What are the IGRM maturity levels and how do you assess them?

A quick note on terms. The IGRM (Information Governance Reference Model) is a visual framework that shows how legal, records, IT, privacy, security, and business stakeholders share responsibility for information across its lifecycle. It is a coordination model, not a scoring system. The “maturity levels” people ask about usually come from a companion idea: a maturity model that rates how developed an organization’s governance practices are. The two are often used together, so this answer covers both.

What the maturity levels describe

Most information governance maturity models use a tiered scale, frequently five levels that progress roughly like this:

• Sub-standard / minimal — Practices are absent or ad hoc. Information is managed inconsistently and reactively, often only when a problem forces it.
• In development — Some policies exist but are incomplete or unevenly applied across departments.
• Essential — Baseline requirements are met. Policies, retention schedules, and accountability are defined and generally followed.
• Proactive — Governance is integrated into routine operations, monitored, and improved over time.
• Transformational — Governance is embedded in culture and strategy, continuously measured, and treated as a source of value and risk reduction.

These levels are typically mapped against principles such as accountability, transparency, integrity, protection, compliance, availability, retention, and disposition.

How to assess maturity

Assessment is a structured self-evaluation rather than a single test. A practical approach:

1. Choose a framework and define the principles you will score against.
2. Gather evidence — review policies, retention schedules, system inventories, audit logs, and interview stakeholders across legal, IT, records, privacy, and the business.
3. Score each principle against the level definitions, using the same criteria consistently.
4. Identify gaps between current and target maturity.
5. Build a roadmap with prioritized, measurable improvements, then reassess periodically to track progress.

The goal is not a perfect score but a shared, honest picture of where information risk lives and where coordinated effort will pay off.

To explore related concepts, see the information governance topic hub.

International records standards such as ISO 15489 offer complementary guidance on the underlying recordkeeping practices these models evaluate.