Contents Page
4 Governance maturity aspects
4.1 General
4.2 Governance behaviour
4.3 Governance effectiveness
4.4 Governance efficiency
4.4.1 General
4.4.2 Governance frameworks
4.4.3 Governance strategies
4.4.4 Governance policies
4.4.5 Organizational performance results
4.4.6 Governance charters
4.4.7 Management reports
4.4.8 Governance component reviews
5 Governance maturity measurement framework
5.1 General
5.2 Measurement principles
5.3 Measurement activities
5.3.1 Commitment
5.3.2 Design
5.3.3 Implement
5.3.4 Oversee
5.3.5 Action
5.4 Measurement scale
5.4.1 General
5.4.2 Governance behaviour scale
5.4.3 Governance effectiveness scale
5.4.4 Governance efficiency scale
5.4.5 Governance maturity scale
5.5 Measurement aggregation
6 Governance maturity model
6.1 General
6.2 Governance maturity dimensions
6.2.1 Governance conditions
6.2.2 Governance principles
6.3 Governance maturity calculation
6.3.1 Maturity model content
6.3.2 Evaluation judgements
6.3.3 Aggregation of results
6.4 Governance maturity improvement
6.4.1 Determining governance appropriateness
6.4.2 Setting improvement targets
6.4.3 Implementing improvement initiatives
6.5 Governance maturity evaluation
6.6 Governance maturity reporting
Foreword
ISO (the International Organization for Standardization) is a worldwide federation of national standards bodies (ISO member bodies). The work of preparing International Standards is normally carried out through ISO technical committees. Each member body interested in a subject for which a technical committee has been established has the right to be represented on that committee. International organizations, governmental and non-governmental, in liaison with ISO, also take part in the work. ISO collaborates closely with the International Electrotechnical Commission (IEC) on all matters of electrotechnical standardization.
The procedures used to develop this document and those intended for its further maintenance are described in the ISO/IEC Directives, Part 1. In particular, the different approval criteria needed for the different types of ISO document should be noted. This document was drafted in accordance with the editorial rules of the ISO/IEC Directives, Part 2 (see
www.iso.org/directives).
ISO draws attention to the possibility that the implementation of this document may involve the use of (a) patent(s). ISO takes no position concerning the evidence, validity or applicability of any claimed patent rights in respect thereof. As of the date of publication of this document, ISO had not received notice of (a) patent(s) which may be required to implement this document. However, implementers are cautioned that this may not represent the latest information, which may be obtained from the patent database available at
www.iso.org/patents. ISO shall not be held responsible for identifying any or all such patent rights.
Any trade name used in this document is information given for the convenience of users and does not constitute an endorsement.
For an explanation of the voluntary nature of standards, the meaning of ISO specific terms and expressions related to conformity assessment, as well as information about ISO's adherence to the World Trade Organization (WTO) principles in the Technical Barriers to Trade (TBT), see
www.iso.org/iso/foreword.html.
This document was prepared by Technical Committee ISO/TC 309, Governance of organizations.
Any feedback or questions on this document should be directed to the user’s national standards body. A complete listing of these bodies can be found at
www.iso.org/members.html.
Introduction
The need for effective governance of all sizes and types of organizations is of increasing importance. This is evidenced by society’s growing demands for organizations to demonstrate effective stewardship of the resources which they use and impact, beyond merely financial returns. Society and organizational stakeholders are demanding not only that governance failures be avoided, but that good governance outcomes are demonstrated. These expectations necessitate the existence of a standard against which an organization’s governance can be measured and decisions can be made. This document provides an approach for organizations, and their stakeholders, to evaluate, compare and improve their governance over time such that the organization can achieve good governance outcomes.
In 2021, ISO adopted the first internationally agreed standard for the governance of organizations, ISO 37000, which set out governance conditions, governance principles and key aspects of practice, and governance outcomes for the governance of organizations. At that time, there was no internationally agreed approach by which to measure the governance of an organization in terms of ISO 37000. In the absence of such an approach to measurement, the identification of areas for improvement, the consistent assessment of an organization’s governance maturity and an informed comparison with others were problematic. Governance maturity, in this context, reflects, for example, the degree of organizational responsiveness, agility and resilience in addressing changing operational conditions, while maintaining alignment with the organizational purpose and organizational values.
Figure 1 depicts the governance maturity aspects outlined in this document and which should be considered when evaluating governance maturity. These are the governance behaviour by the governing body when governing the organization, in accordance with
ISO 37000, and the effectiveness and efficiency with which the governing body applies the
ISO 37000 governance principles.
Figure 1 — Governance maturity aspects — Summary |
|
|
This document provides a globally applicable means to measure the maturity of the governance of an organization and describes an internationally agreed maturity measurement framework and maturity model for the governance of organizations. It sets out guidance on measuring an organization’s governance maturity, based on the ISO 37000 governance conditions and governance principles, and applies to all types and sizes of organizations no matter their location. It provides a standardized approach to determine the level of maturity level of the organization’s governance conditions and the organization’s application of the ISO 37000 governance principles, as well as providing examples of governance activities at each level.
Governance practices necessarily vary between organizations and should be selected and implemented according to the organization’s specific and unique circumstances. These variations are due to factors including how long the organization has been in existence, the organizational context, the number of personnel the organization employs, the types of resources the organization uses, and laws and regulations applicable to the organization. This document is, therefore, not intended to assess the implementation of governance practices, nor the effectiveness of these governance practices. This document provides a basis for the evaluation of the application of the guidance provided by ISO 37000.
Figure 2 provides an overview of the governance maturity model outlined in this document.
Figure 2 — Governance maturity model — Summary |
|
|
When applying this document’s governance maturity model to an organization, the results can be used to measure and evaluate the level at which the ISO 37000 governance guidance has been applied, in a consistent and standardized way.
Evaluations, by or on behalf of an organization, can:
—
facilitate self-assessment;
—
provide a basis for improvement;
—
assist with addressing governance risks;
—
be used as input for reports to stakeholders;
—
provide a benchmark for comparison with others.
Reports of governance maturity evaluation results can assist:
—
organizations to prioritize governance improvement activities;
—
governing bodies to demonstrate accountability to their organizations;
—
key stakeholders to hold an organization’s governing body responsible for the continual improvement of the governance of the organization.
Results can therefore be used, for example, by an organization’s:
—
governing body to demonstrate the continual improvement of their governance of the organization;
—
internal stakeholders, such as personnel, to enhance their confidence that the governance of their organization is appropriate, effective and defensible;
—
external stakeholders, such as investors and regulators, for decision-making purposes.