Maturity Frameworks are a fixture in audit, IT, and the consulting fields. This memory-jog-post discusses their origin, components, challenges, and criticisms. Like most models, their utility is as a guide rather than definitive solution. A literature (scholarly, grey-literature, AI, etc.) also yielded 23 sample frameworks which are used to supplement the following analysis.

1. A Mature Rabbit Hole
2. A Shallow Dive and Shallower Swim into Maturity Frameworks
3. Swimming By the Writing Plan
4. Three Mature Definitions
5. What Is a Maturity Framework (Model)
6. Origins of Maturity Frameworks
7. What Makes for a good Maturity Framework?
8. What Does a Maturity Framework Look Like?
9. Why Do You Need a Framework and Who is Answering This Question?
10. How Many Levels Are We Talking About Here?
11. Criteria Or Knowing Which Level to Stop At
12. Staying Mature in the Face of Change
13. Criticisms of Maturity Frameworks
14. Conclusions and Next Posts
15. Notes and References
16. Annex – A Short Survey of Maturity Frameworks
    1. Overview of Analysis
    2. Overview of Analysis
    3. Overview of Maturity Frameworks and Their Primary Category Mapping
    4. Next Steps

Honest, it started out quite innocent! I am finishing off a series on Results Based Management (RBM) and wanted to included Maturity Framework in the mix. The idea was to show that most organizations are already doing RBM, they just don’t know it. Then, if they want to be more systematic, here is a roadmap as a Maturity Framework to get them to the next level.

A Mature Rabbit Hole

See, it was supposed to be easy-peasy! How was I to know that a deep, and very mature, rabbit hole was lurky around the corner! About 30 hours of research and analysis later, I am coming up for air and reporting on my findings.

Some of the 30 hours went into a spreadsheet of Maturity Frameworks. Numerous maturity models were identified (see the Annex below for a current count). Given that there are potentially thousands of models in the universe, the analysis focused on those that were commonly cited or better known. These models were further analyzed according to their levels (e.g. number of levels, descriptions used, and level terms).

A Shallow Dive and Shallower Swim into Maturity Frameworks

I wish I could say I am now an expert on the topic but given the PhDs specializing in the subject, being an expert in one or two blogs would be difficult. Nevertheless, I know now more about a subject that most people have not given too much thought to.

So why did I write this post? It is a memory jog for me to refer to. If you are a Maturity Framework expert, your indulgence (and expertise via comments) please. If you are not an expert but appreciate some crib notes on the subject, then read on!

Swimming By the Writing Plan

My writing plan is as follows. Most content listed below is in this post with a few follow up blogs.

• What is a Maturity Framework (this post)
• Why Build a Maturity Framework
  • (This post but could be expanded into when to (not) use the concept)
• Leveling the Maturity Field (pending)
• Criteria and the Framework (This post, another area for potential expansion)
• Keeping the Framework current (This is a real challenge area)
• So What, Using a Maturity Framework
  • (This theme is spread throughout the post but could use a more fulsome-future consideration)
• The gRBM Maturity Framework (pending)

Three Mature Definitions

Maturity Frameworks are handy way to think about the readiness of an organization to do something. Wikipedia describes them as a framework for measuring an organization’s maturity defined as a measurement of the ability of continuous improvement in a particular discipline. [1]

The Global Institute of Internal Auditors has this definition: Maturity models establish a systematic basis of measurement for describing the “as is” state of a process. A process can then be compared to management’s expectations or with other similar processes. Insights for determining improvement options can be developed. [2]

One final definition is from ITIL, or Information Technology Infrastructure Library. This framework is used in IT service management: Maturity (framework) is a measure of the reliability, efficiency and effectiveness of a process, function, organization etc. The most mature processes and functions are formally aligned to business objectives and strategy and are supported by a framework for continual improvement. (ITIL 2011).

What Is a Maturity Framework (Model)

The key features of a Maturity Framework are:

1. Aligning some of the organization’s constituent parts to business objectives, strategy, management objectives.
2. Supporting Continuous Improvement of select processes.
3. Comparing the AS-IS state to a benchmark or one or more desired future states.
4. Measurement of existing processes to do the above.

Origins of Maturity Frameworks

There are a gazillion maturity frameworks out there, but the grand daddy is the Capability Maturity Model (CMM) [3].

It (CMM) was originally developed in the late 1980s and early 1990s as a means for the US Department of Defense to evaluate its vendors’ ability to effectively deliver on software development projects. It was a supply chain management technique that helped mitigate the risk of project failure from things like a vendor not having a well-defined quality assurance process. [4]

If originally developed in the early 1990’s, the Maturity Framework is creeping towards middle age. The model has matured and become a fixture in project management, audit, risk, IT, quality management, business process improvement, and many other applications.

