Governance maturity model: how to assess and improve it

A governance maturity model turns qualitative governance practices into scored, evidence-backed capability levels you can act on. Run the assessment properly and you get a prioritised, phased roadmap instead of a vague sense that "things could be better." The concept applies equally to core organisational governance, data governance, and AI governance: the same five-level logic, the same evidence requirements, the same output.

The frameworks worth knowing come from bodies like the Cloud Native Computing Foundation, the Institute of Internal Auditors, and NIST for AI-specific controls. Keystoneconsulting has run this assessment process across healthcare, construction, and public sector delivery teams for two decades, and the pattern holds: organisations that score first and prioritise second waste far less budget than those that try to fix everything at once.

Governance maturity assessment: how to start today

• Pick 2 or 3 dimensions tied to your board's actual top risks, not all seven.
• Gather two independent evidence sources per dimension (a document plus an observed behaviour) before assigning a level.
• Convert the resulting gaps into a one-page roadmap with quick wins flagged separately from longer builds.

Key Takeaways

A governance maturity model works because it converts subjective governance impressions into evidence-scored levels that justify a prioritised, phased improvement roadmap.

Table of Contents

• What is a governance maturity model?
• What are the typical levels in a maturity scale?
• Which dimensions does a governance maturity model measure?
• How do you run a governance maturity assessment?
• How do you choose the right maturity model for your organisation?
• How do you turn assessment results into a roadmap?
• What do governance maturity assessments look like in practice?
• When is a full maturity programme worth it, and when isn't it?
• Move from assessment to delivery with Keystoneconsulting
• Sources

What is a governance maturity model?

A governance maturity model is a structured scale, usually four or five levels, that scores how consistently an organisation defines, executes, and monitors its governance practices. It does the same job whether you're assessing procurement oversight, data governance, or AI model risk: it replaces "we think we're doing okay" with a defensible, evidence-linked score.

Take data governance. An organisation with no metadata catalogue, no defined data owners, and no lineage tracking sits at the bottom of most scales. One with automated data quality monitoring, named data stewards per domain, and board-level reporting on data risk sits near the top. AI governance follows the same pattern but adds specific artefacts: a model inventory, documented testing before deployment, and defined escalation paths when a model behaves unexpectedly. NIST's AI Risk Management Framework is the most widely cited reference for what those AI-specific controls should look like.

The business case for running this exercise is straightforward, but it's rarely made well. A maturity score gives a board something concrete to fund: not "improve governance" but "move data risk management from level 2 to level 3, which requires these three things." The Cloud Native Maturity Model frames this as bridging technical capability and business outcomes, scoring across pillars like people, process, policy, and technology so a technical gap translates into a business argument a finance director can approve.

Most models take one of three shapes:

1. Tiered level scales – a single number (1 to 5) per dimension, simple to communicate but light on nuance.
2. Dimensioned matrices – a grid of dimensions against levels, which is where most credible assessments land because it shows exactly where the gaps sit.
3. Single-score dashboards – one aggregate number for executive reporting, usually built on top of a matrix rather than instead of it.

Here's the trap most organisations fall into: chasing level 5 everywhere. The IIA's Maturity Model for Governance is explicit that higher isn't automatically better. A small facilities management team with low regulatory exposure doesn't need the same AI model governance rigour as a hospital trust running clinical decision-support tools. Setting maturity targets without reference to actual risk appetite and operational complexity leads to over-governing, which burns budget on process for its own sake and slows delivery without reducing real risk.

Pro Tip: Before you assess anything, write down your target level per dimension and justify it against your actual regulatory exposure and risk appetite. If you can't justify a level 4 target for a low-risk process, don't set one.

What are the typical levels in a maturity scale?

Most credible scales run five levels, and the labels vary by framework but the underlying logic is nearly universal: initial, developing, defined, managed, and optimised.

Level 1: Initial or ad hoc. Governance happens, but it's undocumented and depends on individual judgement. There's no written policy for how data is classified, no defined owner for AI model risk, no consistent process for escalating a governance failure. Evidence at this level is mostly absence: no policy document exists, no one can name who's accountable.

Level 2: Developing or repeatable. Basic policies exist, but they're inconsistently applied. A data governance policy might exist on paper while half the business units ignore it. Evidence here includes a written policy document, but paired with inconsistent adherence when you actually interview staff or sample records.

