0 / 24

Model 56 of 74 · Risk & Compliance

Regulatory Readiness Maturity Assessment

Assess your organisation's ability to anticipate and comply with regulations.

Pillars & areas

Scan

Know the landscape

  1. 01Regulatory Landscape & Intelligence
  2. 02Compliance Framework & Policies

Monitor

Verify & adapt

  1. 03Compliance Monitoring & Assurance
  2. 04Regulatory Change Management

Engage

Build capability

  1. 05Training & Awareness
  2. 06Reporting & Regulatory Relationships

Levels

  1. 1Last-MinuteScrambling before deadlines
  2. 2Obligation-MappedDocumented & tracked
  3. 3AnticipatoryAhead of the curve

01 Regulatory Landscape & Intelligence

Does the organisation actively track the regulations that apply to it and spot new ones early?

0/4 answered

RL-1How does your organisation identify which regulations apply to its operations?

Think about whether there is a maintained register of applicable laws and regulations, or whether obligations are discovered ad-hoc.

RL-2How does your organisation monitor for upcoming or changing regulations?

Consider whether you learn about regulatory changes from the news, from industry bodies, or through a deliberate scanning process.

RL-3How well does your organisation understand the intent behind the regulations it must follow?

Think about whether compliance teams understand only the letter of the law, or also the regulatory objectives and enforcement priorities.

RL-4How does your organisation assess the impact of a new or changing regulation on its business?

Consider whether someone formally maps a new regulation to affected processes, systems, and teams before deciding what to do.

02 Compliance Framework & Policies

Does the organisation have a coherent set of policies and controls that translate regulatory requirements into day-to-day practice?

0/4 answered

CF-1How does your organisation translate regulatory requirements into internal policies and procedures?

Think about whether there is a clear line from a regulation to a specific internal policy that staff actually follow.

CF-2How current are your compliance-related policies?

Consider when your policies were last reviewed and whether they reflect the regulations as they stand today.

CF-3How does your organisation manage conflicts or overlaps between different regulations?

Think about situations where two regulations require different things, or where the same control satisfies multiple regulations.

CF-4How accessible are compliance policies to the staff who need to follow them?

Consider whether a frontline employee could find the policy that applies to their work within a few minutes.

03 Compliance Monitoring & Assurance

Does the organisation verify that its controls are working and that it is actually compliant, not just on paper?

0/4 answered

MA-1How does your organisation verify that compliance controls are operating as intended?

Think about whether anyone checks that the controls described in your policies are actually being followed in practice.

MA-2How does your organisation handle compliance breaches or control failures when they are discovered?

Consider what happens when someone identifies that a regulatory requirement is not being met — is there a defined process, or does it depend on who finds it?

MA-3How does your organisation use data and technology to support compliance monitoring?

Think about whether compliance checks are manual spreadsheet exercises or whether systems flag issues automatically.

MA-4How does your organisation prepare for external regulatory audits or inspections?

Consider whether audit preparation is a scramble to gather evidence, or whether evidence is already organised and ready.

04 Regulatory Change Management

Can the organisation absorb regulatory changes smoothly, without disruption or last-minute panic?

0/4 answered

RC-1How does your organisation plan and execute changes required by new or amended regulations?

Think about whether regulatory changes are treated as projects with plans, owners, and milestones, or whether they are handled ad-hoc.

RC-2How far in advance does your organisation begin preparing for known regulatory deadlines?

Consider the typical lead time between identifying a regulatory change and completing your organisation's response.

RC-3How does your organisation ensure that regulatory changes are implemented consistently across all affected business areas?

Think about whether each department implements the same regulatory change differently, or whether there is a coordinated approach.

RC-4How does your organisation verify that a regulatory change has been fully embedded after implementation?

Consider whether anyone checks, weeks or months later, that the changes made for a new regulation are still being followed.

05 Training & Awareness

Do staff understand their regulatory obligations and know how to fulfil them in their daily work?

0/4 answered

TA-1How does your organisation ensure staff understand the regulations relevant to their role?

Think about whether staff receive role-specific compliance training, or whether everyone gets the same generic overview.

TA-2How does your organisation measure whether compliance training is effective?

Consider whether you measure only completion rates, or whether you also assess whether people actually changed their behaviour.

TA-3How does your organisation communicate regulatory changes to affected staff?

Think about what happens when a regulation changes — do the people whose work is affected hear about it promptly and clearly?

TA-4How does your organisation build and maintain regulatory expertise within its workforce?

Consider whether compliance knowledge depends on one or two individuals, or whether expertise is distributed and developed deliberately.

06 Reporting & Regulatory Relationships

Does the organisation report compliance status clearly and maintain constructive relationships with its regulators?

0/4 answered

RR-1How does your organisation report compliance status to senior leadership and the board?

Think about whether leadership receives regular, meaningful compliance reporting, or whether they hear about compliance only when something goes wrong.

RR-2How does your organisation manage its relationship with regulators?

Consider whether your interactions with regulators are limited to inspections and enforcement, or whether you engage proactively.

RR-3How does your organisation handle mandatory regulatory reporting and filings?

Think about whether regulatory reports are filed on time and accurately, or whether deadlines are frequently missed or data quality is poor.

RR-4How does your organisation use regulatory feedback and enforcement trends to improve its compliance posture?

Consider whether you analyse regulatory feedback, industry enforcement actions, and peer benchmarking to strengthen your own controls.

Self-assessment report

Regulatory Readiness

Answer the questions above and your report builds here: an overall score, a score and target for each area, and the three changes that matter most.

