Risk Management Maturity Assessment Method for Strengthening the Resilience of the Intralogistics Service Process in Warehouse 4.0 (RMMAM-W4.0)

Featured Application

The proposed RMMA-W4.0 method can be applied by warehouse managers, risk management officers, and operations directors to diagnose the maturity of risk management practices in highly automated intralogistics facilities and to translate this diagnosis into concrete resilience-strengthening priorities. By linking the maturity profile with a resilience profile through cross-mapping, the method supports investment planning, the prioritisation of improvement actions across technical, organisational, and human dimensions, and the preparation of business continuity and degraded-mode operating procedures for AS/RS and other automated warehouse systems. It may also serve as a benchmarking tool for comparing risk management maturity and resilience profiles across different warehouse facilities within the same organisation, or for monitoring the effects of improvement actions over time.

Abstract

Contemporary warehouses operating under the Warehouse 4.0 paradigm are complex cyber-socio-technical systems, in which risk management maturity assessment is typically conducted in isolation from its impact on the resilience of the intralogistics handling process. The aim of this article is to develop the conceptual framework of a three-layer RMMA-W4.0 method, supporting the resilience of such systems by integrating a map of risk sources, a maturity assessment model covering seven risk management dimensions, and six resilience dimensions of the intralogistics handling process. These dimensions were linked through cross-mapping analysis, enabling a resilience profile to be derived from a maturity profile. The application of the method is illustrated through a case study of a highly automated AS/RS-class warehouse. The results showed that an aggregated maturity index may mask a significant imbalance in the profile—a high level of technical maturity did not translate into most resilience dimensions, particularly degraded-mode operation and recovery, which made it possible to formulate targeted improvement recommendations. The conclusions indicate that decomposing the assessment into a maturity profile and a resilience profile derived from it enables the identification of areas requiring priority reinforcement, while a full gap analysis remains a direction for future research.

1. Introduction

Contemporary warehouses operating under the Warehouse 4.0 paradigm are complex cyber-socio-technical systems, in which the reliability and continuity of the intralogistics handling process depend simultaneously on many mutually interrelated elements. A high degree of automation, the integration of IT/OT systems, and the growing dependence of the process on data and digital infrastructure mean that the effectiveness of risk management cannot be assessed solely on the basis of selected operational indicators. Although important, such indicators do not reveal whether an organisation possesses the actual capabilities to systematically identify, assess, and mitigate risk in a manner that allows it to maintain business continuity under conditions of growing technological and organisational complexity.

In this context, tools that enable a structured diagnosis of the state of risk management practices are gaining increasing importance—among them, maturity models occupy a particularly significant place. Their value, however, is not limited to the mere assessment of an organisation’s current state. A well-designed maturity model should perform a threefold function: first, it should enable a reliable assessment of an organisation’s current capabilities in a given management area; second, it should indicate a concrete, justified pathway for developing specific skills, procedures, and knowledge resources, leading from the current state to a state of higher maturity; third, it should enable comparative (benchmarking) analyses—both between different objects within the same organisation and against adopted best-practice standards. A model that fulfils only the first of these functions is reduced to a one-off measurement of the current state—it does not provide the organisation with knowledge of the direction and manner in which it should develop its risk management capabilities, nor does it allow the organisation to assess its own position relative to other comparable systems. For this reason, research on maturity models should not focus exclusively on developing the assessment tool itself. It is equally necessary to design, in parallel, a mechanism that translates the assessment result into practical organisational action—that is, into the identification of areas requiring reinforcement and the formulation of concrete, targeted improvement recommendations. A maturity model lacking such an interpretive mechanism remains a purely diagnostic tool, whose applied value for an organisation’s decision-makers is limited.

A review of the existing literature on risk management maturity models reveals a research gap of a twofold nature [1,2]. First, existing risk management maturity models are typically generic or sector-neutral in nature and do not account for the specificity of the cyber-socio-technical environment of Warehouse 4.0, in which risk sources simultaneously span the digital, infrastructural, operational, organisational, and human layers. Second, risk management maturity is usually treated as an end in itself, without relating the obtained result to a specific operational effect—namely, the process’s ability to anticipate disruptions, absorb them, respond to them, continue operating under constrained conditions, and recover after they occur—that is, without relating it to the resilience of the intralogistics handling process. Consequently, there is a lack of a tool that would link the assessment of risk management maturity with its practical translation into strengthening a warehouse’s operational resilience, while simultaneously enabling the identification of priority improvement directions and the conduct of comparative analyses between objects.

The aim of this article is to develop the conceptual framework of a three-layer method for assessing risk management maturity, aimed at supporting the resilience of cyber-socio-technical systems supporting intralogistics processes (RMMA-W4.0). The method integrates a map of risk sources specific to Warehouse 4.0, a maturity assessment model covering key risk management dimensions, and resilience components of the intralogistics handling process, linking them through cross-mapping analysis into a coherent interpretive mechanism.

This article makes three main contributions:

• It proposes a conceptual framework for a risk management maturity model that covers the full range of risk sources specific to the cyber-socio-technical environment of Warehouse 4.0, rather than limiting the assessment solely to technical or digital dimensions.
• It introduces a cross-mapping mechanism linking the results of the maturity assessment with six resilience components of the intralogistics handling process, making it possible to transform a maturity profile into a resilience profile and, on this basis, to identify the risk management areas requiring priority reinforcement—thereby combining the model’s diagnostic function with its developmental and benchmarking functions.
• The practical applicability of the proposed method is demonstrated through an illustrative case study based on data collected from a highly automated AS/RS-class warehouse, showing that an aggregated maturity index may mask a significant imbalance in the resilience profile; the case demonstrates usability but is not intended as full empirical validation of the method, and it formulates concrete improvement recommendations on this basis.

The structure of the article is presented in Figure 1.

Figure 1. Article’s structure. Source: Author’s own elaboration.

2. Theoretical Background

2.1. Principles for Formulating Maturity Models

The formulation of a maturity model requires more than the arbitrary definition of levels and criteria; it requires a systematic design process grounded in an explicit understanding of what maturity represents and how it can be meaningfully assessed. Maturity is commonly understood as the evolutionary progress of an organisation, process, or system along a defined developmental path, from an initial, often reactive state toward a state of greater control, integration, and continuous improvement [3]. Anderson and Jessen [4] further characterise this progression as the growing capability of an organisation to consistently achieve the goals it sets for itself, while Kohlegger, Maier, and Thalmann [5] emphasise that maturity models function as structured tools for evaluating current capabilities and identifying the actions required to advance them to a higher developmental stage. A maturity model, in this sense, is not a single measurement but a sequential logical path connecting a lowest, informal state to a highest, systemically managed one [6].

The methodologically correct formulation of a maturity model requires the explicit definition of several structural elements. Van Looy [7] identifies these elements as essential building blocks that must be addressed during model design, while Poeppelbuss, Niehaves, Simons, and Becker [8] further emphasise the role of the assessment mode in determining how the evaluation is practically conducted. Table 1 synthesises these structural elements and their characteristics.

Table 1. Structural elements of a maturity model. Source: Author’s own elaboration based on [5,6].

Structural Element	Characteristics
Object of assessment	The boundaries of the object of assessment must be precisely defined in order to avoid ambiguous interpretation of results.
Assessment dimensions	Components of the assessed object for which requirements corresponding to successive maturity levels are defined.
Maturity levels	A scale, typically comprising four or five levels, progressing from a baseline state to an advanced state.
Transition criteria between levels	Criteria distinguishing successive levels, which should be unambiguous and verifiable.
Rules for aggregation and interpretation of results	Rules determining whether the model generates a single synthetic score, a staged classification, or a differentiated profile.
Assessment mode	The manner in which the assessment is conducted—self-assessment, expert panel, document analysis, or a combination of these methods.

An important methodological choice in this process concerns the logic of aggregating results across dimensions, commonly framed as a distinction between the staged and the continuous model [9,10]. In the staged approach, an assessed object can be assigned to a given maturity level only if it satisfies the requirements of that level across all evaluated dimensions simultaneously, which enforces developmental coherence at the cost of flexibility. In the continuous approach, each dimension is scored independently on the same scale, allowing the assessed object to display markedly different levels of advancement across its components. This distinction has direct consequences for the diagnostic value of a model: aggregating scores into a single index risk concealing weak dimensions behind a favourable average, whereas a differentiated, profile-based result preserves visibility of uneven development and therefore better supports the prioritisation of improvement actions [11].