You know that a concept has become well entrenched when it is used in ISO standards. Maturity Frameworks have grown up and are here to stay so let’s understand how they work.

What Makes for a good Maturity Framework?

Maturity Frameworks do one of three things, they Describe, Prescribe, or Compare. This was laid out in a 2011 article having the very sensible title of ‘What Makes a Useful Maturity Model?’. These functions are defined as follows [5]:

1. Descriptive: Descriptive if it is applied for as-is assessments where the current capabilities of the entity under investigation are assessed with respect to given criteria.
   • The maturity model is used as a diagnostic tool.
   • The assigned maturity levels can then be reported to internal and external stakeholders.
2. Prescriptive: A maturity model indicates how to identify desirable maturity levels and provides guidelines on improvement measures. Specific and detailed courses of action are suggested.
3. Comparative: A maturity model for internal or external benchmarking.
   • Given sufficient historical data, the maturity levels of similar business units and organizations can be compared.

What Does a Maturity Framework Look Like?

A Maturity Framework has four big components in order of importance [5]:

1. Why: What is the purpose of Maturity Framework, how will it be used, by whom?
2. Levels: What are the maturity levels involved, how many steps, what are their names?
3. Criteria: How do you evaluate whether you are at step 0 or a 999?
4. Revision: How is the framework updated for changing criteria, redefined levels, updated purpose, or profound environmental shifts.

Why Do You Need a Framework and Who is Answering This Question?

The biggest benefit of a Maturity Framework is that it aligns with the human tendency to see patterns everywhere. When a consultant (or auditor, or someone else), says the process/organization is at Level 3, our super-power-pattern-recognition scans the levels and quickly concludes that a ‘3’ is ‘about right’, or too optimistic/pessimistic, or not quite right [6].

A Maturity Framework works best when its subjectivity is recognized, and its role is to guide versus control decision makers. The framework turns to the dark side if it becomes prescriptive and locks the organization into ridged set of activities (more on this when we discuss criticisms of a Maturity Framework in a future blog).

How Many Levels Are We Talking About Here?

The CMM framework had five levels while others have four. The Process and Enterprise Maturity Model (PEMM) cheats in that it has four levels at the business unit level and then another four Enterprise level assessments creating a three to four dimensional model [7].

CMM levels also diminished in increment. This means for each additional level there were fewer of what was being measured. In CMM’s case, the number of vendors who were compliant with the capability level. Other frameworks increase with each step. This implies increased costs or capacity with each level. Some frameworks have a very handy ‘Level 0’ or non-existent level. The Quality Management Maturity model had a level 0 AND a level -1 (representing no systematic approach). [8]

Criteria Or Knowing Which Level to Stop At

When is an organization at Level 1 or when has it reached the Nirvana state of Level 5? A cursory definition might be good enough. Other frameworks have extensive rubrics to determine when an organization is a Level 2 versus a Level 3. This evaluation may run into the dozens of pages or be an online survey to fit you into a level; think a ‘Harry Potter Sorting Hat‘ for organizations [9].

The problem with more precise criteria is that they may yield less relevant although more accurate results. For example, the ‘More Information is Better’ cognitive bias can lead an organization confusing extensive criteria gathering with a better assessment of the maturity of an organization [10]. Another challenge in this regard is confusing precision with accuracy when it comes to criteria [11].

An organization needs criteria to assess its maturity, but it also needs to not become bedazzled with an overly complex criteria assessment process.

Staying Mature in the Face of Change

Your organization has developed the perfect maturity level names and descriptions for a framework. The criteria runs to hundreds of pages and is perfect – and then the world changes. Technology, regulations, social conventions, etc., has rendered your carefully crafted framework obsolete. Worse still, it took years to reach this state of perfection and more years to re-open the discussions to update the methodology, what now?

Hopefully you have the structures to review, revise, and publish an updated Maturity Framework. Having the rules of engagement in place reduces the risks of games and politics derailing an update. Ideally the framework has added value so that the organization WANTS to update it. Finally, you have resources and infrastructure to communicate the changes to those who need to know and a process to deal with laggards.

In other words, coming up with a Maturity Framework is hard. Keeping it current in a fair, transparent, accountable manner is harder still!

Criticisms of Maturity Frameworks

One of the best ways to understand the strengths of something is to know its limitations. Like many tools, a Maturity Framework is useful as a general guide but withers under too much scrutiny.

Got Theory? Let’s start with the big criticism, a lack of a theoretical basis for frameworks.

The first CMM framework was used to evaluate software vendors. Thus, the grand daddy of all frameworks was a procurement tool rather than coming out of the academic world.

