Every ResiliencyPulse assessment scores on the same scale: 0 to 5, in 0.25 steps, with the same level descriptions on every question. The level definitions are the maturity model from COBIT, ISACA’s framework for the governance of information and technology, an industry standard auditors and risk teams already know. This post explains what the levels mean and why the scale is built the way it is.
The six levels
0, Non-existent. No recognizable practice. Nobody owns it, nothing is written down, and if you asked three people how it works you would get three shrugs.
1, Initial or ad hoc. It happens, but reactively and through individuals. When the person who knows how it works is on vacation, it does not happen.
2, Repeatable but intuitive. The practice repeats. People know roughly what to do. It still depends on who is in the room rather than on a defined program. Most organizations we assess land here first.
3, Defined process. Documented, standardized, communicated. A new hire can follow it. This is the level at which a program stops being a person and becomes a function.
4, Managed and measurable. Monitored and measured, with action taken when performance slips. The program has metrics leadership sees and a cadence that does not depend on a crisis to trigger it.
5, Optimized. Continuously improved and integrated into how the organization runs. Rare, and it should be. A 5 means the practice has disappeared into the business, not that every box is ticked.
Why the scale starts at zero
A scale that starts at 1 hides the most common honest answer. Plenty of programs have controls that simply do not exist yet, and a facilitator who has to pick between “1, Initial” and nothing will pick 1. Over a hundred questions, that inflates a program’s score by half a point or more and makes the gaps harder to see. Zero is a legitimate score, and we use it.
Why quarter steps
Whole-number scoring forces false precision in the other direction. A practice that is documented but only half rolled out is not a 3, and it is not a 2. Quarter steps let a facilitator record “defined, not yet communicated” as a 2.75 and move on. Category scores then average to something meaningful.
Why every question comes with help text
A scale is only useful if two people scoring the same evidence land in the same place. The level descriptions above are shared by every question, so a 3 means the same thing for exercising as it does for backup verification. What changes from question to question is the evidence. Every question in ResiliencyPulse carries help text and a list of supporting artifacts drawn from the control it measures, so the person scoring knows what to look for before choosing a level. That is what makes scores comparable across facilitators, across years, and, in the benchmark pool, across organizations.
Where programs usually start
Most programs we assess are not broken. They are scattered. Across a decade of Bryghtpath’s Resiliency Diagnosis® work, most organizations start between 1.5 and 2.5. Programs that commit to a structure typically reach 2.5 to 3.5 within about two years, and sustain 3.5 to 4.5 once measurement and integration become routine.
If you want to know where yours sits, the self-check gives an indicative score in about four minutes.