Beyond the technical correctness of its structure, a maturity model must also undergo a systematic verification process. Röglinger and Pöppelbuß [6] argue that the criteria assigned to successive levels cannot constitute an arbitrary compilation of practices considered desirable by the model’s designer; they must instead be derived from theoretical grounding, prior models, and empirical or expert validation, a requirement echoed by Becker, Knackstedt, and Pöppelbuß [12] in their procedural framework for maturity model development. Salah, Paige, and Cairns [13] propose that this verification should proceed through three complementary forms of evaluation: an author’s internal assessment of consistency and completeness; an independent expert assessment addressing the validity of the dimensions, levels, and criteria; and, most importantly, an assessment conducted in a real organisational or operational setting, which alone can confirm the practical usability, clarity, and diagnostic value of the model. Helgesson, Höst, and Weyns [14] similarly stress that the ultimate justification for a maturity model lies not in its formal elegance but in demonstrating that progression to a higher level genuinely corresponds to improved effectiveness or reliability of the assessed process.

Comparative reviews of existing maturity models further indicate that models can be classified according to several defining characteristics: the number of levels adopted, their discrete or continuous character, whether results are expressed quantitatively, and whether the model embodies a philosophy of continuous improvement [3]. These reviews also point to a set of recurrent limitations that a well-formulated model should attempt to mitigate, including an oversimplified representation of organisational reality, an implicit assumption of a single correct improvement path while disregarding viable alternatives, and insufficient transparency regarding the empirical basis on which the model was constructed [11,15]. At the same time, when properly designed and validated, maturity models retain considerable value as diagnostic, developmental, and benchmarking instruments, enabling systematic comparison between organisations or systems operating within the same domain [16,17].

2.2. Risk Management Maturity Models

The concept of organisational maturity in the area of risk management derives from process maturity assessment models, which share a common assumption: describing an organisation’s developmental path from an informal, reactive and unsystematic approach to a fully formalised, proactive approach integrated with enterprise management processes. The point of reference for most of the analysed models remains the concept proposed by Hillson [18], who suggested assessing risk management maturity across four levels (naïve, novice, normalised, natural) described by four attributes: culture, process, experience and application. This model became the theoretical foundation for numerous subsequent sector-specific studies, including most of the models discussed below. It is also worth noting that the literature distinguishes both generic risk management maturity models and models developed for specific sectors, including construction, logistics and supply chain management. Generic models tend to focus on risk management maturity at the enterprise level, whereas sector-specific models place greater emphasis on the specificity of processes, resources and inter-organisational relationships. In order to identify the existing body of research on risk management maturity models, a review of publications indexed in the Scopus database was conducted using the search term “risk maturity model”. The models identified through this review are presented below.

Feitosa and Carpinetti [19] proposed a Supply Chain Risk Management Maturity Model, which—unlike classic descriptive models—combines a theoretical maturity matrix with a multi-criteria fuzzy TOPSIS-Class classification method. The model comprises three dimensions: managed categories of operational and disruption risk; the degree of implementation of the risk management process (identification, assessment, response, monitoring); and elements of organisational support (management commitment, culture, resources, communication, continuous improvement). The use of fuzzy logic makes it possible to account for the uncertainty and subjectivity of expert judgements, which the authors identify as a key advantage over models based solely on rigid ordinal scales.

Oliva [20] developed an enterprise risk management (ERM) maturity model based on a survey of large Brazilian companies, using factor analysis, cluster analysis and multinomial logistic regression to extract four explanatory factors: organisation, technicality, transparency and involvement. On this basis, the author proposed an ordinal five-level maturity scale (Insufficient, Contingency, Structured, Participative, Systemic), whereby these levels were not established a priori but derived directly from the empirical clustering of the surveyed sample of companies.

The GRMM (Generic Risk Maturity Model), originally developed by Hoseini et al. [21] and applied to assess the maturity of Korean construction companies by Karunarathne and Kim [22], differs from the other models in that it uses a 0–10 point scoring system instead of discrete maturity levels. The model distinguishes two categories of attributes: the risk system (strategy and policy, management commitment, culture and staff knowledge) and risk execution (risk assessment, response and mitigation, monitoring and review), with results expressed as a Maturity Score (MS) and an Ambition Score (AS), the difference between which indicates the gap between an organisation’s actual state and its target level.

Salawu and Abdullah [23] applied a fuzzy synthetic evaluation approach to assess the risk management maturity of road-construction contractors in Nigeria, using an RM3-based model built on four attributes (culture and awareness, practice and application, risk management resources, risk management process) assessed on a four-level scale (naïve, novice, managed, optimised). A distinctive feature of this approach is the use of trapezoidal membership functions and a defuzzification procedure to derive an overall risk management maturity index, which allows the ambiguity typical of respondents’ answers in qualitative assessments to be taken into account.

Serpell et al. [24] proposed a maturity model for Chilean construction organisations built directly on Hillson’s concept, extended to five main factors: organisation, communication, knowledge, process and integration, assessed on a four-level scale. The model was subjected to a two-stage expert validation process (two independent panels), and its pilot application in three companies revealed the lowest maturity level in the area of knowledge, which the authors attribute to the absence of systems for collecting and managing organisational experience regarding risk.

Wibowo and Taufik [25] developed a self-assessment tool for risk management maturity intended for public client organisations (owners) of construction projects in Indonesia. The model uses the Delphi method to select and validate 34 attributes grouped into four dimensions (organisational culture, RM processes, RM resources, RM implementation) and the AHP method to determine the weights of individual attributes. The final result is expressed on a 0–100-point scale, translated into four maturity levels analogous to Hillson’s classification (naive, novice, normalized, managed). A significant conclusion drawn by the authors is that the highest weight in the maturity assessment was assigned to soft factors—top management commitment, integrity and ethics, and change management capability—rather than to elements of formal, standardised systems.

Tubis and Werbińska-Wojciechowska [2] proposed the LRMM (Logistic Risk Management Maturity Model) dedicated to logistics processes, whose significant contribution is the introduction of a fifth, original assessment area—cooperation at risk—which takes into account the inter-organisational nature of logistics processes carried out at the interface between supply chain links. The model comprises five areas (knowledge, risk identification and analysis, risk response, risk monitoring, cooperation at risk) assessed on a five-level scale (Poor–Basic–Good–Satisfactory–Excellent), and the authors introduce a two-stage assessment procedure in which a global maturity index (ML) is determined from the partial scores of individual areas, calculated as a weighted average, which allows organisations to be compared on a continuous scale rather than merely assigned to one of the discrete levels.

A comparison of the main characteristics of the analysed maturity models is presented in Table 2.

Table 2. Comparison of the characteristics of the reviewed risk management maturity models. Source: Author’s own elaboration based on [2,19,20,22,23,24,25].

