Two organisations run the same capability maturity assessment in the same year and get near-identical scores.
Five years later, Company A is measurably better at the things its strategy needs it to be good at. Its capability investments went where they mattered, some investments deliberately didn't happen at all, and each annual planning round started from what the previous one had learned.
Company B is commissioning its third assessment, from its third consultancy. Each heat map was presented, discussed, and filed. The new one looks remarkably like the first, because in between, nothing changed except the consultants.
Same starting scores. Opposite trajectories. And nothing on either heat map predicted which organisation would be which.
That's because every maturity model in every sector asks some version of the same question: how mature is this capability? Scored one to five, ad hoc to optimised, the maturity question is always aimed at the capability. The question that actually separated those two organisations sits one level up, and no model asks it:
How mature is the process that decides how mature your capabilities need to be?
Apply the scale to itself
A maturity level, properly understood, measures how institutionalised an operation is: how repeatable, instrumented, and embedded, from improvised effort at the bottom of the scale to measured, continuously improving operation at the top. And a level claim only counts when performance backs it. A capability isn't Level 4 because the system is installed and the staff are trained; it's Level 4 when the outcomes it exists to produce have measurably improved.
Nothing stops you from pointing that scale, and that standard, at the operation that produces your maturity targets.
Company A's deciding process is institutionalised, and you can see it in three habits.
Its target levels come from strategy. For every capability being invested in, someone can name the strategic choice that requires it to reach that level; nothing is aimed at Level 4 just because the scale goes higher. (The instrument for deriving targets this way is the Strategic Choice Cascade.)
Its maturity claims meet the standard above. Levels are claimed on outcomes that moved, never on systems installed and training completed, so the scores on Company A's heat map mean what they say.
And the picture gets redrawn on a schedule, by a named owner, and each redraw produces decisions someone can point to afterward. Push this capability harder. Leave that one alone, on purpose. Cancel this uplift, because the capability is already good enough for what the strategy asks of it.
Company B decided ad hoc. The assessment was commissioned once, presented once, and filed; the targets came from the model's ladder; no one owned a redraw. By its own scale, Company B is a Level 1 organisation, whatever its capability scores say.
And here's what the heat maps hide: Company A can be more mature than Company B even if half its capabilities sit at deliberately low levels. An organisation that holds a capability at Level 2 on purpose, with the reasoning on record, is displaying more organisational maturity than one that pushed the same capability to Level 4 because four is bigger than two. Maturity was never about the height of the bars. It's about whether anyone governs the relation between them.
One capability is the exception, and it's the one this whole argument is about. The deciding process is itself a capability: people, process, technology, and information, scoreable like any other. And it's the only one whose target can never be deliberately low. Every other capability's required maturity depends on which strategy you chose; this one's comes from having a strategy at all, because it's the mechanism that sets every other target. Hold a capability at Level 2 on purpose and you've made a choice. Let the deciding process sit at Level 1 and you've lost the machinery for making choices, which is exactly where Company B lives.
How high its target needs to sit is priced by your operating environment. An organisation with stable demand, few competitors, and slow-moving stakeholders can run a light deciding process and honestly call it enough: the picture rarely changes, so the machinery that redraws it can idle. Most organisations don't live there anymore. Under the three forces reshaping operating reality (markets moving faster than planning cycles, complexity outgrowing the org chart, purpose priced into talent, capital, and trust), the picture is invalidated continuously, and the deciding capability stops being back-office machinery. It becomes the difference between adapting with coherence and improvising.
That, stated plainly, is what business architecture is for. Not diagrams for their own sake: the discipline that matures the deciding capability, with the Design4 framework as its practice.
This is what the third dimension of capability assessment, adaptability, was always reaching toward. Per capability, adaptability measures how readily an operation can change. Across the whole map, it measures the thing that matters more: whether the arrangement itself, targets included, can be redrawn as conditions change. An organisation that treats assessment as a one-time exercise resets to zero at each cycle boundary. An organisation that redraws each cycle compounds, because today's leading practice is tomorrow's baseline.
The AI transition is grading exactly this
By mid-2026, the most widely reported estimate had 95% of enterprise AI pilots delivering no measurable return, a figure from MIT's much-cited State of AI in Business research. Treat that headline number with suspicion; its methodology has been contested, and it won't survive as a precise figure. But the pattern beneath it is better evidenced and harder to dismiss: organisations stuck in perpetual experimentation, for reasons of data quality, governance, and operating-model readiness.
Read that list with the deciding process in mind. Nobody derived which capabilities must be mature enough to absorb AI. Nobody validated the pilots against outcomes. Nobody redrew anything.
The field's response is telling: the SEI and Accenture published a research-validated AI adoption maturity model in June 2026, aimed at exactly this failure. It's a good ladder. And it still can't answer the deciding question, because no model can know which of your capabilities AI has to flow through. That's a strategy question, answerable only from your own where-to-play and how-to-win choices, and it separates two futures. Organisations that know where AI has to land, and which experiments belong in deliberately loose, protected spaces, will convert the investment. Organisations pointing every capability at a higher level will run pilots indefinitely, and the pilots will be indistinguishable from progress.
The wave after AI will grade the same coursework.
What to do with the question
You don't need a new model to act on this; you need four working parts, and you can check for them in an afternoon.
Derivation: can anyone name the strategic choice that sets each capability's target level? Validation: does performance evidence, not deployment evidence, stand behind the levels you claim? Decision records: did the last assessment change an investment decision that someone can point to? A redraw rhythm: does the picture have a named owner and a standing slot in the planning cycle, so the next redraw is a calendar event rather than a crisis?
Miss most of those and your capability scores are outputs of an ad hoc process, which means the scores themselves are the least reliable thing in the room. The capability maturity pillar covers the full discipline: how targets get derived, what a deliberately uneven maturity profile looks like, and how the Design4 framework's governance cycle keeps it current.
Maturity's real product was never the level. It's the durable capacity to keep converting whatever arrives next, and that capacity lives in exactly one place: the process that decides. Score that one first.