How can we evaluate an organization's risk maturity?

In order to accurately measure risk, one needs to evaluate or measure the market or industry risk levels. In other words, one needs to identify whether the organization’s activities or investments are of a risk tolerant nature or a risk averse stance. This can simply be identified through investigating previous investments to make assumptions of the organization’s risk level stance or evaluating a current project risk level stance. Then, one needs to evaluate different variables of an investment decision and how it may influence the organization. Remember, a market or an industry environment depends or is stimulated by each of its inter-dependent variables. Such variable may include demographics, geography, sociology, etc. After determining the organization’s risk stance and the factors or variables that influences such organizations, one should then analyze the performance of an investment or organization in relation to its market performance against its forecasted or desired performance. There are multiple methods or techniques that can be used to determine an organization’s risk maturity levels, which include preliminary risk analysis, failure mode and effects analysis, fault tree analysis, event tree analysis, cause-consequence analysis, etc.

I hope that Ive answered your question, if not you may want to try and rephrase the question.