Model	Sector	No of Levels	Assessment Methods	Dimensions/Assessment Areas
SCRM [19]	Supply chain (any sector)	4	Theoretical model + fuzzy TOPSIS-Class (multi-criteria classification)	Managed risks (demand, production, supply, financial, information, transport, disruption); Risk management process (identification, assessment, response, monitoring); Organisational support (communication, management commitment, culture, resources, continuous improvement, integration)
ERM [20]	Enterprises (enterprise risk management),	5	Factor analysis, cluster analysis, multinomial logistic regression	Organisation (planning, implementation, process control); Technicality (qualitative/quantitative tools); Transparency (communication, participative management); Involvement (external support, value-environment analysis)
GRMM—[22]	Construction (companies and construction projects)	Point-based scale	Expert survey; Maturity Score (MS), Ambition Score (AS), Importance Score (IS) indicators	Risk system (strategy and policy, management commitment, culture and staff knowledge) Risk execution (risk assessment, response and mitigation, monitoring and review)
RM3—[23]	Construction (road projects)	4	Fuzzy synthetic evaluation (trapezoidal membership functions, defuzzification)	Culture and awareness; Practice and application; Risk management resources; Risk management process
Hillson-based maturity model [24]	Construction (clients and contractors)	4	Questionnaire validated by expert panels; average of respondents’ scores	Organisation; Communication; Knowledge; Process; Integration
RM [25]	Public construction (government units)	4	Delphi method (attribute selection and validation) + AHP (attribute weighting)	Organisational culture; RM processes; RM resources; RM implementation (34 attributes in total)
LRMM—[2]	Logistics processes / supply chain	5	Descriptive assessment via maturity matrix + global maturity index (weighted average)	Knowledge; Risk identification and analysis; Risk response (process management); Risk monitoring; Cooperation at risk

The overview of the presented models points to a clear predominance of either a four-level [18,24,25] or a five-level [20] maturity scale, alongside considerable methodological diversity in how the final assessment is derived—from simple arithmetic averages of expert scores [24], through multi-criteria methods based on fuzzy logic [19,23], to hybrid methods combining Delphi and AHP [25] and multivariate analyses [20]. A distinguishing feature of the models dedicated to the logistics sector and supply chains [2,19], compared with models oriented towards a single organization [22,24,25], is the inclusion of an inter-organisational dimension—expressed, respectively, as a category of disruption risks spanning the internal and external chain, and as a separate area of cooperation at risk. The seven risk management maturity dimensions (D1–D7) proposed in this article for Warehouse 4.0 were derived through the convergence of the risk management functions recommended in the ISO 31000:2018 standard [26], recurring constructs identified across the risk management maturity models discussed above, and operational requirements specific to the Warehouse 4.0 environment. This approach ensures that the defined maturity dimensions are independent of the researcher’s arbitrary judgement.

3. Methodology

The aim of the research is to develop the conceptual framework of the three-layer RMMA-W4.0 method, which is intended to meet the need for assessing risk management maturity in Warehouse 4.0, and whose results should support the process of strengthening the resilience of the intralogistics service process. The method will be developed on the basis of a literature review, the author’s own research, and conclusions drawn from an implementation carried out in a selected real-world environment. The starting point for developing the RMMA-W4.0 method is the following main research question:

MRQ: 

How should risk management maturity in Warehouse 4.0 be assessed in order to identify priority areas for resilience reinforcement in the intralogistics service process?

A research question formulated in this way requires targeted analytical work carried out in order to answer the following detailed questions, leading to the creation of the conceptual framework of the model:

• RQ1: Which risk categories should be taken into account in the risk management maturity assessment so that it corresponds to the specificity of the cyber-socio-technical environment of Warehouse 4.0?
• RQ2: Which dimensions and levels of risk management maturity should constitute the structure of the assessment model, in accordance with applicable risk management standards for cyber-socio-technical systems?
• RQ3: Which dimensions of intralogistics service process resilience should be developed through mature risk management in Warehouse 4.0?
• RQ4: How should the risk management maturity dimensions be linked to the intralogistics service process resilience dimensions, so as to identify, on this basis, the risk management areas requiring strengthening from the perspective of process resilience?
• RQ5: How can the results of the matrix juxtaposition of the maturity dimensions and the resilience dimensions be used to formulate recommendations aimed at strengthening the resilience of the intralogistics service process against the operational risks that occur?

To make explicit how each detailed research question is operationalised within the structure of the article, Table 3 maps RQ1–RQ5 to the sections in which they are addressed and to the corresponding results.

Table 3. Structural elements of a maturity model. Source: Author’s own elaboration.

RQ	Addressed in	Result Presented in
RQ1	Section 4.1—Warehouse 4.0 Risk Source Map	Figure 4, Table 7
RQ2	Section 4.2—Risk Management Maturity Assessment Model	Figure 5, Table 8
RQ3	Section 4.3—Intralogistics Service Process Resilience Components	Table 10
RQ4	Section 4.4—Cross-Mapping Matrix of Maturity and Resilience Dimensions	Table 11
RQ5	Section 4.5—Case Study (application of the cross-mapping matrix to the assessed facility)	Tables 12–17

The formulated research questions distinguish three related yet distinct conceptual categories, presented in Figure 2.

Figure 2. Conceptual categories. Source: Author’s own elaboration. Note: What—which risk sources should be analysed as part of the assessment? How—how are the practices for managing these risks assessed? Effect—how risk management maturity is associated with the resilience of the intralogistics service process.

These categories need to be defined given their critical importance within the layers of the method being developed:

• Risk categories denote ordered groups of disruption sources specific to the functioning of Warehouse 4.0. Their purpose is to determine which types of risk should be taken into account in the risk management maturity assessment. These categories form a map of the risk sources characteristic of Warehouse 4.0. Risk categories do not constitute independent maturity dimensions or resilience metrics; rather, they indicate against which disruption sources the maturity of risk management practices should be assessed. In the proposed method, a risk is assumed to be assigned to the category that best describes the dominant source of the disruption, rather than its operational effect.
• Risk management maturity dimensions denote the assessment areas describing the degree of development of risk management practices in Warehouse 4.0. They constitute the core of the method, as they determine what is subject to assessment and in which areas a maturity level can be assigned. These dimensions should relate to the key risk management functions. It is critical that they do not describe types of risk, but rather the manner in which the organisation manages those risks.
• Intralogistics service process resilience components denote the functional constituents of resilience that should be strengthened through mature risk management. Within the method, they perform an interpretive function, making it possible to assess whether a given level of risk management maturity translates into the process’s capacity to maintain an acceptable level of performance under disruption conditions. Resilience components are categories used to interpret the consequences of mature or immature risk management for the continuity of the intralogistics service process.

The detailed questions formulated above make it possible to outline the research procedure and the research methods adapted to the scope of the work undertaken. The procedure comprises 5 research stages, presented in Figure 3.

Figure 3. Research procedure. Source: Author’s own elaboration.

For each stage of the procedure, the scope of the required analytical work has been assigned, together with the dedicated research methodology. This methodology is presented in Table 4.

Table 4. Research methodology. Source: Author’s own elaboration.

Stage	Research Methods
Stage 1	Literature review (findings of systematic and narrative reviews of publications on risk management in warehousing, intralogistics and Industry 4.0) aimed at identifying existing risk classifications. The author’s field research conducted in selected Warehouses 4.0 (accompanying observation, and analysis of incident and operational documentation) aimed at verifying and supplementing the literature-derived categories with disruption sources actually occurring in practice. Synthesis of both sources through content analysis and thematic coding, leading to the identification of mutually exclusive risk categories.
Stage 2	Analysis of the normative document ISO 31000:2018 [26] as the leading source used as the primary basis for the maturity dimensions—the principles, framework and risk management process described in the standard served as the starting point for extracting the key risk management functions/areas subject to assessment. A supplementary literature review covering existing risk management maturity models and concepts of cyber-socio-technical systems. Comparative analysis (conceptual benchmarking) aimed at confronting the dimensions derived from ISO 31000:2018 [26] with the approaches used in other models, and at accounting for the specificity of the integration of the technological, organisational and human layers characteristic of Warehouse 4.0. Deductive synthesis leading to the formulation of the author’s own maturity dimensions (rooted in the structure of ISO 31000:2018 [26], yet adapted to the specificity of Warehouse 4.0) and to the characterisation of the individual levels of the maturity scale.
Stage 3	Literature review in the area of process and supply chain resilience (resilience engineering, supply chain resilience) aimed at identifying universal resilience components. Analysis of normative documents ISO 22316:2017 [27] and NIST SP 800-160 vol. 2 rev. 1 [28]. Findings of the author’s own research conducted in selected Warehouses 4.0 (case studies accompanying observation of the course of the intralogistics service process under disruption conditions), which will be used to transform the general resilience components into the specificity of the intralogistics service process (resilience dimensions).
Stage 4	Matrix analysis (cross-mapping)—juxtaposition of the risk management maturity dimensions and the intralogistics service process resilience dimensions in the form of a relationship matrix, aimed at determining the strength of the association.
Stage 5	Case study—full application of the model (Stages 1–4) in a selected Warehouse 4.0, using documentation analysis and observation of the intralogistics service process, aimed at assessing the diagnostic usefulness of the model and its capacity to formulate recommendations on a concrete example.

