1 Introduction

The shipping industry serves as the backbone of international trade and the global economy, but it also poses risks to human life, the marine environment, and the global atmosphere (Schröder-Hinrichs et al. 2020). Therefore, there is a need to procure the benefits and manage the risks of this transportation mode, where authorities hold specific responsibilities focused on preventing maritime accidents, minimizing their potential consequences, and ensuring the sustainability of this industry (IMO 2023). Although many of these associated tasks are already well established, several factors can introduce uncertainties and jeopardize their successful execution. Some of these factors can be attributed to the internal context of maritime administrations, such as a lack of leadership, resources, or commitment, while others are linked to its external context, including the increasing number of sub-standard vessels, illegal dumping, and cyberattacks, among others. To effectively address this complex array of responsibilities, maritime authorities need to be aware of and understand the risks stemming from both their internal and external contexts (Laine et al. 2021).

A substantial number of studies have indicated that systematic risk management strongly supports the work of maritime authorities (Goerlandt and Montewka 2015; Parviainen et al. 2021; Montewka et al. 2014). To this end, various risk management frameworks, processes, and tools have been introduced in academic literature and professional contexts (Kulkarni et al. 2020; Lim et al. 2018; Li et al. 2012). However, the current selection of available risk assessment tools does not include risk maturity models, despite calls for such applications (Laine et al. 2022; IALA 2023). These models have proven useful in evaluating and developing the risk management performance of organizations across different industrial sectors (Maier et al. 2011), transport modes (ERA 2018; EASA 2017), and governmental bodies (Cienfuegos Spikin 2013). In the maritime sector, such models could also support compliance with international regulations on aids to navigation, goal-based standards, and national contingency planning (Laine et al. 2022). Consequently, there is a need to address the risk maturity models from a maritime perspective and close this identified gap in risk assessment tools for competent authorities and the academic fields of risk research.

To take the first step for providing a risk maturity model for the maritime authorities, an extensive background literature review was conducted to explore recent developments in this field (Laine et al. 2022). The results of this review laid basis for the new model development, which was made in close collaboration with the competent authorities and risk management experts through a process based on the Delphi methodology. Following its results, this article introduces a new risk maturity model called the R-Mare that is founded on the matrix technique. This matrix incorporates 17 risk management attributes, a five-step risk maturity scale, and associated risk maturity grid descriptions. By using this matrix, maritime authorities can evaluate their current risk management performance, identify areas for improvement, and develop a plan for achieving a higher level in risk management maturity. Even though the R-Mare matrix has been primarily developed for the maritime authorities of Finland, its approach could also be considered in other coastal and flag states. The here presented risk maturity model thus provides an important step forward in this field, while setting the basis for further development.

The remainder of this paper is organized as follows. Section 2 presents the theoretical background of the proposed risk management maturity model. Section 3 outlines the Delphi-based process used to develop the model. Section 4 presents the resulting R-Mare matrix model, while Section 5 discusses its strengths and anticipated challenges and points to opportunities for future research. Finally, Section 6 provides overall conclusions of this work.

2 Background

2.1 Risk maturity models

Risk maturity models are conceptual models that an organization can use to evaluate and improve its ability to manage risks (Hoseini et al. 2021; Perrenoud, 2018; Becker et al. 2009). These models have proven to be useful to evaluate organization’s current level of maturity, identify realistic targets for improvement, and produce action plans for developing or enhancing its risk capacity (Hilsson 1997). The specific criteria and levels of risk maturity can vary depending on the model and the type of organization (Cienfuegos Spikin 2013). In addition, the techniques that these models are built upon can range from simple to complex.

While many of the risk maturity models introduced in the academic literature are based on different types of approaches and specific end-user requirements, some best practices can be identified from the recent works to support the model development. Firstly, according to Cienfuegos Spikin (2013), a risk maturity model should be built on a sound scientific basis. This statement may seem self-evident, but in many of the recent models, the scientific criteria have not been fully considered (ibid). Second, Hoseini et al. (2021) have highlighted that the risk maturity model should be founded on an appropriate technique that aligns with its purpose, objectives, and end-user requirements. In other words, there are no one-size-fits-all solutions in this field. Third, Maier et al. (2011) have stated that the model’s risk management attributes, risk maturity levels, and risk maturity grid descriptions should be meaningful and tailored for its end-users. This requirement applies especially to models based on qualitative techniques, such as attributes-maturity level matrices. For a comprehensive review on the risk maturity models, the reader is referred to Laine et al. (2022).