Level 3: Defined or standardised. Processes are documented, roles are assigned, and there's consistent application across the organisation. This is where most mid-sized organisations plateau, and honestly, for many risk profiles, that's a defensible place to stop. Evidence includes role descriptions with named accountability, a standard operating procedure that people actually follow, and consistent records across business units.

Level 4: Managed or measured. Governance performance is actively monitored with metrics, not just documented. Automated controls start appearing: data quality dashboards, model performance monitoring, exception reports that flag deviations without a human having to go looking. Evidence includes dashboards, monitoring logs, and a track record of exceptions being caught and resolved.

Level 5: Optimised or institutional. Governance is embedded in culture and continuously improved based on data. The organisation doesn't just monitor; it adjusts controls proactively based on what the monitoring shows. Evidence includes a documented continuous-improvement cycle, historical trend data showing deliberate adjustments, and governance metrics tied directly to business outcomes.

A word of caution on the evidence standard here: a practical rule used by experienced assessors is to require at least two independent artefacts before moving a dimension up a level, one documented source and one observed behaviour. A policy document alone doesn't prove level 3. You need the policy plus proof people are actually following it, because self-reported maturity is notoriously inflated. Ask any internal auditor.

One thing that trips up first-time assessors: maturity is almost never uniform across an organisation. A construction firm might score level 4 on financial controls and level 1 on AI-assisted scheduling tools it adopted eighteen months ago without any formal review process. The fix isn't to average these into one misleading number. Build a heat map instead, dimensions down one axis, business units or domains across the other, colour-coded by level. It shows exactly where the gaps concentrate, which is usually far more useful to a board than a single aggregate score that hides the worst problems.

Which dimensions does a governance maturity model measure?

Most credible frameworks converge on a similar set of dimensions, whether the assessment covers general organisational governance, data governance, or AI governance specifically.

• Policy and standards – documented rules covering data classification, model approval, or procurement thresholds; evidence is the policy document itself plus a review date showing it's kept current.
• Roles and accountability – named owners for each governance area, not just job titles on an org chart; evidence includes RACI matrices and interview confirmation that the named person actually knows their responsibilities.
• Processes and workflows – the actual sequence of steps from request to approval to review; evidence includes documented workflow maps and audit trails showing the process was followed, not just designed.
• Data management – how data is catalogued, classified, and tracked through its lifecycle; a metadata catalogue with defined lineage is the single strongest piece of evidence here.
• Risk and controls – how risks are identified, scored, and mitigated, plus what happens when a control fails; evidence includes a risk register with dates and resolution notes, not a static list nobody's updated in a year.
• Technology and tools – whether governance is supported by dedicated systems or by spreadsheets and email chains; for AI governance specifically, this is where a model inventory becomes essential.
• Monitoring and metrics – whether performance is tracked over time with defined KPIs, or whether governance health is only discovered during an annual audit.

For data governance, the metadata catalogue and lineage tracking dimensions carry disproportionate weight. Without them, every other dimension is built on an unreliable foundation, because you can't govern data quality you can't trace back to its source.

AI governance adds requirements the general model doesn't cover. A model inventory listing every AI system in production, who owns it, what data trained it, and when it was last validated is close to non-negotiable for anything beyond level 2. MITRE's AI maturity model frames this well: a credible AI governance assessment pairs every score with documented evidence and converts each identified gap into a sequenced item on a roadmap, rather than a general "improve AI oversight" note that never gets actioned.

Pro Tip: If your organisation runs any AI system, and most now do even informally, start your model inventory before you start scoring anything else. You cannot assess AI governance maturity for systems you haven't catalogued.

How do you run a governance maturity assessment?

The process is straightforward on paper: scope, collect evidence, score, validate, report. The difficulty is in resisting the urge to skip steps under time pressure, which is exactly how assessments end up producing scores nobody trusts.

1. Scope the assessment. Decide which business units, systems, or governance domains are in scope. Trying to assess everything at once is the single most common reason these projects stall, so pick a critical path tied to your board's actual top risks rather than attempting full coverage on the first pass.
2. Collect evidence. Gather policy documents, role descriptions, process maps, system logs, and audit records. Interview the people actually doing the work, not just their managers, because the gap between documented process and lived reality is where most maturity gets overstated.
3. Score each dimension. Apply your chosen scale (typically 1 to 5) per dimension, using the two-artefact rule: a documented source plus an observed behaviour before you assign anything above level 2.
4. Validate scores. Cross-check scores across assessors if more than one person is involved, and sense-check against known incidents. If a business unit scores level 4 on risk management but had three unresolved control failures last year, something's wrong with the scoring, not the incident record.
5. Report and deliverables. Produce the heat map, gap register, and roadmap together, not as separate documents that never get read side by side.