I am repeating this criticism although stumbling through this article suggests that the Academic world has in fact embraced maturity frameworks, at least at the periphery.

Bureaucratic, Inflexible and Static. Of course, if the academic world did come up with a good theoretical model, then this next criticism would come to the fore.

Organizations that try to improve their standing against a framework discover that the framework was static while the world changed. Changing the framework is fraught with its own risks namely gaming the system. To manage this problem, a mini-Maturity Framework-cottage industry grows up in the organization adding to the transaction cost and reducing the framework’s value.

Process over Outcomes.

Being a snapshot in time, the focus becomes improving the respective processes that made up the original framework. Noting the above challenges, processes become increasingly successful yielding poorer and poorer outcomes because they have lost sight of the of the original intent of the framework.

Does Not Accommodate Messy.

A variation on some of the above critiques but an important one. Life is messy with multiple paths that are equally bad/good. A maturity framework offers to sweep away this messiness with an end level ‘Nirvana’. Most of these Nirvana’s seemed to end up in a heaven filled with continuous improvement initiatives. Nothing particularly wrong with this as a destination unless you get there and realize the world has left you behind. Messy, controlled chaos, and choppy oceans filled with Black Swans is our future, not the best place for wrong type of maturity.

Resource Intensive with Diminishing Returns on Investment

Following a Maturity Framework can initially yield excellent results on the effort. To get to ever higher levels requires ever increasing resources. Small or resource-constrained organizations might find it challenging to fully adopt the model. This could limit their ability to achieve desired improvements – or staying at a lower maturity level make the most business sense. [12]

De-emphasizes Innovation or at least only implies it.

Frameworks focus on optimizing existing processes and may not give sufficient attention to fostering innovation and creativity in organizations. This could result in missed opportunities for breakthrough improvements and disruptive innovations that drive significant competitive advantages. [12]

Innovation is implied through a focus on things like continuous improvement. Self-directed tweaks to an existing process are great. Throwing out the process and replacing it with something else might be a better idea.

Too Broad or Too Focused.

In some cases, a Maturity Framework tries to boil the ocean and in others, it is a tempest in a teacup.

Too Broad. Starting with the first observation, many of the models suggest that Nirvana is just around the corner if only the organization embraces continuous improvement and turns the creative power of its employees loose on its business processes. There certainly is a lot of benefit from adopting such enlightened business practices. They did wonders for some organizations. Alternatively, if the road to hell is paved with good intentions, the road to Nirvana uses employee engagement initiatives for its construction [13].

Too Focused. Other Maturity frameworks seem to be business domain specific, for example, for Internal Audit, Procurement, Human Resources, etc. There is nothing wrong with having a model to better understand these internal processes. That is, until they get out of hand and the focus is on support areas and not the core business of the organization.

Useful as a Roadmap but Not a Tour Guide.

In many ways, Maturity Frameworks are like RBM. They are most useful when used as a tool by a capable leadership team who understands the limitations. The team manages the framework in a transparent and accountable manner and remembers it is a model of the organization and not the reason the organization exists. Think: all models are wrong, but some models are useful.

Conclusions and Next Posts

That in a nutshell is a Maturity Framework. Each of these components is worthy of a Doctorial dissertation or two so a short post will not do them justice. I hope to get back to a government Results Based Management shortly, but in the next post, a deeper dive of determining and assigning levels.