2.2 Delphi methodology

The Delphi methodology is a research approach based on developing consensus among a group of experts through a series of questionnaires and controlled feedback (Whiting et al. 2003). This methodology is established on the principle of anonymity and the assumption that group judgments are more valid than individual ones (Dalkey 1972). The Delphi-based process typically involves several steps, including planning and question generation, panelist nomination, administration of interview and questionnaire rounds, and establishment of consensus criteria.

The Delphi methodology is commonly applied in fields such as healthcare and futurology to gather expert and stakeholder input for decision-making, policy development, and strategic planning (Keeney et al. 2011). The field of its application includes also risk maturity models (Monda and Giorgino 2013) and maritime risk research (Lahtinen et al. 2020; Duru et al. 2012; Szwed 2011). Based on the authors’ literature review, the Delphi methodology is also strongly applicable to the development process of a risk maturity model for maritime authorities (Laine et al. 2022).

2.3 ISO 31000 standard on risk management

The ISO 31000 is the international standard for organizational risk management. This standard has been developed by the International Organization for Standardization to provide principles, framework, and process to manage risks within the internal and external context of organizations (ISO 2018). These three key components of the ISO standard are based on best practices and have been developed through extensive consultations and expert input. Moreover, the standard offers flexibility to take into account specific organizational needs.

Even though several authors have critically examined the ISO 31000 standard as a whole (Aven et al. 2019; Leitch 2010; Purdy 2010), it has been widely utilized in various research and industrial sectors. The application area of the standard also includes risk maturity models (Proença et al. 2017), maritime risk research (Parviainen et al. 2021; Nevess et al. 2015), and risk management guidelines of maritime administrations (Helcom 2018; IALA 2022). Therefore, it can be argued that the ISO standard is appropriate for benchmarking when developing a risk maturity model for maritime authorities.

2.4 Formal Safety Assessment

Formal Safety Assessment (FSA) is a risk assessment methodology developed by the IMO. This methodology has been described as “[…] a rational and systematic process for assessing the risks associated with shipping activity and for evaluating the costs and benefits of IMO’s options for reducing these risks (IMO 2018).” The key element of FSA is a five-step risk assessment process that includes (i) hazard identification, (ii) risk assessment, (iii) risk control options, (iv) cost-benefit assessment, and (v) decision-making recommendations. To support the implementation of this process, the FSA also provides risk terminology, risk assessment tools, decision-making principles, and other useful elements.

The FSA methodology has faced a criticism especially in academic contexts concerning its narrow risk perspective, lack of transparency, and use of expert judgements, to name a few (Montewka et al. 2014; Kontovas and Psaraftis 2009). Nevertheless, it has been used in various maritime research applications and activities of maritime administrations, port authorities, and their stakeholders (Vidmar and Perkovič 2018; Zhang et al. 2013; Vantikos and Psaraftis 2004). In addition, the methodology shares many similar elements and process descriptions with current risk maturity models and the ISO 31000 standard, such as hazard identification and risk assessment. Therefore, it can be argued that the FSA methodology is also appropriate for benchmarking purposes in the development of risk maturity models.

3 Methods and material

3.1 Overview of the study process

The basic design of the development process for the risk maturity model for maritime authorities is derived from recent studies in this field and risk management guidelines. First, the study by Maier et al. (2011) was applied to support the specification of the purpose, objectives, end-users, and success criteria of the model, as it provides thorough guidance in this regard. Second, the review of Laine et al. (2022) was used to specify the methodology for the development process of the risk maturity model and the technique to be employed in the model itself. Third, the results of this same review were also utilized to determine the initial number of risk maturity levels and risk management attributes for the model and to identify best practices for describing the model’s risk maturity grids. Finally, both the ISO 31000 standard and the IMO FSA guidelines were used as benchmarks to support the definition of the risk management attributes for the model. Table 1 provides a summary of the design specifications, end-user needs, and development basis for creating this so-called R-Mare matrix model.

