a director of Navigatus with a depth of experience in health and safety risk management. A brief profile for Kevin can be found here.