Maturity and Assessment
The Enterprise Readiness Maturity Model
Organizational readiness develops step by step. A team might start by making one recurring response explicit. Then it learns to recognize relevant signals, coordinate across functions, and improve its preparation as situations change. Maturity is the capability it accumulates to see more, coordinate more deliberately, and learn at each stage.
Many fields use maturity models to assess capability and find where to improve. Before leaders can close a gap, they need a way to describe it. Enterprise Readiness does the same. Scores do not create readiness, but a common language helps an executive team compare different instincts about where the enterprise stands. The real question is not simply whether the enterprise is ready, but ready compared to what, and compared to where it was six months ago.
Readiness is a capability an organization builds, not a record of situations it managed to avoid. What matters is whether the organization becomes more capable of responding to what arrives, and whether that capability improves with use. Erik Hollnagel made a related distinction in resilience engineering. He defined safety as the capacity to succeed under varying conditions rather than merely the absence of failure. These levels are an organizing model drawn from patterns I observed over decades of leading transformations, not a validated universal scale.
Level One: Reactive. A reactive organization is driven by events. Projects start after problems surface, and information arrives too late to matter. The enterprise recognizes a Strategic Situation only once it has become hard to avoid. Departments work independently, each on its own version of a problem that has already spread across the organization. Success depends heavily on individuals, so capability is fragile when they leave. In organizations I observed, people sometimes said, "we did not see this coming," even when warning signs had been visible earlier. The organization had not developed a way to recognize and interpret those signals together. The organization survives, but it rarely anticipates.
Level Two: Managed. Managed organizations introduce discipline. Projects become more predictable, governance improves, and standardized reporting gives leadership visibility across the enterprise. This is where many Project Management Offices create enormous value, and where many organizations I worked in began. By this point the PMO has usually set a method, made delivery more consistent, and built governance that reduces the chaos of Level One.
These are real achievements, but Readiness is still limited. The enterprise manages execution well. Yet it responds to Strategic Situations inconsistently, optimizing locally rather than collectively. A cybersecurity incident is handled by the security team. When an acquisition closes, integration goes to a project team formed from scratch. Success at Level Two depends on capable, disciplined management, not yet on enterprise adaptability. The organization performs when conditions are stable and struggles when they change faster than the system can absorb.
Level Three: Aligned. The first time I recognized a Level Three organization, I was not reading a governance document. I was in an executive meeting where someone asked whether the organization was ready for what was coming, before anyone had mentioned delivery. When that question is asked seriously and answered with evidence, the organization has learned to see situations before they become undeniable.
At Level Three, leadership starts organizing around Strategic Situations as well as projects. "Are we ready for this?" becomes a legitimate question in meetings that once revolved around delivery milestones. A common language develops. Readiness Protocols emerge for situations the organization faces often, and leaders recognize recurring patterns instead of treating each one as unprecedented. It also becomes easier to measure Readiness.
Amy Edmondson's research on psychological safety highlights one condition that helps people surface uncomfortable signals: the ability to speak without fear of punishment. In the organizations I watched move toward Level Three, the most visible change was not always in governance documents. It was often in the quality of executive meetings. Conversations became more honest and problems surfaced earlier. Decisions came faster because the shared understanding they required had been built before the meeting began.
Level Four: Adaptive. Adaptive organizations learn from each activation. Signals become visible earlier, and leaders can recognize a Strategic Situation while response options are still open. Readiness Protocols can shorten mobilization when they are relevant, current, and authorized. When a significant situation arrives, the organization adapts what it has prepared. It tests that preparation against the facts instead of starting from zero.
Atul Gawande showed how a checklist helps skilled professionals avoid skipping essential steps under pressure. A Readiness Protocol works in a similar way: it holds decisions that should not have to be reinvented in the moment. In the Stanford play-clock example, preparation made a coordinated response possible within a defined clock. Enterprise situations have different windows and cannot be reduced to the same constraint.