Table 1 The summary on the design specifications for the R-Mare matrix model
Full size table

The standard Delphi methodology process used for creating the R-Mare matrix model is illustrated in Fig. 1. This process involved four steps: (1) Delphi study preparations, (2) Delphi panelist selection, (3) Delphi survey, and (4) Delphi questionnaire. The aim of the Delphi survey step was to support the construction of the R-Mare matrix, while the questionnaire step focused on evaluating the importance of its risk management attributes. Both steps also considered consensus criteria in line with the principles of Delphi methodology. The content of this four-step process is described in Sections 3.2 to 3.4, and the summary of its results in Section 4.

Fig. 1
figure 1

Overview of the Delphi process for R-Mare matrix model development

Full size image

3.2 Preparations for Delphi study

The first step of the Delphi process of Fig. 1 (S-1) focused on the study preparations for the R-Mare matrix model development. To begin with, both the semi-structured interviews of Delphi survey rounds (S-3) and the multiple-choice questionnaires of Delphi questionnaire rounds (S-4) were prepared and tested. To support these preparations, the review results (Laine et al. 2022), as well as the ISO 31000 standard and the IMO FSA guidelines, were used for cross-checking and benchmarking.

Next, the preparations focused on defining the consensus criteria for the Delphi survey (S-3) and questionnaire rounds (S-4). For this purpose, the work of Keeney et al. (2011) was adopted, as it provides suitable criteria for the associated semi-structured interviews and multiple-choice questionnaires. These criteria are as follows:

  1. 1.

    Semi-structured interviews: greater than 80 percent agreement among the Delphi panelists;

  2. 2.

    Multiple-choice questionnaires: interquartile range is equal or less than one (IQR ≤ 1) among the Delphi panelist, when rated on a 5-point sematic differential scale.

The output of this first step thus provided a methodologically solid plan for executing the interview and questionnaire rounds of this Delphi-based study for the R-Mare matrix model development, including the associated consensus criteria.

3.3 Selection of Delphi panelists

The second step of the Delphi process of Fig. 1 (S-2) considered the selection of panelists to ensure sufficient resources for the R-Mare matrix model development. By utilizing the professional networks of the authors, 11 experts were chosen to the Delphi panel in line with the academic state of the art (Keeney et al. 2011).

Table 2 presents a list of the chosen Delhi panelists, along with a summary of their relevant expertise and distribution between organizations. To describe their roles briefly, both maritime safety and response authorities represented potential end-users of the model, providing essential insights for its development, particularly from a practical perspective. On the other hand, the contribution of academics was also considered necessary to ensure that the model meets scientific criteria related to maritime risk management. Further, the input of an aviation safety authority expert was extremely valuable, as it offered best practices and new ideas from this industrial sector to complete the model development.

Table 2 Summary of Delphi panelists
Full size table

The output of this second step therefore established a Delphi panel comprising professional experts, which was a key element in successfully implementing the R-Mare matrix model development process.

3.4 Delphi survey

The aim of the third step of this Delphi process of Fig. 1 (S-3) was twofold: (i) to create the R-Mare matrix model and (ii) to achieve a target level of consensus (> 80%) on its elements among the 11 Delphi panelists. This step took place from December 2022 to February 2023 and involved two rounds of Delphi surveys conducted through online semi-structured interviews.

The first Delphi survey round focused on defining the risk maturity levels and risk management attributes of the R-Mare matrix, whereas the second considered its risk maturity grid descriptions and consensus criteria. The results of these survey rounds yielded five risk maturity levels, 17 risk management attributes, and 85 risk maturity grid descriptions, specifically tailored for the self-evaluation of the maritime authorities. The results also indicated that 9 out of 11 panelists (82%) were satisfied with these model elements or had only minor additional suggestions. The feedback from the two panelists with more critical views was also carefully considered to enhance the level of consensus.

The output of this third step thus provided the final version of the R-Mare matrix model with an acceptable level of consensus on its elements among the Delphi panelists. These results are described in detail in Section 4.