Who to involve matters more than most guidance admits. You need the process owners who can describe how work actually happens, a risk or compliance lead who understands the organisation's regulatory exposure, and, for AI-specific assessments, whoever owns the model inventory or data science function. Leaving out frontline staff and only interviewing management is the fastest route to an inflated score.

On weighting: not every dimension deserves equal influence over the final picture. A hospital trust should weight patient data governance and clinical AI oversight more heavily than general procurement processes. A construction firm might weight financial controls and health and safety governance above data management. There's no universal weighting scheme, which is precisely why the difference between compliance and governance matters here: compliance asks whether you met a fixed rule, governance asks whether your decision-making structure would catch a problem you haven't seen yet. Weight your assessment toward the risks that keep your board awake, and triangulate scores using more than one evidence source per dimension so a single missing document doesn't tank an otherwise solid score.

The deliverables that actually get used are a heat map showing maturity by dimension and business unit, a gap register listing specific missing artefacts or broken processes, a prioritised roadmap sequencing fixes by risk and effort, and a small set of KPIs to track progress after the assessment closes. Skip any one of these and the assessment risks becoming a document that gets filed and forgotten.

How do you choose the right maturity model for your organisation?

Not every published framework fits every organisation, and adopting one wholesale because a competitor uses it is a common early mistake.

Judge fit against four criteria. First, scope: does the model cover the domains you actually need assessed, or will you be forcing square pegs into round holes? Second, evidenceability: can you realistically gather the artefacts the model expects, or does it assume a level of documentation maturity you're nowhere near? Third, language: does the model's terminology map onto how your organisation already talks about risk and process, because a model that requires translation before anyone understands it will get ignored? Fourth, standards alignment: does it reference recognised frameworks like ISO or NIST where your regulator or auditor will expect that alignment?

An off-the-shelf model, such as those referenced by Gartner's data governance maturity materials or ISO's governance of organisations guidance, works well when your organisation is fairly typical for its sector and you need external credibility, particularly for audit or investor purposes. A customised approach makes more sense when your risk profile is unusual, for example a construction firm running AI-assisted scheduling across a dozen sites with wildly different regulatory regimes, where a generic model would miss the specific gaps that matter.

Adapting a model, whether bought or built, comes down to four practical steps: define the dimensions that matter to your actual risk profile, agree observable signals for each level so scoring doesn't become subjective, set an assessment cadence (annual is common, but high-change environments like active AI deployment often warrant every six months), and decide who governs the assessment process itself so scoring doesn't drift over time without anyone noticing.

Pro Tip: Don't inherit a competitor's dimension weighting just because their published framework looks authoritative. Their risk profile isn't yours, and a model built for a global bank will bury a mid-sized NHS trust in irrelevant controls.

How do you turn assessment results into a roadmap?

A gap register without prioritisation is just a longer, more depressing to-do list. The conversion from scores to action happens through a prioritisation framework, and the two most common are risk-times-effort and impact-times-effort.

Risk times effort works well when your primary driver is regulatory exposure or operational risk: a low-effort fix that closes a high-risk gap, such as assigning a named data owner where none currently exists, jumps to the top. Impact times effort suits organisations focused on efficiency or board confidence rather than acute risk: a fix that dramatically improves reporting speed for relatively little build cost outranks a technically important but invisible backend improvement.

A typical three-phase roadmap looks like this:

1. Immediate controls (0 to 3 months). Quick, low-cost fixes: assign missing accountability, document an existing but unwritten process, close an obvious policy gap. These build momentum and give the board an early result to see.
2. Foundational capabilities (3 to 12 months). Build the metadata catalogue, establish the model inventory, implement consistent scoring and monitoring across business units. This is where most of the real budget goes.
3. Scale and optimise (12 months plus). Extend mature practices to remaining business units, automate monitoring that was previously manual, and start using governance data to proactively adjust controls rather than just react to failures.