In Stage 1, primary use will be made of a systematic literature review concerning risk in Warehouses 4.0 [29], together with two complementary literature-based approaches [30,31] defining the risk categories characteristic of Industry 4.0. The results of the theoretical work will be verified and supplemented with data derived from the author’s field research, carried out, among others, as part of two industrial—research internships implemented under the Mozart Programme: (1) Strategy for the implementation of Warehouse 4.0 and the development of R&D services in the supported supply chains and (2) A risk-analysis-based model of material flow management in a supply chain dedicated to the automotive industry.

In Stage 2, in addition to normative documents, the theoretical work will primarily draw on the findings of the narrative literature review of risk management models presented in Section 2 and on the new approach to risk assessment in cyber-socio-technical systems described in the monograph [32]. Knowledge acquired in the course of research on the construction of risk management and digital maturity models, whose findings were presented in [2,33], is also of significant importance for defining the maturity assessment dimensions.

In Stage 3, primary use will be made of a literature review in the area of resilience engineering and supply chain resilience, the synthesis of which is presented in [34], in order to identify universal process resilience components (the capacity to anticipate, absorb, respond to and overcome disruptions), together with an analysis of the normative documents ISO 22316:2017 [27] and NIST SP 800-160 vol. 2 rev. 1 [28], which constitute formal reference frameworks for assessing organisational and system resilience. The results of the theoretical work will be verified and supplemented with data from the author’s own research conducted in selected Warehouses 4.0, which will enable the transformation of the general resilience components into the specificity of the intralogistics service process.

In Stage 4, matrix analysis (cross-mapping) will be applied. This method consists of systematically juxtaposing two or more sets of analytical categories in the form of a relationship matrix, in order to identify and structure the associations occurring between them. This method is applied in systems and organisational research wherever the phenomenon under assessment is multidimensional in nature and the individual dimensions are not independent of one another but are mutually conditioning. Within the RMMA-W4.0 method, matrix analysis will be used as an interpretive mechanism linking the two layers of the method: the risk management maturity assessment model and the intralogistics service process resilience components. The application of cross-mapping stems from the assumption that the maturity dimensions (D1–D7) and the resilience dimensions (R1–R6) are neither identical to nor disjoint from one another, but remain in a partial relationship of mutual influence that varies in strength. The maturity of risk management practices in a given dimension translates, as a rule, not into a single resilience capability but usually into several, with the degree of this influence differing depending on the dimension. The construction of the matrix will be carried out in two stages. In the first stage, the qualitative nature of the associations between each of the seven maturity dimensions and each of the six resilience dimensions will be established, based on a comparison of the mechanisms described in the maturity level characteristics with the mechanisms developing the individual resilience dimensions. In the second stage, each association will be assigned a quantitative contribution coefficient, specifying the extent to which a given maturity dimension shapes a given resilience dimension.

The construction of the RMMA-W4.0 method is based on a set of methodological assumptions that specify the object of assessment, the role of the individual layers of the method, and the scope of the results the method provides. These assumptions define the boundaries of the method and thus form the basis for interpreting the results obtained in the further part of the study. The characteristics of the individual assumptions, together with their significance for the construction of the method, are presented in Table 5.

Table 5. Methodological assumptions of the risk management maturity assessment method for Warehouse 4.0. Source: Author’s own elaboration.

Methodological Assumption	Description of the Assumption	Significance for the Construction of the Method
The method is not a digital maturity assessment method for Warehouse 4.0	The subject of the method is not the assessment of the level of digitisation and the use of Logistics 4.0 technologies as such. Digital technologies are treated as an element of the cyber-socio-technical warehouse environment, which can simultaneously strengthen the intralogistics service process and generate new vulnerabilities.	Makes it possible to avoid equating a high technological level of the warehouse with high resilience of the intralogistics service process.
The core of the method is the risk management maturity model	The main element of the method is a maturity model based on risk management dimensions and a five-level maturity scale, with the assessment focused on the maturity of risk management practices.	Enables a structured assessment of the degree of development of risk management practices in Warehouse 4.0. Allows the method to be built around the risk management process.
The risk source map defines the scope of the assessment	The method distinguishes risk sources relevant to Warehouse 4.0, which form a map structuring the scope of identification and analysis of risks characteristic of the intralogistics service process.	Allows verification of whether the risk management maturity assessment covers the full spectrum of disruptions that may affect the continuity of the intralogistics service process.
The resilience dimensions constitute the interpretive layer of the method	The method adopts six dimensions of intralogistics service process resilience, covering the pre-disruption, in-disruption and post-disruption phases. This means that anticipation and absorption of disruptions are equally relevant as response, operation in degraded mode, adaptation and recovery of operations.	Enables the interpretation of the risk management maturity level through the lens of its impact on process resilience, while also allowing process resilience to be assessed more broadly than merely through the time needed to return to the pre-incident state.
The method adopts a continuous mode of results interpretation	Each maturity dimension and each resilience dimension is assessed individually on a five-level scale. The result of the assessment is a profile, not a single aggregated stage-based classification.	Preserves the visibility of the uneven development of individual dimensions, instead of masking it behind a single synthetic score.
The method has a diagnostic-prescriptive character	The method serves not only to determine the current level of risk management maturity but also—through the cross-mapping matrix—to identify areas requiring strengthening from the perspective of process resilience and to formulate improvement recommendations within the maturity dimensions.	Justifies the use of the cross-mapping matrix results for designing actions aimed at strengthening the resilience of the intralogistics service process.
The scope of the method concerns the operational level	The method focuses on the continuity and resilience of the intralogistics service process, not on the overall digital transformation strategy of the enterprise. Strategic and financial risks may constitute context but are not treated as core assessment areas.	Preserves the coherence of the method with the aim of the study, namely strengthening the resilience of the intralogistics service process under operational disruption conditions.

The methodological assumptions presented above, together with the previously described research procedure, constitute the complete methodology for developing the RMMA-W4.0 method. They define the sequence of research stages and the substantive and interpretive scope of the method, specifying the nature of the results obtained on its basis. In accordance with the methodology thus defined, research was carried out on the development of the RMMA-W4.0 method and its implementation in a selected real-world warehouse facility. The results obtained in the course of this research are presented in the following section of the article.

4. Results

The proposed RMMA-W4.0 method consists of three interrelated layers defined in the first three stages of the research work. The Risk source map constitutes the preliminary layer of the method, establishing the scope of the assessment by indicating which types of hazards should be taken into account so that the method corresponds to the specificity of Warehouse 4.0—its application precedes the maturity assessment, because only knowledge of the required scope of risk sources allows the maturity level to be correctly assigned to the individual dimensions in the next step. The Maturity assessment model constitutes the core of the method, determining what and how is assessed with respect to risk management, using the scope established by the risk source map. The Resilience components, in turn, constitute the interpretive layer, determining what effect mature risk management should produce with respect to the continuity and resilience of the intralogistics service process—by juxtaposing them with the maturity assessment results in the form of a relationship matrix, they make it possible to identify the areas requiring strengthening from the perspective of process resilience. A detailed characterisation of each layer, together with its function within the method, is presented in Table 6.

Table 6. Layers of the risk management maturity model in Warehouse 4.0. Source: Author’s own elaboration.

Layer Name	Characteristics	Function in the Model
Warehouse 4.0 risk source map	Covers the risk classes specific to the Warehouse 4.0 environment. This map does not constitute a separate maturity scale, but structures the scope of risks that should be taken into account in the assessment, preceding its execution.	Ensures the completeness of the assessment. Indicates against which disruption sources the maturity of risk management should be analysed, before proceeding to the assessment of the individual dimensions.
Risk management maturity assessment model	Covers the risk management maturity dimensions and a five-level maturity scale. The dimensions describe the key risk management areas, assessed using the scope determined by the risk source map. The model has an adaptive character, and the assessment carried out takes into account the weights assigned to each maturity dimension.	Constitutes the main assessment mechanism. Makes it possible to determine the level of maturity at which risk management practices in Warehouse 4.0 are situated.
Intralogistics service process resilience components	Covers the resilience components that should be strengthened through mature risk management. These components are not additional maturity dimensions, but interpretive categories that make it possible to assess whether risk management translates into process resilience.	Makes it possible to interpret the maturity assessment results through the lens of process resilience. By juxtaposing them with the maturity dimensions in the form of a relationship matrix, it enables the identification of areas requiring strengthening from the perspective of process resilience, providing the basis for further, in-depth analysis of resilience gaps.