3.5 Delphi questionnaire

The aim of the fourth step of this Delphi process of Fig. 1 (S-4) was also twofold: (i) to evaluate the importance of 17 risk management attributes within the R-Mare matrix model and (ii) to achieve a target consensus level (IQR ≤ 1) on these evaluations among the 11 Delphi panelists. This step took place from March 2023 to April 2023 and involved two rounds of Delphi questionnaires conducted with the panelists. These rounds were performed using online multiple-choice questionnaires that comprised a 5-point ranking scale for each of the attributes (1 = Not important, 2 = Slightly important, 3 = Moderately important, 4 = Important, and 5 = Extremely important).

The results of these questionnaire rounds indicated that all 17 attributes of the R-Mare matrix were considered either Important (4) or Extremely important (5) by the panelists. The consensus criteria were achieved for 14 of the attributes, while three attributes had an IQR value exceeding the established limit. Nevertheless, after these two questionnaire rounds, it was determined to conclude the study in accordance with the general practices of the Delphi methodology (Keeney et al. 2011).

The output of this fourth step confirmed the usefulness of the R-Mare matrix model and provided an evaluation of importance to its risk management attributes and an analysis of the associated level of consensus. These results are described in Section 4.5 and Table 5.

3.6 Reliability and validity of Delphi study

This section briefly addresses the critical aspects of reliability and validity in utilizing the Delphi process for designing the R-Mare matrix model. In general, reliability focuses on the consistency and stability of the “measuring instrument,” while validity concerns the accuracy of measuring what was intended to be measured in the analysis (Aven and Heide 2009). Both of these aspects are of paramount importance in ensuring the overall quality of the model.

The reliability in the context of Delphi methodology refers to the consistency and stability of the results obtained through multiple rounds of expert input and feedback (Landeta 2006). To address the consistency aspect, the presented Delphi process for the R-Mare matrix model incorporates detailed design specifications (Section 3.1), comprehensive study preparations (Section 3.2), and the selection of an appropriate number of expert panelists (Section 3.3). As for the stability criteria, the process integrates state-of-the-art consensus criteria for both the survey (Section 3.4) and questionnaire (Section 3.5) rounds.

The validity in the context of the Delphi methodology refers to the accuracy and truthfulness of the results in reflecting the knowledge and judgments of the expert panel (Landeta 2006). One well-recognized concept in the field of risk validation is face validity and its associated tests (Sadeghi and Goerlandt 2023). These tests involve a peer review process where experts assess whether the model appears reasonable to them (Collier and Lambert 2019; Sargent 2013). When considering the presented Delphi process for the design of the R-Mare matrix model from the perspective of face validity, several key observations can be made.

First, the Delphi methodology employed in this work provides a systematic and well-documented approach, which is advantageous from a validity perspective as it serves as a form of quality assurance (Goerlandt et al. 2017). Several authors have also demonstrated the Delphi method’s capability to provide evidence of validity (Alarabiat and Ramos 2019; Landeta, 2006) and its effectiveness in conducting both qualitative and quantitative studies (Hsu and Sandford 2007; Skulmoski et al. 2007).

Second, the Delphi panel assembled in this work comprises 11 members, involving both model end-users and risk management experts (Section 3.3). The number of panelists aligns with current best practices. Moreover, specific attention has been paid to ensure that these panelists possess comprehensive knowledge and the necessary competence to provide input for the model design, cross-check its elements, and guarantee the meaningfulness of the output.

Third, the Delphi process implemented in this work encompasses four distinct rounds with associated consensus criteria (Sections 3.4 and 3.5). These rounds are used to increase intersubjective agreement among the panelists and ensure the attainment of an acceptable level of consensus. In other words, their objective is to establish this model as a shared mental framework among the panelists.

Consequently, the presented Delphi process for the R-Mare matrix model design can be considered reliable and valid from the methodological perspective. The subsequent section elaborates on the outcomes of this process.

4 Results

4.1 Overview of the R-Mare matrix model

The results of the Delphi process provided the R-Mare matrix risk maturity model for maritime authorities. Figure 2 shows the basic idea of this model.

Fig. 2
figure 2

Overview of the R-Mare matrix risk maturity model

Full size image

The Y-axis of the R-Mare matrix addresses the scope dimension of the model, elaborated through 17 risk management attributes. These attributes consider ethics and integrity (1), leadership and commitment (2), basic risk management requirements (3–5), parallel activities (6–7), risk assessment (8–16), and decision-making (17). To support the self-evaluation of the maritime authorities, Section 4.2 and Table 3 provide a detailed list of these attributes and the aspects to be considered in their evaluation.