KPIs work best when they're tied to outcomes a board actually cares about, not process completion. "Percentage of AI systems with a documented risk assessment" beats "AI governance policy published" every time, because the first proves something changed and the second just proves a document exists. Track time-to-resolution for flagged exceptions, the proportion of business units at or above your target maturity level, and the number of governance-related incidents year over year. If resources are genuinely constrained, focus that first roadmap phase on two or three dimensions tied to your board's stated top risks rather than spreading thin improvements across everything, which creates visible wins that build momentum for a larger programme later.

What do governance maturity assessments look like in practice?

Across healthcare, construction, and public sector delivery, the pattern Keystoneconsulting sees repeatedly is that organisations know roughly where their weak points are before the assessment starts, but they lack the evidence structure to prove it to a board or turn it into a funded plan. A facilities management team might correctly suspect its incident escalation process is inconsistent, but without documented evidence and a scored comparison against a defined target, that suspicion never becomes a budget line.

The pitfalls are consistent too. Over-scoping is the most common: trying to assess every dimension across every business unit in one pass, which produces a project that drags on for months and loses executive attention before it delivers anything. Inconsistent scoring runs a close second, particularly when different assessors interpret "defined process" differently without an agreed evidence standard. And neglecting change management, treating the roadmap as a technical document rather than something that needs sponsorship and communication to the teams who'll actually implement it, undermines even a technically excellent assessment.

The gap most organisations underestimate isn't the governance failure itself. It's the distance between knowing a process is weak and having documented, defensible evidence that would survive a board challenge or an external audit.

This is where a platform like Videra earns its place. It maps workflows against defined stages, generating an auditable trail as work actually happens rather than relying on someone reconstructing evidence after the fact. For a construction delivery team or an NHS administrator managing lifecycle governance, that continuous evidence trail is what turns a one-off assessment into an ongoing measurement capability instead of a snapshot that's stale within six months.

• Over-scoping stalls projects before they deliver value.
• Inconsistent scoring across assessors undermines board trust in the results.
• Skipping change management turns a good roadmap into a shelved document.

When is a full maturity programme worth it, and when isn't it?

Here's where I'll push back on how these programmes usually get sold. A full, multi-dimension maturity assessment across every business unit is justified when you're facing regulatory scrutiny, preparing for a major systems change like AI adoption at scale, or when a genuine governance failure has already cost you money or reputation. Outside those triggers, a full programme is often oversized for the actual problem.

Targeted interventions, assessing two or three dimensions tied to your worst known risk, usually deliver more value per pound spent than a comprehensive exercise that takes a year to report and longer to action. I've seen boards approve six-figure governance programmes when the real issue was one missing accountability structure that a focused three-week assessment would have surfaced.

Executive sponsorship follows the money, not the mission. Don't pitch "improved governance maturity." Pitch the specific business outcome: reduced audit findings, faster board reporting, fewer AI-related incidents. Link every metric in your roadmap back to something a finance director or operations lead already tracks. If resources are genuinely tight, start with your board's declared top risk, assess just that dimension properly with real evidence, and use the result to build the case for anything bigger. A well-evidenced small win beats an ambitious plan that never gets funded.

— Peter

Move from assessment to delivery with Keystoneconsulting

Keystoneconsulting is the direct route from a governance maturity assessment to an actually-delivered roadmap, not another consultancy that hands you a report and leaves. Where a generic framework gives you a score, Keystoneconsulting's team combines the assessment methodology with the Videra platform, which maps your workflows, automates board and exception reporting, and keeps every stage audit-ready as your improvement plan moves from paper to practice.

For healthcare organisations specifically, the Videra Healthcare platform is built around NHS project and lifecycle governance requirements, so assessment findings translate directly into workflows your teams already use. If you're weighing up whether to run this yourself or bring in a partner, Keystoneconsulting's team can scope a pilot assessment against your two or three highest-priority governance dimensions and show you what a phased roadmap looks like before you commit to anything larger.

Pro Tip: Before booking a demo, have your current gap register or last audit findings ready, even a rough version. It lets the conversation focus on your actual roadmap rather than generic platform features.

Get in touch to scope a pilot assessment or request a walkthrough of how Videra turns governance scores into tracked, auditable delivery.

Sources

• Cloud Native Maturity Model
• Maturity model for governance (IIA)
• MITRE AI maturity model
• NIST AI Risk Management Framework

Recommended

• Construction delivery process improvement: a governance-first guide
• Risk management in project delivery: a UK guide
• Best enterprise project governance platforms 2026
• Best AI governance software for UK enterprises: 2026 guide