4.1. Layer 1—Warehouse 4.0 Risk Source Map

The first layer of the method is the Warehouse 4.0 risk source map. Its task is to determine which types of hazards should be taken into account in the risk management maturity assessment, so that the method corresponds to the specificity of the cyber-socio-technical warehouse environment. This map performs a structuring function with respect to the scope of the assessment, preceding its execution—only establishing which risk classes should be taken into account makes it possible, in the next step, to correctly assess the maturity of the individual risk management dimensions with respect to this scope. Its application is intended to ensure that the risk management maturity analysis is not limited solely to digital or technical risks, but also covers operational, organisational and human sources of disruption to the intralogistics service process. The risk classification was developed for the purposes of assessing the continuity and resilience of the intralogistics service process, and therefore primarily covers risks affecting the operational level of warehouse functioning. It is based on two complementary literature approaches presented in [30,31]. Fuchs et al. indicate that risks associated with the implementation of Industry 4.0/5.0 technologies can be grouped, among others, as technological, operational and socio-cultural risks, alongside strategic, financial and environmental risks. Rodríguez-García et al., in turn, referring directly to highly automated warehouse systems, identify five main types of disruption: cyberattacks, technology sabotage, technological failures, power and network outages, and human–machine interaction problems. Based on a synthesis of the classifications presented in both sources, a proposed risk source map was developed, the graphical scheme of which is presented in Figure 4.

Figure 4. Diagram of the risk source map in Warehouse 4.0. Source: Source: Author’s own elaboration based on [29,30,31].

The map shows five risk sources grouped into three domains—technical (digital + infrastructure), operational (arising directly from the course of the process) and social (organisational + human)—with the intralogistics service process as the central point on which all these sources act. Colour codes domain membership, in accordance with the legend below the diagram. Because the map was developed for the purposes of assessing the continuity and resilience of the intralogistics service process, it therefore focuses primarily on risks affecting the operational level of warehouse functioning. The map deliberately does not cover classic environmental and health-and-safety hazards (e.g., fire, flooding, climatic conditions) as a separate category—these hazards, to the extent that they affect the continuity of the intralogistics service process, are included within intralogistics infrastructure risks or operational risks, depending on the mechanism of their effect on the process. Table 7 presents detailed characteristics for all the distinguished risk groups.

Table 7. Warehouse 4.0 risk source map. Source: Author’s own elaboration based on [29,30,31].

Risk Source	Characteristics	Significance for the Risk Management Maturity Assessment
Digital risks	Include hazards arising from the dependence of the intralogistics service process on information systems, data, cybersecurity, connectivity, IT/OT integration, and the availability of WMS, WCS, ERP or TMS systems. They concern both the unavailability of systems and the loss of integrity, quality, timeliness or security of the data used to control the process.	Make it possible to assess whether risk management covers the vulnerabilities arising from the digitisation of the process, dependence on data, systems integration and cybersecurity.
Intralogistics infrastructure risks	Include hazards arising from the unavailability, failure or limited physical and technical fitness of the infrastructure supporting the intralogistics process, including automation, internal transport equipment, storage systems, sorters, conveyors, workstations, identification devices and power supply infrastructure.	Make it possible to assess whether risk management takes into account the process’s dependence on technical infrastructure, its availability, redundancy, maintenance, and the possibility of bypassing failures of critical resources.
Operational risks	Include hazards arising from the course and organisation of work itself at the individual stages of the intralogistics service process (receiving, storage, replenishment, picking, consolidation, packing, shipping, returns handling)—such as the variability and unpredictability of demand or order structure, a mismatch between operational capacity and load, errors in the design of flows and work sequences, and quality defects in goods received into the warehouse. These hazards materialise independently of the state of digital systems, infrastructure or human resources, and their effects on process performance (decline in throughput, failure to meet SLA, picking errors, growing backlog) are the subject of the impact assessment in dimension D3.	Make it possible to assess whether risk management takes into account hazards arising from the dynamics and design of the process itself—independently of digital, infrastructural, organisational or human sources—and whether the organisation identifies bottlenecks and alternative execution paths before they translate into a decline in the performance parameters measured in D3.
Organisational risks	Include hazards arising from the organisation of work, procedures, responsibility, communication, escalation, coordination between operations, IT and maintenance, testing of contingency plans, and learning after incidents. They concern the organisation’s preparedness to recognise, handle and limit the effects of disruptions.	Make it possible to assess whether risk management is embedded in the organisational structure, procedures, responsibility, communication and improvement mechanisms, rather than being limited solely to technical aspects.
Human risks and human–machine interaction risks	Include hazards arising from operator errors, lack of competencies, cognitive overload, incorrect interpretation of alarms, improper operation of HMI interfaces, excessive trust in automation, and limited staff capacity for manual, emergency or degraded-mode work.	Make it possible to assess whether risk management takes into account the role of the human being in the Warehouse 4.0 environment, in particular competencies, training, readiness for emergency work, and the quality of cooperation between operators and digital and automated systems.

Note: a physical failure of an automation device (e.g., a sorter, a conveyor) is classified as an intralogistics infrastructure risk, whereas incorrect control of that device resulting from a failure or error of the WCS/OT system is classified as a digital risk. This distinction should be maintained when assigning audit observations to the individual risk sources.

The risk source map was developed for, and is directly applicable to, highly automated, WMS/AS-RS-integrated warehouse facilities operating under the Warehouse 4.0 paradigm, of the type analysed in the case study presented in Section 4.5. Its applicability to warehouses with substantially lower levels of automation or digital integration, where the digital and intralogistics infrastructure risk sources identified here would be of correspondingly lower relevance, has not been examined. Extrapolation of the map to such facilities, or to warehouses of markedly different scale or business profile, should therefore be undertaken with caution and treated as a hypothesis to be verified in future research, rather than as an established property of the classification framework.

4.2. Layer 2—Risk Management Maturity Assessment Model

The risk management maturity model constitutes the core of the proposed method. Its task is to structure the assessment of risk management practices with respect to the intralogistics service process and to indicate the extent to which these practices support the maintenance of business continuity and the strengthening of process resilience under conditions of disruption and threat. The model comprises a set of seven maturity dimensions, which relate to the key risk management functions and are linked to the guidelines of the ISO 31000:2018 standard [26], as the leading document standardising risk management practices. These dimensions are presented in Figure 5.

Figure 5. Diagram of the risk source map in Warehouse 4.0. Source: Author’s own elaboration.

The assessment of each dimension is carried out on the five-level scale presented in Table 8. A detailed characterisation of the fulfilment requirements for the individual assessment levels within each dimension is presented in Appendix A.

Table 8. General characteristics of risk management maturity levels in Warehouse 4.0. Source: Author’s own elaboration.

Level Name	Level Characteristics
Level 1 Reactive	Risk management is ad hoc in nature and is triggered mainly after a disruption occurs. Risks, vulnerabilities and the effects of incidents are recognised primarily on the basis of employee experience and current operational problems. There is a lack of formal procedures, consistent risk assessment criteria, systematic monitoring, and linkage of actions to the resilience of the intralogistics service process.
Level 2 Basic	Risk management is partially documented and covers selected risks, procedures and actions to limit the effects of disruptions. The organisation has basic registers, instructions or indicators, but this approach is not yet complete, regularly updated, or fully linked to process criticality, disruption scenarios and resilience gaps.
Level 3 Standardised	Risk management is conducted according to adopted principles and covers the key risk classes of Warehouse 4.0. Risks are identified, classified and analysed in relation to the intralogistics service process, critical resources, business continuity parameters and disruption scenarios. Formal roles, procedures, control mechanisms, response plans and a basis for identifying resilience gaps are in place.
Level 4 Predictive	Risk management is supported by data, KPI/KRI monitoring, trend analysis, scenario testing, assessment of the effectiveness of control mechanisms, and early warning. The organisation is not limited to reacting to disruptions, but is able to identify symptoms of deteriorating process performance, assess residual risk, and anticipate potential resilience gaps before an incident fully escalates.
Level 5 Adaptive	Risk management is integrated with the continuous strengthening of the resilience of the intralogistics service process. The organisation dynamically updates its risk profile, adapting procedures, resources, competencies, technologies and control mechanisms to changing operating conditions, while developing a risk-awareness culture, the capacity for human–automation cooperation, and the dynamic prioritisation of resilience investments. The results of the maturity assessment are systematically used to reduce resilience gaps, design improvement actions, and build process resilience already at the stage of technological and organisational change.

