Change Governance Maturity Assessment: 7-Step Framework

Last Updated: October 26, 2026

Quick Summary

A maturity assessment framework for change governance scores how consistently your organisation requests, reviews, approves, tests and records changes. It rates five dimensions (governance, people, process, data and technology) against five maturity levels, using evidence rather than opinion. Scores then point to the gaps worth closing first.

• Score each of the five dimensions separately, so a strong area cannot hide a weak one.

• Maturity runs from Level 1 Initial, with changes handled by email and memory, to Level 5 Optimised, with continuous improvement.

• Every score needs evidence, such as approval logs, test records and a sample of recent change records.

• Agree sub-criteria with the process owner and mark non-applicable items N/A rather than zero.

• Run the first assessment on one business unit to test the method before rolling it out.

What a Change Governance Maturity Assessment Measures

A change governance maturity assessment framework tells you how well your organisation controls change today. It scores how changes are requested, reviewed, approved, tested and recorded.

Most organisations already have some change process. The question is whether that process is consistent, owned and provable. A maturity assessment answers it with evidence rather than opinion. See how a governed operational change platform runs these controls in practice.

Change management versus change governance

Change management is the work of moving a change from idea to working reality. Change governance is the layer above it. It sets the rules for who can approve what, which evidence must exist, and how decisions are recorded.

A team can run excellent change management and still have weak governance. Each project may succeed while no one can show who signed off the risk.

Change Management Maturity Levels Explained

Maturity levels describe how far an organisation has moved from ad hoc change to controlled, measured change (People Capability Maturity Model). Most models use five stages.

• Level 1, Initial: Changes happen through email, verbal agreement and memory.

• Level 2, Repeatable: A basic process exists, but teams apply it differently.

• Level 3, Defined: One documented process applies across the organisation.

Be honest when you place yourself. That is a useful starting point, not a failure.

Core Dimensions to Assess: Governance, People, Process, Data and Technology

A useful assessment looks at five dimensions. Each one can be scored separately, so the gaps are easy to see. The difference between a generic maturity model and a change governance maturity assessment framework is that each dimension must be broken down into change-governance-specific criteria with observable evidence.

1. Governance: Who owns decisions, and do they have clear authority? Sub-criteria to score: decision rights are documented per change category (standard, normal, emergency); a named accountable owner exists for each category; a change advisory forum meets on a fixed cadence with quorum rules; emergency changes have a defined retrospective approval route; segregation of duties prevents the raiser from also approving. Evidence: terms of reference, decision-rights matrix, forum minutes, emergency change log.

2. People: Do staff know their roles, and are they trained to follow the process? Sub-criteria: role descriptions for change raisers, approvers and implementers are current; training is completed and recorded before someone can approve; competency is reassessed on a defined cycle; cover arrangements exist for absence. Evidence: training register, role descriptions, competency sign-off records.

3. Process: Are steps defined, repeatable and followed in practice? Sub-criteria: a single documented process covers all change types; risk assessment is proportionate to change impact; testing and back-out plans are mandatory before approval; post-implementation review is scheduled and completed. Evidence: process document with version control, sampled change records showing each step, post-implementation review reports.

4. Data: Is the change record complete, accurate and easy to find? Sub-criteria: every change has a unique identifier; the record captures requester, approver, risk rating, test evidence and outcome; records are retained for a defined period; data quality is checked on a sample basis. Evidence: change register export, data-quality sample results, retention policy.

5. Technology: Do tools support the process, or do they get in the way? Sub-criteria: the tool enforces the workflow rather than allowing bypass; approvals are captured in the tool, not by email; the tool produces an audit trail; integration with the configuration management database is in place. Evidence: tool configuration screenshot, audit-trail export, integration specification.

Score each dimension on its own. An organisation may have strong technology and weak governance. Scoring them together hides that problem.

Book Demo →

Pro Tip Before scoring, agree the sub-criteria with the process owner. If a sub-criterion is not applicable, for example, a single-site organisation may not need site-level cover arrangements, record it as not applicable rather than scoring it zero. This keeps the total comparable between business units.

Change-governance-specific dimensions competitors often miss

A change governance maturity assessment framework should also score the mechanisms that determine whether change is actually controlled across a portfolio, not just within a single project. Consider adding these as a second tier of scoring:

• Decision rights and escalation: Is there a documented route for a change that exceeds a defined risk or cost threshold, and is it used in practice? Evidence: escalation log, threshold definitions.

• Portfolio prioritisation: Are changes ranked against capacity and strategic priorities before approval, or does every request get approved on a first-come basis? Evidence: prioritisation criteria, portfolio review minutes.

• Change capacity and saturation: Is there a view of how much change each team can absorb in a period, and is it used to sequence releases? Evidence: capacity model, release calendar.

Step by Step: Running the Assessment

Run the assessment in a clear sequence. The steps below follow a practical seven-step approach.

1. Define the scope, including which sites, teams and change types are in view.

2. Gather the current process documents and recent change records.

3. Score each of the five dimensions against the maturity levels.

4. Collect evidence for each score, such as approval logs and test records.

5. Identify the top gaps and rank them by business risk.

6. Validate the results with stakeholders.

7. Agree an improvement plan and a date to reassess.

Keep the first run small. One business unit is enough to test the method before rolling it out.

