Resilience Maturity Without Maturity Theatre

Resilience maturity, honestly judged, means a firm can show, over time, that its important services are better understood, better tested, and better able to recover than they were before. Maturity theatre is the appearance of that progress without the substance: polished dashboards, high self assessed levels, and programme milestones that say nothing about whether users of a particular service would be served during a disruption.

A firm that claims an advanced maturity level while its most important payment service has never been tested end to end is performing maturity rather than possessing it. The test is not the level claimed, but the chain of evidence behind it: a service, a map, a tolerance, a scenario, and a change that followed.

Levels mislead because they compress very different services into a single score. A firm may be strong on governance documents and weak on recovery for one critical service, yet an average level hides that weakness behind strengths elsewhere. A board reading only the level will miss the service where users are most exposed.

Levels also invite gaming. Teams learn what evidence earns a higher level and produce that evidence, whether or not it improves recovery, while harder work that would improve recovery but does not change the level is deferred. The measurement then drives behaviour away from the service and towards the score.

Genuine progress looks like a service whose map has become more accurate, whose tolerance has been challenged and refined, whose scenarios have become more demanding, and whose recovery has been demonstrated rather than asserted. It also looks like weaknesses found earlier, fixed, and retested, with the record showing each step.

Progress of that kind is usually uneven. One service may advance quickly because its owner and suppliers are engaged, while another stalls because a dependency is hard to resolve. Honest reporting shows that unevenness, because it points effort at the service that needs it, rather than smoothing it away into a single reassuring level.

Honest reporting stays close to services. Instead of a single maturity score, a firm can report, service by service, what is understood, what has been tested, what was found, and what remains open. That format is less tidy than a dashboard, but it gives a reader something to challenge and a manager something to act on.

Reporting should also separate activity from outcome. Running a test is activity. Changing a recovery order because the test showed users would wait too long is an outcome. A maturity account that lists outcomes, with the services they concern, is harder to fake than one that lists activities, because outcomes can be checked against the service record.

A firm can avoid theatre by making its own assessments falsifiable. That means writing down, for each service, what would count as evidence of improvement and what would count as evidence of decline, and then letting test and incident results speak against those criteria, even when the results are unwelcome.

External challenge helps as well, whether from internal audit, a peer review, or a supervisor, provided the challenge is aimed at services rather than at programme documents. Challenge that asks only whether a framework is complete will produce framework completeness. Challenge that asks whether a service recovers will produce service recovery, or at least an honest account of why it does not yet.

Take any maturity claim and ask which service it refers to, what test supports it, and what changed because of that test. If the claim survives those questions for several services, it may describe real maturity. If it dissolves into programme language, it is theatre, however well presented.

This guide is educational and does not offer a maturity model for any firm. It offers a way to read maturity claims critically, by returning always to the service, its users, and its recovery evidence.