About this model

About the Regulatory Readiness maturity model

Regulatory compliance is not a checkbox exercise. Organisations that treat compliance as a periodic scramble to satisfy auditors consistently spend more, suffer more disruptions, and face greater enforcement risk than those that weave regulatory awareness into the fabric of their operations. True regulatory readiness means the organisation can absorb new and changing regulations smoothly, demonstrate compliance at any moment, and maintain constructive relationships with the bodies that oversee it.

This model assesses not whether an organisation is compliant with any specific regulation, but whether it has the structures, processes, and culture to stay compliant as the regulatory landscape evolves. The goal is to shift from firefighting to foresight.

The Regulatory Readiness maturity model evaluates an organisation's capability across six areas that together determine how well it can anticipate, prepare for, implement, and sustain compliance with regulatory obligations. It applies regardless of industry, jurisdiction, or regulatory regime.

The model uses 24 questions across 6 areas, scored at three maturity levels. Each question describes concrete, observable behaviours rather than abstract ideals, making it straightforward to identify where the organisation stands today and what a meaningful improvement looks like.

Who this assessment is for

  • Chief Compliance Officers, Heads of Regulatory Affairs, and GRC (Governance, Risk & Compliance) leaders
  • Risk managers and internal audit teams assessing compliance programme maturity
  • General Counsel and legal operations teams responsible for regulatory obligations
  • Senior executives and board members seeking visibility into regulatory risk exposure
  • Operational leaders in regulated industries (financial services, healthcare, energy, pharmaceuticals, telecommunications) responsible for embedding compliance into business processes
  • Consultants and advisors helping organisations strengthen their regulatory posture

The three maturity levels

  • Level 1 — Last-Minute: The organisation addresses regulatory obligations only under pressure. Compliance activities are ad-hoc, driven by deadlines, audit findings, or enforcement actions. Knowledge of applicable regulations is incomplete, policies are outdated, and there is no systematic process for tracking regulatory change. Compliance depends on individual effort rather than organisational capability.
  • Level 2 — Obligation-Mapped: The organisation has documented processes for identifying, tracking, and implementing regulatory requirements. A regulatory register exists, policies are reviewed on a cycle, training is delivered, and compliance is monitored through periodic assessments. The compliance function operates as a recognisable programme with defined roles and responsibilities, though it may still be largely manual and backward-looking.
  • Level 3 — Anticipatory: The organisation continuously scans the regulatory horizon, begins preparing for changes during the consultation phase, and embeds compliance into business operations rather than bolting it on afterwards. Monitoring is automated where possible, evidence of compliance is generated as a by-product of normal operations, and the organisation maintains proactive relationships with its regulators. Compliance is treated as a strategic capability, not an overhead.

The 6 areas assessed

1. Regulatory Landscape & Intelligence

Assesses whether the organisation actively tracks which regulations apply to it, monitors for new and changing regulations, understands regulatory intent, and evaluates the business impact of regulatory developments. Organisations that score well here are rarely surprised by a new obligation.

2. Compliance Framework & Policies

Evaluates whether regulatory requirements are translated into clear, accessible internal policies and controls. This area examines policy currency, the management of regulatory overlaps and conflicts, and whether staff can actually find and use the policies that apply to their work.

3. Compliance Monitoring & Assurance

Examines how the organisation verifies that its compliance controls are working in practice, not just on paper. This includes internal monitoring, breach handling, the use of technology for compliance oversight, and the organisation's readiness for external audits and inspections.

4. Regulatory Change Management

Assesses the organisation's ability to absorb regulatory changes smoothly. This covers how changes are planned and executed, lead times before deadlines, consistency of implementation across business areas, and verification that changes are sustained after initial implementation.

5. Training & Awareness

Evaluates whether staff understand the regulations relevant to their roles and know how to comply in their daily work. This area covers the quality and relevance of training, measurement of training effectiveness, communication of regulatory changes, and the depth and distribution of regulatory expertise across the organisation.

6. Reporting & Regulatory Relationships

Examines how compliance status is reported to leadership and the board, the quality of the organisation's relationship with its regulators, the reliability of mandatory regulatory filings, and whether the organisation learns from regulatory feedback and industry enforcement trends.

How this model relates to other frameworks

  • ISO 37301 (Compliance Management Systems)
  • COSO Internal Control Framework
  • Basel Committee on Banking Supervision — Compliance and the Compliance Function in Banks
  • OECD Regulatory Policy Outlook
  • IIA Three Lines Model (Institute of Internal Auditors)
  • NIST Risk Management Framework (organisational governance components)

Frequently asked questions

What is the Regulatory Readiness maturity model?

Assess your organisation's ability to anticipate and comply with regulations. It is an original, simplified model with three maturity levels (Last-Minute, Obligation-Mapped and Anticipatory), assessed through 24 questions across 6 areas: Regulatory Landscape & Intelligence, Compliance Framework & Policies, Compliance Monitoring & Assurance, Regulatory Change Management, Training & Awareness and Reporting & Regulatory Relationships.

How long does the Regulatory Readiness assessment take?

Most people finish in 10–14 minutes. Each of the 24 questions has three concrete answer options. Your progress is saved in the page URL, so you can bookmark it and come back later.

How is the score calculated?

Each answer scores 1 (Last-Minute), 2 (Obligation-Mapped) or 3 (Anticipatory). An area's score is the average of its answered questions, and the overall score is the average of the area scores, so every area counts equally. Scores run from 1.0 to 3.0.

Is my data stored or shared?

No. Your answers are never sent to a server. They are stored only in the page URL, which you control. Copy the link to share results with colleagues, or export a PDF or CSV report.

How should I use the results?

Start with "Where to focus" in your report. It lists the questions with the biggest gap to the target you set for each area, and shows what the next level looks like in practice. For a fuller picture, ask several people from different teams to complete the assessment and compare their links. Differences in perception are often as revealing as the scores themselves.