Scoring rubric and evidence requirements

Every score needs evidence. A claim that "approvals are always done" is not enough. Ask for a sample of approval records from the last quarter.

A simple rubric helps. For example, a score of 3 might require a documented process, a named owner, and records for at least 80% of sampled changes. Set your thresholds before you start, so scores stay consistent between assessors.

Validating results with stakeholders

Scores that only the assessor agrees with will not drive change. Walk the results through with operations, IT and finance leads. Ask them whether the gaps match what they see daily.

Where they disagree, check the evidence together. Often the disagreement reveals a process that exists on paper but not in practice.

Change Management Assessment Template and Maturity Model Examples

A template keeps the assessment repeatable. The structure below is one way to make scores defensible and comparable between assessors and between assessment cycles.

Template structure

At minimum, the template should contain one row per sub-criterion, with these columns:

Many teams start with a spreadsheet. That works for a first pass. It becomes hard to maintain once several sites and business units are involved, because versions drift and evidence gets scattered across email threads. A central record solves that, but the column structure above should be agreed before any tool is chosen.

Maturity level descriptors with evidence requirements

A score is only repeatable if each level has a written descriptor and a defined evidence standard. The example below is for the governance sub-criterion "decision rights documented per change category". Use it as a pattern for the other sub-criteria.

Book Demo →

• Level 1, Initial: No documented decision rights. Approvals happen by email or verbally. Evidence standard: none expected; the absence is the finding.

• Level 2, Repeatable: Decision rights exist informally and vary by team. Evidence standard: at least one team can describe its approval route, but no document is produced.

• Level 3, Defined: A decision-rights matrix exists and covers standard, normal and emergency changes. Evidence standard: current version of the matrix, dated within the last 12 months, plus a sample of three change records showing the matrix was followed.

Set your evidence thresholds before you start, so scores stay consistent between assessors.

Worked scoring example

Suppose an assessor reviews the governance dimension for a single business unit. They find a decision-rights matrix dated eight months ago (meets the Level 3 evidence standard), but the quarterly compliance report has not been produced (fails the Level 4 standard). The score is 3, with a gap note: "No compliance measurement; introduce quarterly sample of ten changes." Confidence is high because the evidence was direct.

Watch Out Do not score a sub-criterion at Level 3 or above on the basis of a document alone. The evidence standard for defined and managed levels requires a sample of actual change records showing the document was followed. A process that exists on paper but not in practice is a Level 2 finding, not a Level 3 one.

Benchmarking and interpreting results by context

A single maturity target is not universal. A small organisation with one change category may reasonably sit at Level 3 on governance and still be well controlled, while a multi-site organisation with emergency change exposure should expect Level 4. When comparing results across sectors, organisation sizes or transformation types, compare like with like: score the same sub-criteria, use the same evidence thresholds, and record the context (number of sites, change volume, regulatory exposure) alongside the score.

Change Governance Best Practices for Building a Roadmap

The assessment is only useful if it leads to action. Turn the top gaps into a roadmap with clear owners and dates.

• Fix ownership first. Name one accountable person for each change category.

• Separate duties. The person who raises a change should not approve it.

• Keep evidence as you go. Record approvals and test results when they happen.

Watch out: a roadmap with twenty actions rarely finishes. Pick the three gaps with the highest business risk and start there.

Booking Your Change Governance Assessment With ChangeGate

We will show you how the scoring, evidence and approvals work in a live governed record.

Frequently Asked Questions

What are the different levels of change management?

Change management maturity is usually described across a small number of staged levels, often five. At the lowest level, change is handled ad hoc, with little documentation and approvals that depend on individuals. Middle levels introduce defined processes, a standard change log and clear approval routes. The highest levels use measured performance, continuous improvement and governance that runs consistently across business, operational and IT change. The exact labels vary between models, so the useful test is whether each level has observable criteria you can evidence during an assessment.

How do you assess change governance maturity?

Start by defining the dimensions you will score, such as governance roles, processes, people and culture, data and tooling. For each dimension, write criteria describing what each maturity level looks like, then collect evidence such as change records, approval logs, meeting minutes and training records. Score each dimension against the rubric, validate the scores with stakeholders from IT, operations and compliance, and compare results against your own targets rather than an external average. The output should be a prioritised list of capability gaps.

What should a change governance maturity framework measure?

A useful framework measures whether change is governed consistently across the organisation, not just whether a tool exists. Key areas include clear ownership and decision rights, segregation of duties so no one approves their own change, risk assessment before approval, evidence that changes deliver their intended benefits, and how well business, operational and IT change connect. Measures such as failed change rate, approval cycle time and percentage of changes with complete evidence give the scoring a factual basis.

What is the difference between change management and change governance?

Change management is the practice of planning and delivering individual changes and helping people adopt them. Change governance is the oversight layer that sets the rules: who can approve a change, what evidence is required, how risk is assessed and how the organisation confirms that change delivered its promised value. Maturity assessment checks the governance layer, so an organisation can run many change projects well yet still score low if the rules are inconsistent or unevidenced.

Book Demo

Add changegate.io as a preferred source on Google →