Launch
Pick the model from the Nudj library, set the target level, dates and participants.
OECD Tax Administration Maturity Model Series2021 model
OECD Enterprise Risk Management Maturity Model: self-assessment tool
See how well enterprise risk management is understood, governed, practised and used in decision making across your tax administration.
About the model
What the Enterprise Risk Management model measures
The Enterprise Risk Management Maturity Model covers the organisational and operational sides of ERM in tax administrations, from strategy and governance through to how risks are identified, treated, reviewed and reported.
Maturity moves from ad hoc, reactive risk management that depends on individuals, to ERM that is fully part of strategy, performance management and culture, increasingly supported by advanced technology.
Structure8 indicative attributes under one overall maturity descriptor
Maturity levels5: Emerging → Progressing → Established → Leading → Aspirational
FormatFacilitated self-assessment; best-fit level per attribute
What is assessed
The 8 attributes
Each attribute is rated at the level that best describes the administration today. Not every statement under a level has to be met; the aim is the best overall fit, backed by evidence.
Indicative attributes
- 1. Strategy
- 2. Governance
- 3. Culture
- 4. Risk Identification
- 5. Risk Analysis and Evaluation
- 6. Risk Treatment
- 7. Review and Revision
- 8. Information, Communication, and Reporting
Maturity levels
5 levels, from Emerging to Aspirational
The model describes a direction of travel, not a pass mark. There is no single right level for every administration: you choose the target that fits your context, and Nudj measures the gap to it.
Emerging
Capabilities exist in pockets and depend on individuals; practice is ad hoc and often reactive.
Progressing
Some processes are in place and understood, but they are applied unevenly across the administration.
Established
Processes are standard, coordinated and part of how the administration routinely works.
Leading
Practice is integrated with strategy and performance management and continuously improved.
Aspirational
A forward-looking position few administrations reach yet, often using advanced data and technology.
How it works in Nudj
From self-assessment to an improvement plan.
Discuss
Run the facilitated discussion. Each participant chooses the best-fit level for every attribute.
Evidence
Record the reasons for each rating and attach supporting documents.
Validate
An assessor reviews, challenges and validates the ratings before they count.
Analyse
See the result by attribute and theme, and the gap to your target level.
Act
Turn the gaps into recommendations, a roadmap and owned tasks.
Re-assess
Run the model again later and compare cycles to show progress.
Running the session
Who should take part
ParticipantsStaff with risk management responsibilities across grades and business areas. A facilitator from outside the ERM chain can challenge views and ask for evidence.
TimeFrom a few hours to more than a day, depending on preparation and detail.
OutcomeA validated maturity profile, the gaps to your target, and a roadmap of owned actions.
FAQ
Questions about the Enterprise Risk Management model in Nudj
Is this the official OECD Enterprise Risk Management Maturity Model?
Nudj's assessment follows the structure of the OECD Enterprise Risk Management Maturity Model as published by the OECD: the same attributes and the same 5 maturity levels. Nudj is not affiliated with the OECD; we recommend that participants also have the OECD publication to hand.
Can we run the Enterprise Risk Management model as a self-assessment?
Yes. The model is designed as a facilitated self-assessment. Nudj supports a single facilitated session or several respondents rating separately, with an assessor validating the results.
How long does the assessment take?
From a few hours to more than a day, depending on preparation and detail.
Can we compare results over time?
Yes. Each run is a separate assessment event, and Nudj compares cycles side by side so you can show progress against your target.
Is Nudj available in Arabic?
Nudj's interface works in English and Arabic, including right-to-left layout. The OECD model content itself is in English.
Can we add our own questions or use other frameworks?
Yes. You can extend a built-in model with your own questions, and use Nudj's framework builder for your organisation's own models alongside the OECD ones.
Does the ERM model replace our risk register?
No. It assesses how mature your risk management practice is. Nudj turns the gaps it finds into owned improvement actions; your risk register stays where it is.
Other OECD maturity models in Nudj
OECD is a registered trademark of the Organisation for Economic Co-operation and Development. Genuine Soft and Nudj are not affiliated with or endorsed by the OECD. The maturity models are published by the OECD; Nudj provides the platform for running assessments based on them.
Run the Enterprise Risk Management model in Nudj.
See the full assessment, from the first rating to the improvement roadmap.