The Risk Management Maturity Model (RM3) provides a useful mechanism to understand the capability of the organisation to sustain (or improve) high levels of effective control ie to understand why an organisation is performing as it is. Information captured from the audits can be used to help inform the RM3 evaluation.
This stage tests the assumptions made in relation to the controls and their level of effectiveness, and also implements the monitoring arrangements determined in stage 3.
Once the risk profile has been established (the bow ties) it becomes possible to establish the vulnerability of the organisation to the identified hazards and the criticality of the controls.
Assurance that the health risks are being effectively and efficiently managed can only be achieved if there is a full understanding of the health risk profile of the organisation, proportionate to the significance of the risks