According to the Standards, which of the following is based on the assertion that the quality of an organization's risk management process should…

A maturity model is a framework that describes the stages of development for a specific process, such as risk management. It is based on the principle that processes evolve and improve over time, moving from ad-hoc and informal states to more defined, managed, and optimized levels. The core assertion of a maturity model is this progressive improvement in quality, capability, and reliability. Internal auditors often use risk management maturity models to assess the current state of an organization's risk management processes and to provide a roadmap for future enhancements, thereby directly supporting the idea that the process quality should improve over time.

A. Process element: This refers to a specific component or activity within a larger process (e.g., risk identification), not a framework for its evolution.

B. Key principles: These are fundamental rules or beliefs that guide the risk management process, but they do not, by themselves, constitute a model for its progressive improvement.

D. Assurance: This is the outcome of an objective assessment of a process, providing an opinion on its effectiveness, rather than being the model for its development.

1. The Institute of Internal Auditors (IIA). (2010). Practice Guide: Assessing the Adequacy of Risk Management Using ISO 31000. "A maturity model can be used to assess the current state of risk management and to set targets for improvement. The model describes the characteristics of effective risk management at various levels of maturity." (Section: "Risk Management Maturity Models").

2. The Institute of Internal Auditors (IIA). (2017). Implementation Guide 2130: Control. "The internal audit activity may evaluate the design adequacy and operating effectiveness of the organization’s control environment... This may involve using a maturity model to evaluate where the organization is on the continuum from a weak control environment to a strong one." (Paragraph 3).

3. Paulk

M. C.

Curtis

B.

Chrissis

M. B.

& Weber

C. V. (1993). Capability Maturity Model for Software

Version 1.1 (CMU/SEI-93-TR-024). Software Engineering Institute

Carnegie Mellon University. This foundational document from a reputable university institution establishes the concept of a maturity model as a framework for continuous process improvement through defined evolutionary stages (e.g.

Initial

Repeatable

Defined

Managed

Optimizing). (Section 2.1

"The Five Levels of Software Process Maturity").