There is no single best way for organizations of all types to do risk management. Instead, there appears to be a maturity model for risk management that has at least three levels. Some organizations work on one or two levels. Those working in high-risk environments may take advantage of all three levels, using that which is appropriate to their circumstances.