The developed maturity assessment model has an adaptive character, meaning that each dimension is assessed individually on a five-level scale, and the result is presented in the form of a system maturity profile, rather than a single aggregated number. This profile presents the maturity level of each dimension separately and makes it possible to identify areas requiring improvement. This is particularly important, because a high maturity level in one dimension does not automatically compensate for a low maturity level in another dimension, especially if that dimension is of major importance for the resilience of the intralogistics service process. This is also justified by the way the results obtained are used in the further analysis. The assessments of the individual dimensions constitute the starting point for interpreting the results in relation to the resilience components covered in Layer 3 of the method, and for identifying resilience gaps in the intralogistics service process.

In addition, because the importance of the individual dimensions depends on the specificity of a given warehouse—the degree of automation, the level of digitisation, and the nature of the processes handled—weights assigned to the individual dimensions were introduced into the model. The weight reflects the extent to which a given dimension affects the synthetic maturity index of a given warehouse, making it possible to move away from the assumption that all risk management areas are of equal importance regardless of the operational context.

The method does not impose fixed weight values—their determination is left to the managerial or audit team carrying out the assessment, since it is this team that has knowledge of the actual risk profile of a given warehouse. The role of the method, on the other hand, is to define the universal principles to which the assignment of weights must be subject, regardless of who applies the assessment and in which warehouse. These principles are as follows:

• Normalisation. The sum of the weights assigned to all assessed dimensions must equal one:

$${\displaystyle {\sum }_{i=1}^n}{w}_i=1, w\ge 0$$

(1)

where n denotes the number of assessed dimensions (n = 7 for the maturity assessment model layer), and w_i denotes the weight assigned to dimension D_i.

2.

No zero weights. Due to the structuring function of the risk source map (Layer 1), no dimension should receive a weight of w_i = 0—this would mean the complete omission of a given area from the aggregated assessment, which would be contrary to the assumption of assessment completeness. It is recommended to adopt a minimum weight threshold (e.g., w_i ≥ 0.05), set individually by the organisation.

3.

Substantive basis of the weights. The weights should reflect the warehouse’s actual risk exposure in a given area, rather than being assigned arbitrarily. As criteria for weight assignment, managers should take into account: the degree of process automation and digitisation, the criticality of a given dimension for the continuity of intralogistics service, the organisation’s past incident history, and the organisation’s strategic priorities in the area of risk management.

4.

Structured weight-setting procedure. In order to limit subjectivity, it is recommended that weights not be set arbitrarily, but using a structured comparison method (e.g., pairwise comparison of dimensions, rank scoring, or an expert workshop), and that the process of setting them be documented and reproducible (auditable).

5.

Periodic verification. The weights are not fixed—they should be reviewed cyclically (e.g., once a year or after a significant technological or organisational change), so that they reflect the current risk profile of the warehouse.

Adherence to the above principles is intended to ensure that, although the specific weight values differ between warehouses, the manner of their assignment itself remains consistent and comparable within the organisation, which is a necessary condition for interpreting the results over time and across locations.

For each dimension D_i, a maturity level L_i ∈ {1, 2, 3, 4, 5} is determined, in accordance with the characteristics assigned to the individual levels in the maturity assessment model. The weighted maturity index (M_w) is calculated as the sum of the products of the maturity levels and their assigned weights:

$$M_w={\displaystyle {\sum }_{i=1}^n}{w}_i\times L_i$$

(2)

Because the weights sum to 1, the value of Mw falls within the same range as the maturity level scale, i.e., M_w ∈ [1, 5], which allows it to be interpreted directly against the level names, even though the result itself may take non-integer values. The interpretation range of the results obtained is presented in Table 9.

Table 9. Interpretation of the Mw maturity index values. Source: Author’s own elaboration.

Result Range	Maturity Level
1.00–1.49	Level 1—reactive
1.50–2.49	Level 2—basic
2.50–3.49	Level 3—standardised
3.50–4.49	Level 4—predictive
4.50–5.00	Level 5—adaptive

The interpretation of the results should take into account both the values assigned to the individual dimensions and their importance expressed through the weights. Particular attention is required for those dimensions that have obtained a low maturity level combined with a high weight. This is because it means that a poorly developed risk management area is of significant importance for maintaining the continuity of the intralogistics service process and may constitute a priority maturity gap.

4.3. Layer 3—Intralogistics Service Process Resilience Components

The third layer of the method consists of the intralogistics service process resilience components. Their task is to determine what effect mature risk management should produce with respect to the continuity and resilience of the process. These components do not constitute separate maturity dimensions or an independent assessment scale, but perform an interpretive function with respect to the results obtained in the maturity assessment model layer. Their application is intended to ensure that the risk management maturity assessment is related to the actual capacity of the intralogistics service process to anticipate disruptions, limit their effects, continue operating under constrained conditions, and recover after their occurrence.

The model assumes that mature risk management in Warehouse 4.0 should develop such resilience capabilities of the intralogistics service process as make it possible not only to reduce the probability of disruptions occurring, but also to maintain an acceptable level of process performance, limit the effects of a disruption, switch the process to an emergency or degraded mode, and restore its operation after an incident.

The resilience capability areas defined in the model are based on recognised normative and research approaches concerning organisational and system resilience. In particular, the following were used:

• NIST SP 800-160 Vol. 2 Rev. 1 (Developing Cyber-Resilient Systems) [28], where system resilience is defined through the capabilities to anticipate, withstand, recover and adapt,
• ISO 22316:2017 (Security and resilience—Organizational resilience) [27], which identifies resilience as the organisation’s capacity for absorption and adaptation in a changing environment.
• The literature on business process resilience, which distinguishes phases before, during and after a disruption.

On this basis, these concepts were synthesised and extended to the specificity of Warehouse 4.0, distinguishing six resilience capabilities of the intralogistics service process: anticipation of disruptions, absorption of a disruption, response to a disruption, operation in degraded mode, adaptation of the process, and recovery of operations. These capabilities relate to different phases of a disruption’s impact on the process, and their distinction stems from the assumption that process resilience cannot be equated solely with the time needed to return to the pre-disruption state.

In the remainder of this paper, the six distinguished resilience capabilities will be referred to as the resilience dimensions. The term “capability” remains appropriate when referring directly to the adopted normative foundations (NIST SP 800-160 [28], ISO 22316 [27], ISO 22301 [35]), where the resilience of systems and organisations is defined precisely in terms of capabilities. For the purposes of the remainder of the method, in particular the construction of the cross-mapping matrix (Section 4.4), it is nevertheless justified to adopt the term “resilience dimension”. This follows from the fact that it ensures terminological symmetry with the risk management maturity dimensions (D1–D7), which are juxtaposed in the matrix with the six resilience dimensions—both sides of the relationship matrix are then described by concepts of the same order of generality, which facilitates the interpretation of the result. The characteristics of the defined resilience dimensions are presented in Table 10.

Table 10. Resilience dimensions of the intralogistics service process. Source: Author’s own elaboration.

