Consultation on proposed changes to the Risk Management Maturity Model (RM3)

Date published: 8 January 2019
Closing date: 31 January 2019

This consultation seeks views on the proposed changes to the Risk Management Maturity Model (RM3).

Since publishing the first edition of the Risk Managment Maturity Model (RM3) in 2011, ORR inspectors and safety practitioners in the rail industry have gained considerable experience of using the model to assess health and safety management systems and identify what needs to be done to continuously improve towards excellence in risk management.

The RM3 Governance Board has used this experience, and the outputs of an industry forum in 2016, to review and revise the model. We are consulting on this revision which we have called RM3 2019 and we welcome your views on these changes.

Responding to this consultation

Please submit your responses, in electronic form, to by 31 January 2019. You may find it useful to use the feedback form to structure your response to this consultation.

Publishing your response

We plan to publish all responses to this consultation on our website. This may include your personal data such as your name and job title.

Should you wish any information that you provide, including personal data, to be treated as confidential, please be aware that this may be subject to publication, or release to other parties or to disclosure, in accordance with the access to information regimes. These regimes are primarily the Freedom of Information Act 2000 (FOIA), the General Data Protection Regulation (GDPR,) the Data Protection Act 2018 (DPA) and the Environmental Information Regulations 2004.

Under the FOIA, there is a statutory code of practice with which public authorities must comply and which deals, amongst other things, with obligations of confidence. In view of this, if you are seeking confidentiality for information you are providing, please explain why. If we receive a request for disclosure of the information, we will take full account of your explanation, but we cannot give an assurance that confidentiality can be maintained in all circumstances. An automatic confidentiality disclaimer generated by your IT system will not, of itself, be regarded as binding on ORR.

If you are seeking to make a response in confidence, we would also be grateful if you would annex any confidential information, or provide a non-confidential summary, so that we can publish the non-confidential aspects of your response.

Any personal data you provide to us will be used for the purposes of this consultation and will be handled in accordance with our privacy notice which sets out how we comply with the General Data Protection Regulation and Data Protection Act 2018.


In responding to this consultation you consent to us:

  • handling your personal data for the purposes of this consultation;
  • publishing your response on our website (unless you have indicated to us that you wish for your response to be treated as confidential as set out above.)

Your consent to either of the above can be withdrawn at any time. Further information about how we handle your personal data and your rights is set out in our privacy notice.

Format of responses

So that we are able to apply web standards to content on our website, we would prefer that you email us your response either in Microsoft Word format or OpenDocument Text (.odt) format.

If you do send us a PDF document, please:

  • create it from the electronic Word file (preferably using Adobe Acrobat), as opposed to an image scan, where possible; and
  • ensure that the PDF's security method is set to no security in the document properties.

Consultation document

RM3 2019 consultation document
8 January 2019

Further information

RM3 2017 edition