The five levels of data maturity, and how to score yourself

The five levels, described honestly

1 — Ad hoc

It works because of particular people. One analyst knows where everything is and how the month-end pack is built. Nothing is written down; if they leave, six weeks disappear. Reports are correct roughly as often as that person is available.

This is not incompetence. It is the natural state of an organisation that grew faster than its processes, and most businesses between 50 and 200 people are here.

2 — Repeatable

The same thing tends to happen twice. There are conventions, some of them shared, and the important reports are rebuilt the same way each month. It still depends on individuals, but on their habits rather than their improvisation. A new starter can be shown how, verbally.

3 — Defined

It is written down and people follow it. There is a register with owners, a classification scheme, procedures for the events that cause damage, and a responsibility matrix. A new starter can be handed a document. When someone leaves, the work continues.

This is the target. It is where the failure mode "the person who knew left" stops happening, and it is achievable in months rather than years.

4 — Managed

The process is measured and the measurements change behaviour. Quality is monitored against thresholds, coverage is tracked, breaches trigger something. The distinction from level 3 is not the existence of a dashboard — it is whether anyone acts on it.

5 — Optimised

Deliberate, continuous improvement, with changes tested rather than assumed. Genuinely rare, and it needs staff whose actual job this is. If a self-assessment puts you at 5, the self-assessment is wrong.

Why aiming for 5 is a mistake

Each level costs more than the last and returns less. The move from 1 to 3 removes the failure mode that actually hurts a mid-market business: dependence on individuals. The move from 3 to 4 buys earlier warning of quality problems, which is worth having. The move from 4 to 5 requires a dedicated function, and for a company of 300 people that function is two salaries that would return more elsewhere.

Say the target out loud when you start. "We are aiming for level 3 and staying there" is a defensible position that saves a great deal of drift, and it protects the programme from the reasonable objection that this could go on for ever.

Scoring yourself in an hour

Assess five areas separately rather than producing one blended number. A composite hides the one that is about to hurt you.

Score each 1 to 5. Take the lowest as your headline rather than the mean, because the lowest is where the next failure comes from. Do it with three people in a room, separately, then compare — the disagreements are more informative than the scores.

The rule that makes a score worth having

It has to be able to fall.

A maturity score that only ever rises is a marketing artefact, and everyone watching it works that out within two months, at which point it stops being read. Build it from measures that respond to reality: the share of datasets with a named owner, the share classified, the share of procedures approved and in date, the share of owners who have completed their training.

When a steward leaves and their datasets lose their owner, the number should drop. When a procedure passes its review date, the number should drop. Those drops are the entire value — they are the early warning that the thing has stopped being maintained, arriving before the wrong number does rather than after.

Reporting it upwards without theatre

A board wants three things: where are we, where are we going, and what happens if we do nothing. One page. The composite, the five areas underneath it, the trend over the last few months, and the two specific items that moved.

Include the drops explicitly. A report that shows a fall, names the cause and says what is being done about it buys considerably more credibility than one that has only ever gone up — and it makes the next request for time and budget an easier conversation.