Legal Maturity Evaluation Tool

There is no specific legal department in place (neither central or decentralized). Legal advice is given on a case to case basis from external or in-house counsel, who are deployed in business or supporting units.

A loosely connected group of "in-house counsel" exists lacking a structure without a direct reporting line to the first (board) or second level management.

There is a structured and comparatively independent legal department without a direct reporting line to the first (board) or second level management.

The legal department is structured and has own resources such as rooms and internal budget. The head of legal reports (at least) to the second level management.

The legal department is structured and has own resources such as rooms and internal budget. The head of legal reports at least legal issues directly to the management (board) and is involved in the operational risk reporting.

There are only hard copies of the contracts with externals filed in the business unit. The access regarding the contracts is only possible in a physical way.

Some contracts with externals are digitized. Access to those contracts is electronically possible by contacting the business unit.

All contracts are digitized and electronically available in the business units. The legal department will be provided with copies on demand.

All contracts with externals are digitized and electronically available in the business units as well as in the legal departments.

All contracts with externals will be digitized and electronically available in the business unit and the legal department on grounds of a contract lifecycle management system.

All external counsel costs are billed by the hour.

All external counsel costs are billed by the hour. There have been some discussions around the need to review this for some external counsel usage.

All external counsel costs are billed by the hour. There are ongoing discussions and reviews of agreements with current external counsel usage to see if other remuneration options are available.

External counsel who have long-term agreements with the organization for continuous work are billed using alternative remunerations options. External counsel who have short-term project based agreements with the organizations are billed by the hour.

External counsel with long-term agreements are billed using alternative remuneration options. Remuneration options for external counsel who have short-term project based agreements are negotiated and agreed on a case by case basis.

There is no risk management process in place to handle legal risks. Issues and tasks are dealt with on a case by case basis as they come in..

There is no risk management process in place to handle legal risks. However, there are ongoing discussions around creating a working group to develop and implement a process.

There is a working group in place that is currently developing a risk management process to handle legal risks.

There is a legal risk management process that is being implemented in the legal function's work. The steps include (1) identify, (2) analyze, (3) evaluate, (4) treat and (5) review.

There is a clearly defined legal risk management process that is in place and implemented in our every day work. The process is written in a procedural documentation that is easily accessible to all staff and provided to new staff upon onboarding.

Management is reactive in addressing GDPR requirements. Compliance processes are informal and inconsistent.

The need for GDPR compliance is implicitly understood by management, but practices are largely informal. The need for GDPR policies, plans and procedures is communicated by management, but development is left to the discretion of individuals.

A GDPR compliance programme is established and communicated. The programme is defined with appropriate business objectives.

Management has implemented a GDPR programme organization structure with documented roles, responsibilities and staff performance criteria.

A proven, full life cycle programme methodology is implemented. An integrated program management office is responsible for the GDPR programme. Resources are best utilized to support strategic initiatives.