Which of the following is MOST useful for measuring the existing risk management process against a desired state?

A balanced scorecard measures performance across multiple perspectives (e.g., financial, customer) but is not specifically designed for assessing process maturity against an ideal state.

A risk management framework provides the structure and guidelines for risk management, but it serves as the standard or blueprint, not the tool for measuring process maturity itself.

A Capability Maturity Model (CMM) provides a structured approach to assess the maturity of an organization's processes, including risk management, against a set of predefined levels. It helps identify gaps between the current state and a desired, more mature state, guiding targeted improvements in the process.

Risk scenario analysis focuses on understanding potential risk events and their impact, not on assessing the maturity or effectiveness of the risk management process itself.