We present a model for benchmarking risk analysis and risk based decision making practice within organisations. It draws on behavioural and normative risk research, the principles of capability maturity modelling and our empirical observations. It codifies the processes of risk analysis and risk based decision making within a framework that distinguishes between different levels of maturity. Application of the model is detailed within the selected business functions of a water and wastewater utility. Observed risk analysis and risk based decision making practices are discussed, together with their maturity of implementation. The findings provide academics, utility professionals, and regulators a deeper understanding of the practical and theoretical underpinnings of risk management, and how distinctions can be made between organisational capabilities in this essential business process.