Resilience Dimension	Characteristics	Disruption Impact Phase	Example Assessment Metrics
R1. Anticipation of disruptions	The capability to identify symptoms of disruption before they lead to a significant deterioration in process performance. In Warehouse 4.0, this concerns, among others, the detection of anomalies in data, zone overload, declining system availability, deteriorating automation performance, or an increase in picking errors.	Before the disruption occurs	Anomaly detection time; number of disruptions detected before the process stops; availability of operational data; number of predictive alerts; share of critical resources covered by monitoring.
R2. Absorption of a disruption	The process’s capability to limit the impact of a disruption without an immediate loss of an acceptable level of service, thanks to buffers, redundancy, throughput reserves or alternative resources.	At the onset of the disruption	Minimum throughput maintained after the disruption; maximum permissible backlog; share of orders kept within SLA during the disruption; size of resource reserves; time to onset of the disruption’s impact.
R3. Response to a disruption	The capability to quickly initiate appropriate actions after identifying a disruption—recognising the nature of the event, escalation, task allocation, communication, and activation of contingency procedures.	During the disruption (initial phase)	Response time; escalation time; contingency procedure activation time1; number of tested scenarios; proportion of roles/teams notified in accordance with the procedure within the established time; proportion of procedure steps completed in accordance with the response checklist.
R4. Operation in degraded mode	The capability to continue the intralogistics service process under limited availability of systems, automation, data, personnel or infrastructure.	During the disruption (sustainment phase)	Percentage of throughput that can be maintained in degraded mode; switchover time to emergency mode1; number of processes with a documented manual workaround; share of staff trained for emergency work; error rate during degraded-mode operation.
R5. Adaptation of the process	The capability to reconfigure the process, resources and priorities in response to changed operating conditions—reallocating people and resources, changing the order sequence, or temporarily modifying operating rules.	During and after the disruption	Process reconfiguration time; number of available alternative execution paths; proportion of priority orders completed despite resource reallocation; reduction in cumulative performance loss.
R6. Recovery of operations	The capability to restore the intralogistics service process to an acceptable level of performance after a disruption, consistent with the adopted resilience thresholds (e.g., RTO, SLA, throughput, permissible backlog).	After the disruption has occurred	Process RTO; actual recovery time; backlog clearance time; SLA level after recovery; cumulative performance loss; number of corrective actions after the incident.

Note: The contingency procedure activation time (R3) and the switchover time to emergency mode (R4) relate to two different moments of the same event—the former measures the time to procedure initiation, the latter the time to actually achieving stable operation in degraded mode—and should not be treated as a duplicated metric.

These dimensions form the basis of the method’s interpretive mechanism: by juxtaposing them with the maturity assessment results of the individual dimensions in the form of a relationship matrix (cross-mapping), they make it possible to indicate which risk management areas shape a given resilience capability to the greatest extent, and thus which of them require strengthening for the intralogistics service process to achieve the desired level of resilience. It should be noted that the example assessment metrics listed in Table 10 for each resilience dimension are illustrative in nature and are not accompanied, at the present stage of the method’s development, by quantitative scoring criteria (e.g., defined measurement scales or numerical thresholds); this qualitative framing reflects a deliberate design choice for this initial, proposal-stage version of the method. The development of quantitative scoring criteria for the R1–R6 indicators constitutes a direction for subsequent iterations of RMMA-W4.0.

4.4. Cross-Mapping Matrix of Maturity and Resilience Dimensions

The fourth element of the method is the cross-mapping matrix, an interpretive mechanism linking the maturity assessment result (Layer 2) with the dimensions defined in Layer 3. The matrix answers the question of which risk management dimensions shape a given resilience dimension of the intralogistics service process to the greatest extent, and thus which of them should be strengthened if a given dimension is to be improved.

The associations between the seven maturity dimensions (D1–D7) and the six resilience dimensions (R1–R6) were derived from a comparison of the mechanisms described in the maturity level characteristics (Appendix A) with the mechanisms developing the individual resilience capabilities (Table 10). The strength of the association was marked on a three-level scale: ●—primary association (the dimension constitutes the principal source of the given capability), ◐—supporting association, empty cell—no significant association. The results of the analysis carried out are presented in Table 11.

Table 11. Cross-mapping matrix of the maturity dimensions and the resilience dimensions of the intralogistics service process. Source: Author’s own elaboration.

	R1 Anticipation	R2 Absorption	R3 Response	R4 Degraded Mode	R5 Adaptation	R6 Recovery
D1. Identification of criticality	◐	●			◐
D2. Identification and classification of risks	◐
D3. Analysis of risk impact		◐			●
D4. Vulnerability assessment and monitoring	●		◐
D5. Risk treatment and business continuity		●	●	●	◐	●
D6. Competencies and communication			●	●
D7. Review, learning and improvement						◐*

Note: D7 constitutes a cross-cutting mechanism, strengthening all six resilience dimensions through learning from incidents; only its strongest direct association is marked in the matrix.

The application of the matrix proceeds in three steps, following the completion of the maturity assessment of dimensions D1–D7 (Layer 2):

• Assignment of contribution coefficients. For each column of the matrix (each resilience dimension j), the managerial team assigns a coefficient c_ij ∈ [0, 1] to each dimension marked in that column as ● or ◐, whereby the sum of the coefficients within a given column must equal 1: Σ_i c_ij = 1. Dimensions marked ● should receive a clearly higher coefficient than dimensions marked ◐, reflecting the difference in association strength established in the matrix. Empty cells have no assigned values and are not included in the sum of coefficients. The method does not impose specific values for c_ij—analogously to the weights w_i from Layer 2, their determination is left to the team implementing the assessment, subject to the normalisation principle.
• Determination of the process resilience profile. Based on the assessed maturity levels L₁, …, L₇ and the assigned coefficients, the level of each resilience dimension C_j is calculated as a weighted average of the maturity levels of the dimensions that shape it:

  $$C_j={\displaystyle {\sum }_{i=1}^7}{c}_{ij}\times L_i$$

  (3)

  where C_j denotes the resulting level of resilience dimension j on a 1–5 scale, consistent with the maturity level scale. The levels L₁, …, L₇ used in this step are the same values that were individually assessed for each dimension in Layer 2—unlike the aggregated index Mw, calculated there as a single combined measure for the entire risk management system, the C_j formula deliberately refers to the levels of individual dimensions, in order to preserve the ability to indicate which of them require strengthening. Repeating this calculation for all six dimensions (R1–R6) gives the process resilience profile (C₁, …, C₆), which complements the maturity profile obtained in Layer 2.
• Identification of areas requiring strengthening. The resilience profile makes it possible to identify the resilience dimensions with a relatively lower C_j level compared with the others, and, through the cross-mapping matrix, to identify which specific maturity dimensions (especially those marked ●) are responsible for this lower result. This identification is comparative in nature within the profile itself—it makes it possible to determine which resilience dimensions of the intralogistics service process are less developed than the others in a given warehouse, and thus which risk management dimensions should be strengthened first in order to raise the level of dimensions R1–R6.

The analytical procedure presented above, within the three-layer RMMA-W4.0 method, was implemented in a selected facility constituting an example of Warehouse 4.0.

4.5. Case Study

The RMMA-W4.0 method was implemented in a logistics centre operating as an automated mini-load container warehouse (an AS/RS-class system—Automated Storage and Retrieval System). The facility was designed for maximum storage density and rapid picking of small loads, in a “goods-to-person” working model, in which the operator does not move around the warehouse but waits for the goods to be delivered by the automation to the picking station.

The automated zone occupies more than 20,000 m² of floor area, and the racking structure exceeds 20 m in height, fully utilising the building’s cubic capacity. Automated container stacker cranes, equipped with grippers adapted to handling light loads, move between the racks, picking up and placing cartons in the rack slots. The retrieved cartons are then routed through a network of several km of roller and belt conveyors to the packing zones and loading ramps. The entire movement—allocation of storage locations, queuing of stacker crane tasks, and path optimization—is managed by a higher-level WMS-class IT system, whose tasks include, among others, preventing the formation of bottlenecks during peak order periods.

Due to the high degree of automation, the considerable storage height, and the inherently limited possibility of direct, manual staff intervention in the racking zone, this facility constitutes a representative example of a cyber-socio-technical environment in which the maturity of risk management in the technical layer (monitoring, control, automation) may significantly outpace maturity in the organisational and human layer—which makes it a suitable facility for verifying the RMMA-W4.0 method.

4.5.1. Risk Management Maturity Assessment

In accordance with the established procedural rules of the RMMA-W4.0 method, a risk management maturity assessment of the studied warehouse was carried out on the basis of the risk source map and the maturity model. The results of the assessment obtained are presented in Table 12.

Table 12. Risk management maturity assessment results—case study. Source: Author’s own elaboration.