Artificial Intelligence can strengthen executive judgment at this level without replacing it. With clear authority and governance, teams can use AI for sensing and pattern recognition without confusing contribution with accountability. Learning becomes more institutional as departments practice coordinating. The organization looks less rushed. Uncertainty has not disappeared, but some of the relevant preparation is already in place.
The checklist analogy sets the frame; the measurable test starts at authorization. With a fully configured protocol under controlled conditions, mobilization and coordination are in full motion 12 minutes after executive authorization, when protocols are pre-staged. Detection and the authorization request come first, and the executive's decision time is not counted. It is a validation target, not a universal customer result.
Level Five: Anticipatory. In my experience, elements of this level are uncommon, though I lack a representative cross-industry sample to estimate how common they are. Anticipatory enterprises try to shape their environment, not only respond to it. They work to recognize weak signals before markets shift and invest in capability before a situation demands it. Governance evolves without waiting for a crisis. Innovation may become more systematic rather than episodic.
Each activation can strengthen the organization's ability to handle a related situation, if the learning is captured and built into practice. That accumulated judgment may become an advantage. The effect varies with the quality of the learning, the relevance of the prior experience, and changes in the environment. A product is easier to copy than a deeply embedded organizational practice, though neither advantage is permanent.
Maturity Is Not Linear
Organizations rarely mature evenly. Technology capability might operate at Level Four while governance sits at Level Two and decision-making culture at Level Three. That is normal; capabilities grow where the organization has invested. The model works best as a diagnostic tool, not an overall grade, because it shows which of the four gaps needs deliberate investment. Leadership can then talk precisely about Signal Loss, Decision Rights, Structural Barriers, and Psychological Safety instead of generally about readiness.
The Journey Never Ends
A maturity model can suggest that its highest level means the work is done. Law Seven applies here as well.
Readiness is never permanently finished. An organization at Level Five today can lose capability if learning stops, governance hardens, or new leadership lets useful practices lapse. Maturity is behavioral as well as categorical: when uncertainty increases, does performance improve or get worse? The levels describe a progression from reactive patterns toward stronger coordination, learning, and anticipation. They are an aspiration of Enterprise Readiness, not a prediction about every organization. What Enterprise Readiness aims for is getting better at responding to uncertainty, not avoiding it.
The organizations that may benefit soonest from the preparation architecture are not necessarily the most sophisticated. Some see their maturity journey costing more than it delivers. Delays in building response capability can prolong the assembly costs illustrated by the Mobilization Tax. The architecture is meant to close a gap that a maturity journey alone may not address. In the first ninety days, an organization can establish an initial baseline and pilot, not complete the work.
The preparation architecture may be especially relevant to organizations that have been told they must mature before they can compete. Under the right conditions, a less mature organization can build a fit-for-purpose capability without inheriting every legacy process of a more mature competitor. Results depend on its starting point, governance, leadership, and the situations it needs to address. The preparation architecture is not a shortcut that guarantees success. It is a distinct capability to develop alongside the organization's other strengths.
The Enterprise Readiness Assessment
Diagnosis helps leaders choose the right intervention. Medicine begins with examination, not treatment. A physician who prescribes without an adequate diagnosis risks treating the wrong problem. Organizations sometimes begin transformation with the answer already chosen: "We need Agile," "We need AI," "We need a reorganization," or "We need new governance." Some may be right, but they are interventions, not diagnoses. Richard Rumelt argues that good strategy begins with an honest diagnosis of the challenge. He warns against leaping to goals and solutions first. Without understanding the current state, even a promising intervention can solve the wrong problem.
I learned this early in my career, during a transformation I led inside a large financial services organization. The executive team concluded that its execution problems stemmed from weak governance. We redesigned the governance architecture, added reporting layers, established steering committees, and created a portfolio oversight function. Execution did not improve. The organization got slower.
The real problem was fragmented decision-making, which no amount of documentation could fix. People at every level were making locally reasonable decisions that together produced incoherent outcomes. We needed to address Decision Quality at the executive level first, and a diagnosis before the prescription would have told us so.