Table 3 Risk management attributes of the R-Mare matrix model
Full size table

The X-axis of the R-Mare matrix focuses on the progress dimension of the model. This involves five risk maturity levels namely Inadequate (1), Reactive (2), Compliant (3), Proactive (4), and Optimal (5). Section 4.3 and Table 4 provide a detailed description for each level. Their overall aim is to support the self-evaluation of the maritime authorities concerning the maturity of the organizational practices with respect to the 17 risk management attributes.

Table 4 Risk maturity levels of the R-Mare matrix model
Full size table

Each cell of the R-Mare matrix model is further populated with a specific textual grid description to characterize traits of performance at each level and attribute (L1/A1–L5/A17). To complete the support for self-evaluation of maritime authorities, Section 4.4 and Table 6 (Appendix) provide general criteria and two practice-oriented examples for all 85 risk maturity grids of the model. By using the associated 5-point score system, the authorities can also quantify, visualize, and further analyze the results of their self-evaluation as needed.

4.2 Risk management attributes

This section focuses on the 17 risk management attributes of the R-Mare matrix model. That is the Y-axis of the model as shown in Fig. 2. Based on the results of Delphi survey rounds described in Section 3.4, Table 3 provides a list of the selected attributes and the key aspects to be considered in their context.

4.3 Risk management maturity levels

This section describes the five risk maturity levels of the R-Mare matrix model. That is the X-axis of the model as illustrated in Fig. 2. The definition of the levels is shown in Table 4, which is based on the results of the Delphi survey rounds, see Section 3.4.

4.4 Risk management maturity grids

The R-Mare model also contains textual grid description focusing on the cells of this matrix-based approach, as illustrated Fig. 2. The general criteria and examples included in these descriptions are based on the results of the Delphi survey rounds described in Section 3.4. Table 6 (Appendix) presents the results of this part.

4.5 Evaluation of the risk management attributes

The risk management attributes of the R-Mare matrix model were evaluated in the Delphi questionnaire rounds in terms of their importance for maritime administrations. This task was conducted using a 5-point ranking scale, as described in Section 3.5.

Table 5 indicates the views of the 11 Delphi panelists from this perspective. Based on the median value of the ranking results, all 17 risk management attributes of the model were considered either 4 = Important (59%) or 5 = Extremely important (41%) in the work of maritime administrations. These questionnaire rounds also involved an analysis of these rankings regarding the consensus criteria (IQR ≤ 1). As shown in the table, the established target level was not achieved for only three risk management attributes (nos. 6, 7, and 9).

Table 5 The risk management attributes of the R-Mare matrix model; summary of their background information and results of Delphi questionnaire rounds
Full size table

Table 5 further shows that all risk management attributes of the R-Mare matrix can be identified in previous studies, with some of them present in both the ISO 31000 standard and the IMO FSA guidelines. However, in these benchmarking references, the definitions of the corresponding attributes are either generic or specific to other domains, such as mining or healthcare. In other words, they are not applicable to maritime administrations as such.

5 Discussion

5.1 Scope and applicability of the R-Mare matrix model

To respond into identified needs of maritime authorities and contribute to the academic field of maritime risk management, this article has introduced a new risk maturity model called the R-Mare matrix. The value of this model can be described by highlighting the following topics.

Firstly, the R-Mare matrix model is established on a sound scientific basis that importance has been emphasizes by Cienfuegos Spikin (2013). The model was developed using the Delphi methodology, which has strong scientific credit and applicability for the development of risk maturity models (Monda and Giorgino 2013) and the implementation of maritime risk research (Lahtinen et al. 2020; Duru et al. 2012; Szwed 2011). Although the use of this methodology was time-consuming and taxing on the consulted experts, it proved to be an appropriate approach for this work. More specifically, the methodology enabled the identification of the requirements of maritime authorities for the model, the extraction of their relevant tacit knowledge, and the incorporation of best practices from the scientific risk field and the aviation industry into the model development process. The Delphi methodology also involves the principle of consensus, which was beneficial in making the R-Mare matrix model a shared mental model among the panelists.

