Maturity Frameworks are a fixture in audit, IT, and the consulting fields. This memory-jog-post discusses their origin, components, challenges, and criticisms. Like most models, their utility is as a guide rather than definitive solution.

[toc]

Honest, it started out quite innocent! I am finishing off a series on Results Based Management (RBM) and wanted to included Maturity Framework in the mix. The idea was to show that most organizations are already doing RBM, they just don’t know it. Then, if they want to be more systematic, here is a roadmap as a Maturity Framework to get them to the next level.

See, it was supposed to be easy-peasy! How was I to know that a deep, and very mature, rabbit hole was lurky around the corner!

A Very Deep Dive and Shallow Swim into Maturity Frameworks

I wish I could say I am now an expert on the topic but given that there are a few PhDs specializing in the subject, being an expert in one or two blogs would be difficult. Nevertheless, I know now more about a subject that most people have not given too much thought to.

So why did I write this post? It is a memory jog for me to refer to. If you are a Maturity Framework expert, your indulgence (and expertise via comments) please. If you are not an expert but appreciate some crib notes on the subject, then read on!

Swimming By the Writing Plan

My writing plan is as follows. Most content listed below is in this post with a few follow up blogs. As time and interest permit, I may revisit one or more of these topics.

• What is a Maturity Framework (this post)
• Why Build a Maturity Framework
  • (This post but could be expanded into when to (not) use the concept)
• Leveling the Maturity Field (pending)
• Criteria and the Framework (This post, another area for potential expansion)
• Keeping the Framework current (This is a real challenge area)
• So What, Using a Maturity Framework
  • (This theme is spread throughout the post but could use a more fulsome-future consideration)
• The gRBM Maturity Framework (pending)

What Is a Maturity Framework (Model)

Maturity Frameworks are handy way to think about the readiness of an organization to do something. Wikipedia describes them as a framework for measuring an organization’s maturity defined as a measurement of the ability of continuous improvement in a particular discipline. [1]

The Global Institute of Internal Auditors has this definition: Maturity models establish a systematic basis of measurement for describing the “as is” state of a process. A process can then be compared to management’s expectations or with other similar processes. Insights for determining improvement options can be developed. [2]

Origins of Maturity Frameworks

There are a gazillion maturity frameworks out there, but the grand daddy is the Capability Maturity Model (CMM, see the above graphic).

It (CMM) was originally developed in the late 1980s and early 1990s as a means for the US Department of Defense to evaluate its vendors’ ability to effectively deliver on software development projects. It was a supply chain management technique that helped mitigate the risk of project failure from things like a vendor not having a well-defined quality assurance process. [3]

If originally developed in the early 1990’s, the Maturity Framework is creeping towards middle age. The model has matured and become a fixture in project management, audit, risk, IT, quality management, business process improvement, and many other applications.

You know that a concept has become well entrenched when it is used in ISO standards. Maturity Frameworks have grown up and are here to stay so let’s understand how they work.

What Does a Maturity Framework Look Like?

A Maturity Framework has four big components in order of importance [4]:

1. Why: What is the purpose of Maturity Framework, how will it be used, by whom?
2. Levels: What are the maturity levels involved, how many steps, what are their names?
3. Criteria: How do you evaluate whether you are at step 0 or a 999?
4. Revision: How is the framework updated for changing criteria, redefined levels, updated purpose, or profound environmental shifts.

Why Do You Need a Framework and Who is Answering This Question?

The biggest benefit of a Maturity Framework is that it aligns with the human tendency to see patterns everywhere. When a consultant (or auditor, or someone else), says the process/organization is at Level 3, our super-power-pattern-recognition scans the levels and quickly concludes that a ‘3’ is ‘about right’, or too optimistic/pessimistic, or not quite right [5].

A Maturity Framework works best when it recognizes that it is highly subjective and guides rather than controls decision makers. The framework turns to the dark side if it becomes prescriptive and locks the organization into ridged set of activities (more on this when we discuss criticisms of a Maturity Framework).

How Many Levels Are We Talking About Here?

The CMM framework had five levels while others have four. CMM levels also diminished in increment. This means for each additional level there were fewer of what was being measured. In CMM’s case, the number of vendors who were compliant with the capability level. Other frameworks increase with each step. This implies increased costs or capacity with each level. Some frameworks have a very handy ‘Level 0’ or non-existent level.

Criteria Or Knowing Which Level to Stop At

When is an organization at Level 1 or when has it reached the Nirvana state of Level 5? A cursory definition might be good enough. Other frameworks have extensive rubrics to determine when an organization is a Level 2 versus a Level 3. This evaluation may run into the dozens of pages or be an online survey to fit you into a level; think a ‘Harry Potter Sorting Hat‘ for organizations [6].