What the Assessment Measures
The Enterprise Readiness Assessment does not measure project maturity, performance against benchmarks, or compliance. It examines an enterprise's capacity to sense Strategic Situations, build Shared Understanding, establish authority, communicate in the required sequence, deploy a Prepared Response, and encode Institutional Memory. Many other assessments ask something else.
An organization can be profitable and still have preparation gaps. Financial results can reflect prior advantages such as market position, a successful product cycle, or a loyal customer base. Disappointing results, on their own, do not mean an organization lacks adaptive capability either. Some choose to invest in readiness under financial pressure, though that investment cannot guarantee an advantage. Financial performance reflects outcomes; Enterprise Readiness focuses on capability. Both matter, and neither replaces the other.
The Four Diagnostic Gaps Applied
Chapter 9 introduced the four gaps of Enterprise Readiness as a diagnostic record. The assessment examines not only the current evidence for each gap but why it exists and what would change it.
Applied this way, each gap turns into a question: Signal Loss: Did relevant information reach the people who could act before the window closed? Decision Rights: Were authority, accountability, and escalation clear when a decision was required? Structural Barriers: Which cross-functional dependencies became walls under pressure? Psychological Safety: Could people surface the signal, uncertainty, or disagreement the response required?
Building the Diagnostic Record
Rather than a single composite score, the assessment produces an evidence record organized around Signal Loss, Decision Rights, Structural Barriers, and Psychological Safety. Some organizations receive signals early but lose them before they reach the people who can act. Others understand the situation but spend the response window settling authority. Still others run into cross-functional dependencies or conditions that suppress necessary disagreement. Chapter 17 develops how evidence, trend, and intervention make these vulnerabilities visible. The goal is not a uniform score. It is to see which gap is delaying coordinated action, what evidence supports that conclusion, and what intervention should close it.
The Questions That Reveal the Most
Across dozens of Readiness assessments in different industries and organization sizes, I have found that some questions reveal more than others.
The Readiness Review asks different questions.
Instead of "How many Strategic Situations did we face last year?" ask "Which ones surprised us, and what prevented earlier recognition?" Rather than "Do we have Readiness Protocols?" ask "When did we last use one, and how did it change the outcome?" Replace "Is executive alignment strong?" with "Describe the last time a significant decision was made and trace what happened to it as it moved through the organization." Trade "Does governance support Readiness?" for "What is the most recent example of governance slowing an important response? What would have needed to be different for it to accelerate instead?" And in place of "Is confidence high?" ask "Can people surface uncertainty or disagreement before a response requires it?"
None of these can be answered from documentation. They require honest conversation, and that takes a level of trust that itself reflects the organization's Readiness. Sometimes the willingness to engage openly with the assessment is the first indicator.
The Assessment as Operating Practice
The assessment should never become an annual compliance exercise: a questionnaire sent out in Q4, scored by November, filed in December, and forgotten by February.
Readiness shifts with markets, leadership, technology, and priorities. So the assessment belongs in the operating rhythm: quarterly conversations, executive retreats, major investment decisions, and post-situation reviews.
Philip Tetlock's research on forecasting suggests that judgment about an uncertain future can improve through disciplined updating and honest track records. A Readiness assessment can encourage that habit instead of a negotiation between competing intuitions. Used this way, it is less an audit than a mirror. Leaders can ask not only "What score did we receive?" but "What does this reveal about how we are thinking?"
In assessments I have led, the most important outcome was sometimes not the record but the conversation it made possible. Leaders discovered they disagreed about the organization's most significant Strategic Situations. Executives who believed their decisions were consistently strong learned that the teams carrying out those decisions experienced something different. Boards that believed they were governing Readiness learned they were governing performance.
A capability is hard to improve when leaders cannot see how it works in practice. In the end, the assessment is an exercise in organizational self-awareness. That awareness can inform judgment, and judgment acted on over time can build capability.