Secondly, the R-Mare matrix model is based on an appropriate technique that considers the end-user requirements, as suggested by Hossein et al. (2021). The model builds on the attributes-maturity level matrix technique, which has been used in several research applications of this field and identified to be strongly applicable for self-evaluation (Laine et al. 2022). The panelists of the Delphi process also considered this technique rather easy to use and understand, while having a good potential to provide valuable risk-related information. To implement this technique in the activities of maritime authorities, the R-Mare matrix was populated with 17 risk management attributes, 5 risk maturity levels, 85 risk maturity grids, and associated definitions during the Delphi process.

Thirdly, the R-Mare matrix model is tailored to the operational context of maritime authorities in line with the proposals of Maier et al. (2011). Taking the advantages of the Delphi methodology, the contents of risk management attributes, risk maturity levels, and risk maturity grids of the matrix were contextualized to the work of maritime authorities and made useful and meaningful for them. The Delphi process survey rounds also indicated a high level of consensus concerning these elements, as over 80 percent of the panelists agreed with their content. In addition, the results of subsequent Delphi questionnaire rounds confirmed the importance of these risk management attributes with a high degree of consensus.

Given the above and the fact that the Delphi panelists considered the R-Mare matrix useful for supporting the evaluation and development of maritime authorities’ risk management performance and harmonizing current practices, it can be argued that the model has met its design objective.

5.2 Limitations of the R-Mare matrix model

Every model has its limitations, and so does the R-Mare matrix. This model does not consider the causal relations between its different risk management attributes and risk maturity levels. The output of this model is also based on the subjective judgments of evaluators, and its quality is highly dependent on their level of competence and available resources. In this respect, the proposed R-Mare matrix may have similar drawbacks to many other risk maturity models, as can be noted in the work of de Oliveira and Di Serio (2015). The R-Mare matrix model also has geographical limitations. The model was developed for the maritime authorities of Finland with local experts, which may limit its applicability to other coastal and flag states.

5.3 Future research

The proposed R-Mare matrix is the first risk maturity model developed for maritime authorities. To address the limitations of this model highlighted in Section 5.2, future research could be directed to examine linear and non-linear relationships between the different model elements or to extend its scope and context beyond the confines of the Finnish maritime administration.

In addition to these avenues of investigation, future research could address the quality aspects of the R-Mare matrix model, especially in terms of its practical utility and complexity. Although the presented Delphi process for this model development can be considered reliable and valid from the methodological perspective (Section 3.6), the model has not undergone explicit testing. Such testing endeavors could center around aspects like inter-rater reliability and test-retest reliability. While the former pertains to the extent of agreement among evaluators who assess the same model elements for a given maritime administration, the latter concerns the consistency of their assessments when measuring these elements on different occasions. These tests have the potential not only to provide valuable insights for improving the quality of the R-Mare matrix model but also to shed light on the necessary training, resource allocation, and organizational practices needed to ensure its effective application.

6 Conclusions

In conclusion, this study introduces a novel risk maturity model called the R-Mare matrix to support maritime authorities in developing their risk management performance. The objective of this model is to assist the authorities in evaluating their current risk management practices, identifying areas for improvement, and developing a plan for achieving a higher risk maturity level.

The development process of the R-Mare matrix model was carried out using the Delphi methodology, as it has a strong scientific credibility in delivering reliable and valid results. This systematic and documented process engaged a total of 11 expert panelists, aligning with the recent academic recommendations. As a result, the presented model incorporates 17 risk management attributes, a five-step risk maturity scale, and 85 detailed risk maturity grid descriptions. Through this process, these model elements were also customized to suit the professional context of maritime authorities, ensuring their utility, significance, and suitability for self-evaluation.

The proposed R-Mare matrix model provides a potential solution for addressing an identified gap in the academic maritime risk field, while responding to the practical needs of maritime authorities. To meet academic criteria, the model’s development was grounded in the state-of-the-art concepts and perspectives within the scientific risk field. To address the practical criteria, the model development emphasized strong end-user involvement and the attainment of a high level of consensus on its elements.

This study further discusses the strengths and weaknesses of the R-Mare matrix model and outlines potential directions for future research in this area of work. These discussions can be taken into account when testing and implementing the model within the organizational processes of Finnish maritime authorities or considering its application in other coastal and flag states. Overall, this novel model represents an important step forward in both academic and practical dimensions within this area.