The problem with more precise criteria is that they may yield less relevant and accurate results. For example, the ‘More Information is Better’ cognitive bias can lead an organization to confuse extensive criteria gathering with a better assessment of the maturity of an organization [7]. Another challenge in this regard is confusing precision with accuracy when it comes to criteria [8].

An organization needs criteria to assess its maturity, but it also needs to not become bedazzled with an overly complex criteria assessment process.

Staying Mature in the Face of Change

Your organization has developed the perfect maturity level names and descriptions for a framework. The criteria runs to hundreds of pages and is perfect – and then the world changes. Technology, regulations, social conventions, etc., has rendered your carefully crafted framework obsolete. Worse still, it took years to reach this state of perfection and more years to re-open the discussions to update the methodology, what now?

To start, hopefully you have the structures already in place to review, revise, and publish an updated Maturity Framework. Having the rules of engagement in place already reduces the risks of games and politics derailing an update. Ideally the framework has added value so that the organization WANTS to update it. Finally, you have resources and infrastructure to communicate the changes to those who need to know and a process to deal with laggards and ‘game players’.

In other words, coming up with a Maturity Framework is hard. Keeping it current in a fair, transparent, accountable manner is harder still!

Criticisms of Maturity Frameworks

One of the best ways to understand the strengths of something is to know its limitations. Like many tools, a Maturity Framework is useful as a general guide but withers under too much scrutiny.

Got Theory? Let’s start with the big criticism, a lack of a theoretical basis for frameworks. The first CMM framework was used to evaluate software vendors. Thus, the grand daddy of all frameworks was a procurement tool rather than coming out of the academic world.

Bureaucratic, Inflexible and Static. Of course, if the academic world did come up with a good theoretical model, then this next criticism would come to the fore. Organizations that try to improve their standing against a framework discover that the framework was static while the world changed. Changing the framework is fraught with its own risks namely gaming the system. To manage this problem, a mini-Maturity Framework-cottage industry grows up in the organization adding to the transaction cost and reducing the framework’s value.

Process over Outcomes. Being a snapshot in time, the focus becomes improving the respective processes that made up the original framework. Noting the above challenges, processes become increasingly successful yielding poorer and poorer outcomes because they have lost sight of the of the original intent of the framework.

Useful as a Roadmap but Not a Tour Guide. In many ways, Maturity Frameworks are like RBM. They are most useful when used as a tool by a capable leadership team who understands the limitations. The team manages the framework in a transparent and accountable manner and remembers it is a model of the organization and not the reason the organization exists. Think: all models are wrong, but some models are useful.

Conclusions and Next Posts

That in a nutshell is a Maturity Framework. Each of these components is worthy of a Doctorial dissertation or two so a short post will not do them justice. I hope to get back to a government Results Based Management shortly, but in the next post, a deeper dive of determining and assigning levels.

Notes and References

1. Maturity model | Wikipedia.
2. “Practice Guide: Selecting, Using, and Creating Maturity Models | The IIA.” Accessed December 23, 2025. www.theiia.org.
3. An excellent review of Maturity Models is available from Why Maturity Models Don’t Work | Barryoreilly.com.
4. The components are roughly based on this article: Pöppelbuß, Jens, and Maximilian Röglinger. “WHAT MAKES A USEFUL MATURITY MODEL? A FRAMEWORK OF GENERAL DESIGN PRINCIPLES FOR MATURITY MODELS AND ITS DEMONSTRATION IN BUSINESS PROCESS MANAGEMENT.” ECIS 2011 Proceedings, October 6, 2011. https://aisel.aisnet.org/ecis2011/28.
5. Technically, this is called Apophenia. It kept our surviving ancestors from being eaten by hungry predators and causes others to believe that aliens are talking to them from their microwave. The Brain’s Obsession with Hidden Patterns.
6. If you have never read the Harry Potter books or seen the movies then read on if you are particularly curious: Sorting Hat | fandom.com.
7. Cognitive Biases help us run our lives and sometimes run amok. For this bias, I choose an investment website to explain it as financial investments tend to be a ‘pick one’ or ‘over think it’ type of affairs, see: Information Bias: Is More Information Always Better? | Quartr.com.
8. Accuracy and Precision are often used interchangeably. They are both part of a larger challenge of measurement (source: Accuracy and Precision | Geeks for Geeks).
   • Accuracy reflects how close you are to the measurement’s true value. Precision is how consistent 2+ measurements are to each other.
   • Both measures have their limitations, starting with Accuracy.
   • True values have a habit of changing. The market for widgets was X last year but is now X-Y this year. If you don’t constantly measure this change, your reference point may be off and thus inaccurate.
   • Precision has the same problem. Measures were close together but now are drifting apart because the underlying value is changing. Are the measurements imprecise or is the new measure more accurate.
   • Both precision and accuracy are dependent upon the assumption that you know what to measure, know how to measure it, that measuring it does not (in)directly change what is being measured, and that the subject of measurement has not changed while answering the questions (the assumption of consistency).