All 35 requirements · Governance maturity measurement framework
Model requirement 5.3.2
Design
What ISO 37004:2023 asks at 5.3.2, in our own words, and how it reads inside a controlled group. The draft's public contents heading for it is 5.3 Measurement activities.
What the model asks
The design of the evaluation should follow from its intent, scope and objectives. It should identify: which organizational entities and structures fall within scope; which stakeholders are relevant, what role each plays, what they expect and how good the relationship with them is; whether representatives will be used; how personal data will be protected in line with compliance obligations; how long the evaluation is expected to take, its deadlines and what must be reported; which human factors could influence it and how strongly; and how technology will be used. The design should state who carries out the evaluation (the body itself, a facilitator, the organization's own staff, or an independent outside provider) and should consider independent assurance, whether responses are anonymous, whether consensus is reached in workshops or responses are individual, and regulatory requirements, including those that deal with differing opinions.
What it means when one board controls another
The design is where the group decides whether it is evaluating one group or many entities. Fix the scope in entities and dimensions, the period, the raters and the aggregation method in advance, and record which entity boards were consulted in the design rather than after the ratings.
Evidence an evaluator asks for
A maturity rating is a claim about how the group governs. The evidence is what proves it operated. Keep both, and keep them together.
- Evaluation design: Documented evaluation design covering scope, stakeholders, evaluators, data protection, timing and method
Where evaluations commonly find gaps
- Evaluator independence undecided
- Personal data of respondents unprotected
How this requirement enters the rating
This unit is one of the five measurement activities. Treat it as a programme step with its own artefact and its own owner, and record the artefact in the evaluation file. The activity page carries what to keep.
It carries 1 evidence item and 2 common gaps in the model. One item is enough only if it is the artefact that proves the practice operated, not a policy that says it should. Both gaps are seen often enough in first evaluations that the evaluation design should test for them explicitly. The group application on this page is ours; the requirement and evidence are the model's, stated in our own words.
Requirements that sit beside it
Source for this page
- ISO 37004:2023, Governance of organizations, Governance maturity model, Guidance. The published text of the organizational governance maturity model, which the draft applies to controlled groups. Supplies the three aspects, the measurement framework, the six-point scale, the dimensions and the 35 model requirements stated on this site.
- ISO/DIS 37014 official record. The designation, title, edition, committee, ICS, stage, stage date, page count, price and abstract. Retrieved 21 October 2026.
- ISO/DIS 37014 free OBP preview. The foreword, introduction, scope, normative references, terms and definitions and the full table of contents, which ISO publishes for free. Retrieved 21 October 2026.
Retrieved 2026-10-21. The requirement above is our statement of the clause in our own words; the official text is linked so you can check it.
Note on the draft: The requirement, evidence and gaps on this page are read from ISO 37004:2023, which the draft states it builds on. The draft's own clause body is not public, so this page does not state it. The clause reference at the top is the draft's public contents heading that this requirement sits under.
The maturity kit, USD 299 one off. The 35-requirement register, the 54-cell maturity worksheet, the evidence list and a dated plan, as PDF, CSV and XLSX.