Notes and References

1. Maturity model | Wikipedia.
2. “Practice Guide: Selecting, Using, and Creating Maturity Models | The IIA.” Accessed December 23, 2025. www.theiia.org.
3. A Wikipedia source suggests that the GREAT Grand Daddy of Maturity Frameworks came from the quality management field and specifically the Quality Management Maturity Grid (QMMG). Like CMMM, it contained five levels which I personally find more intuitive: Uncertainty, Awakening, Enlightenment, Wisdom, Certainty; See: Quality Management Maturity Grid | Wikipedia.
4. An excellent review of Maturity Models is available from Why Maturity Models Don’t Work | Barryoreilly.com.
5. The description reference and components are roughly based on this article: Pöppelbuß, Jens, and Maximilian Röglinger. “WHAT MAKES A USEFUL MATURITY MODEL? A FRAMEWORK OF GENERAL DESIGN PRINCIPLES FOR MATURITY MODELS AND ITS DEMONSTRATION IN BUSINESS PROCESS MANAGEMENT.” ECIS 2011 Proceedings, October 6, 2011. https://aisel.aisnet.org/ecis2011/28.
6. Technically, this is called Apophenia. It kept our surviving ancestors from being eaten by hungry predators and causes others to believe that aliens are talking to them from their microwave. The Brain’s Obsession with Hidden Patterns.
7. See: Hammer, Michael. “The Process Audit.” Process Management. Harvard Business Review, April 1, 2007. https://hbr.org/2007/04/the-process-audit.
8. 5 of the 23 models evaluated had a level ‘0’. As this included an entry for both COBIT 4 and 5, the entry is really 4 out of 23. One model had a level ‘-1’ in addition to a level ‘0’.
9. If you have never read the Harry Potter books or seen the movies then read on if you are particularly curious: Sorting Hat | fandom.com.
10. Cognitive Biases help us run our lives and sometimes run amok. For this bias, I choose an investment website to explain it as financial investments tend to be a ‘pick one’ or ‘over think it’ type of affairs, see: Information Bias: Is More Information Always Better? | Quartr.com.
11. Accuracy and Precision are often used interchangeably. They are both part of a larger challenge of measurement (source: Accuracy and Precision | Geeks for Geeks).
    • Accuracy reflects how close you are to the measurement’s true value. Precision is how consistent 2+ measurements are to each other.
    • Both measures have their limitations, starting with Accuracy.
    • True values have a habit of changing. The market for widgets was X last year but is now X-Y this year. If you don’t constantly measure this change, your reference point may be off and thus inaccurate.
    • Precision has the same problem. Measures were close together but now are drifting apart because the underlying value is changing. Are the measurements imprecise or is the new measure more accurate.
    • Both precision and accuracy are dependent upon the assumption that you know what to measure, know how to measure it, that measuring it does not (in)directly change what is being measured, and that the subject of measurement has not changed while answering the questions (the assumption of consistency).
12. These two criticisms were inspired (to a greater or lesser degree) by this excellent blog: Business Process Maturity Model (BPMM) Explained | Flevy.com. Permission is in progress.
13. Examples of employee empowerment success stories can be found here: What are some case studies of companies that empower their employees? | Linkedin. A cursory review of why empowerment fails lists the usual culprits such poor culture alignment in an organization. Remember, ‘Never do what you can delegate but you can’t delegate what can’t be done‘.

Annex – A Short Survey of Maturity Frameworks

Overview of Analysis

To better understand Maturity Frameworks, I created a spreadsheet of some of the most common as well as a listing of the levels. In no way, shape, or form is this meant to be a statistical sample. Instead, it is meant to capture the most referenced models, a few that were interesting, and ideally at least one from each of the core business domains.

The IT world got ahead start on such things so is vastly overrepresented. Nevertheless, models can be found in governments, businesses, nonprofits, etc. and across all types of business processes.

Overview of Analysis

To date, 47 distinct maturity frameworks have been identified. 29 of these models have had their respective levels documented. Most of the models had 5 levels (20/29) followed by 4 with three having six or more levels.

# With 4 Levels	# With 5 Levels	# With 6 Levels	# With 9 Levels
6	20	2	1

Nearly all of the models identified the following attributes associated with the most-mature levels:

1. Continuous Improvement: Nearly all models emphasize ongoing refinement of processes, systems, or capabilities.
2. Strategic Integration: Maturity is marked by alignment with enterprise strategy and decision-making.
3. Embedded Culture. Practices (e.g., ethics, quality, risk) are not just implemented—they’re ingrained in organizational culture.
4. Data-Driven Decision Making. Advanced analytics, AI, and predictive insights guide real-time or strategic decisions.
5. Automation & Optimization. Systems are automated and optimized for efficiency, adaptability, and scale.
6. External Benchmarking or Validation. Excellence is validated through benchmarking, audits, or mission performance.
7. Resilience & Risk Management. Mature organizations anticipate, monitor, and respond to risks proactively.

Overview of Maturity Frameworks and Their Primary Category Mapping

Note that frameworks with a value of ‘Pending’ do not have a detailed analysis of their levels. This maybe for a variety of reasons including:

1. Over representation of the model type in the existing analysis population.
2. Inability to locate the model or clearly identify the respective levels.
3. Time and interest to pursue the model in context of the above.

Focus Description	Level-Documented	Pending-Documented
Business Process	2	2
Information Technology	12	9
Line Area (Finance, HR, etc.)	6	1
Other (Ethics, Risk, Controls, etc.)	3	3
Planning (Strategy but not Project)	2	2
Quality or Project Management	4	1
Grand Total	29	18

Next Steps

I built this analysis to better understand Maturity Frameworks. As I continue to come across new and interesting ones, I will add them to the data set. Nevertheless, if anyone knows of a Graduate Student looking for an (mildly) interesting project and possibly a paper to publish, send them my way. I have already spent WAY too much time stumbling around what is an interesting corner of business analysis world!