Dimension	Level (Li)	Audit Finding
D1	3—Standardised	The facility’s critical resources—the mini-load stacker cranes, the conveyor network, the WMS server—have been identified and formally documented. However, the criticality assessment is not dynamically updated on the basis of current operational data or resilience test results.
D2	2—Basic	A basic risk register is maintained, covering mainly technical and infrastructural risks (stacker crane and conveyor failures). Organisational and human risks are not included in the register systematically or updated regularly.
D3	3—Standardised	The impact of disruptions on process parameters (throughput, picking time) is formally measured and analysed by the WMS system as part of the ongoing management of task queuing and resource allocation.
D4	4—Predictive	The WMS system detects symptoms of overload and potential bottlenecks before they fully escalate, including during peak periods (e.g., Black Friday). Monitoring is continuous in nature and supports early warning of disruptions.
D5	2—Basic	No documented business continuity plans or defined capacity buffers for storage aisles were found. Physical emergency access to rack slots above 20 m in height is significantly limited, which reduces the capacity to quickly implement actions to limit the effects of stacker crane failures.
D6	2—Basic	The “goods-to-person” working model limits staff’s direct contact with the physical storage environment. A low level of crew preparedness for manual or emergency work in the event of automation unavailability was found.
D7	2—Basic	No formalised incident-review process or systematic updating of procedures based on lessons learned from disruptions was found. Improvement actions, where they occur, are ad hoc in nature.

The results obtained indicate high risk management maturity in dimension D4, which reached the predictive level. At the same time, it should be emphasised that most dimensions reached only Level 2—basic, despite the warehouse being characterised by a high level of automation of service processes. Only two dimensions (D1 and D3) reached the standardised level. It can therefore be concluded that the enterprise does not make full use of the potential of cyber-socio-technical systems for risk management in intralogistics service processes.

4.5.2. Assignment of Weights w_i and Calculation of the Aggregated Index M_w

In accordance with the rules formulated in Section 4.2 (normalisation to 1, no zero weights, a substantive basis grounded in risk exposure and process criticality), weights were determined for the individual assessment dimensions. These weights, together with their justification, are presented in Table 13.

Table 13. Weights of the maturity dimensions. Source: Author’s own elaboration.

Dimension	Weight (wi)	Justification for Weight Assignment
D1	0.15	The high value of the invested infrastructure (an AS/RS-class system covering 23,064 m2) justifies an above-average weight—incorrect identification of critical resources would carry a high cost.
D2	0.10	A lower weight than the other dimensions, but above the adopted minimum threshold (0.05)—the structuring function of this dimension is important, but risk classification itself has a smaller direct impact on business continuity than the operational dimensions.
D3	0.15	The process’s strong dependence on task queuing by the WMS means that even a minor disruption quickly translates into the throughput of the entire facility—hence the elevated weight.
D4	0.15	The high degree of automation and dependence on the WMS system justify an above-average weight—monitoring mechanisms are a key element of risk management here.
D5	0.20	The highest weight in the set. Limited physical emergency access to rack slots above 20 m in height means an exceptionally high exposure to the risk of being unable to limit the effects of a stacker crane failure—this is the area of greatest criticality for this particular type of facility.
D6	0.15	The “goods-to-person” model limits staff’s natural familiarity with manual work—the elevated weight reflects the risk arising from the crew’s low readiness to take over automation tasks.
D7	0.10	A lower weight, above the minimum threshold—the improvement mechanism is important in the long term, but does not constitute a direct source of risk exposure at the given moment of assessment.

For the weights thus determined, the products of the maturity level and the weight assigned to each dimension were calculated. In accordance with Formula (2), the sum of the values obtained defines the weighted maturity index (M_ww) for the studied warehouse. The results of the calculation obtained are presented in Table 14.

Table 14. Calculation of the weighted maturity index. Source: Author’s own elaboration.

Dimension	wi	Li	wi · Li
D1	0.15	3	0.45
D2	0.10	2	0.20
D3	0.15	3	0.45
D4	0.15	4	0.60
D5	0.20	2	0.40
D6	0.15	2	0.30
D7	0.10	2	0.20
Mw			2.60

The obtained aggregated index value (M_w = 2.60) places the overall risk management maturity of the analysed facility between the basic and standardised levels, in the immediate vicinity of the lower boundary of the latter. This result represents an averaging of the high maturity of the technical layer (D4 = 4) and the substantially lower maturity of the organisational–human layer (D2, D5, D6, D7 = 2). The result obtained confirms the thesis formulated earlier, according to which the aggregated M_w index does not fully reflect the differentiation of the maturity profile of the individual dimensions. Despite the relatively moderate, though not low, value of the aggregate index (M_w = 2.60), as many as four of the seven assessed dimensions remain at the lowest maturity level recorded in this case study. This observation constitutes empirical confirmation of the validity of adopting, within the method, the maturity profile—comprising the individual assessment of all dimensions—as the primary diagnostic tool, while treating the aggregated M_w index solely as an auxiliary measure.

4.5.3. Assignment of Coefficients c_ij and Calculation of the Resilience Profile

After establishing the risk management maturity profile of the analysed facility (Table 12) and the aggregated index M_w, the next step of the case study is to apply the cross-mapping matrix (Table 11, Section 4.4) in order to determine the resilience profile of the intralogistics service process. In accordance with the adopted procedure, for each of the six resilience dimensions, contribution coefficients c_ij were assigned to the individual maturity dimensions marked in the matrix as associated with the given resilience dimension (●—primary association, ◐—supporting association). The adopted coefficients are presented in Table 15, which forms the basis for calculating the level of the individual resilience dimensions (C_j) of the analysed facility. The assigned values preserve the normalisation principle within each resilience dimension (Σ_i c_ij = 1), and dimensions marked as a primary association were assigned a clearly higher share than dimensions with a supporting association, in accordance with the strength of association resulting from the matrix. The coefficients adopted in Table 15 were agreed with the managers responsible for the intralogistics service process at the assessed warehouse, and do not constitute a universal template. In accordance with the principles described in Section 4.4, their final determination remains, in each case, at the discretion of the team implementing the assessment.

Table 15. Contribution coefficients of the maturity dimensions in shaping the resilience dimensions. Source: Author’s own elaboration.

	R1 Anticipation	R2 Absorption	R3 Response	R4 Degraded Mode	R5 Adaptation	R6 Recovery
D1. Identification of criticality	0.20 (◐)	0.35 (●)	-	-	0.25 (◐)	-
D2. Identification and classification of risks	0.20 (◐)	-	-	-	-	-
D3. Analysis of risk impact	-	0.20 (◐)	-	-	0.50 (●)	-
D4. Vulnerability assessment and monitoring	0.60 (●)	-	0.20 (◐)	-	-	-
D5. Risk treatment and business continuity	-	0.45 (●)	0.40 (●)	0.50 (●)	0.25 (◐)	0.70 (●)
D6. Competencies and communication	-	-	0.40 (●)	0.50 (●)	-	-
D7. Review, learning and improvement	-	-	-	-	-	0.30 (◐)
Sum	1.00	1.00	1.00	1.00	1.00	1.00

On the basis of the maturity levels determined in Table 12, the resilience level value was calculated for each of the assessed dimensions R1–R6. The results of the calculation obtained are presented in Table 16.

Table 16. Calculation of the resilience level for each dimension. Source: Author’s own elaboration.

Resilience Dimension	Calculation	Cj
R1	0.20·3 + 0.20·2 + 0.60·4	3.40
R2	0.35·3 + 0.20·3 + 0.45·2	2.55
R3	0.20·4 + 0.40·2 + 0.40·2	2.40
R4	0.50·2 + 0.50·2	2.00
R5	0.25·3 + 0.50·3 + 0.25·2	2.75
R6	0.70·2 + 0.30·2	2.00

Note: Descriptive levels are assigned according to the same threshold ranges defined in Table 10 (1.00–1.49 reactive; 1.50–2.49 basic; 2.50–3.49 standardised; 3.50–4.49 predictive; 4.50–5.00 adaptive).

The interpretation of the results obtained from Table 16 makes it possible to determine the resilience profile of the intralogistics service process carried out at the assessed Warehouse 4.0 (Table 17).

Table 17. Process resistance profile. Source: Author’s own elaboration.

Resilience Dimension	Cj	Descriptive Level
R1	3.40	standardised
R2	2.55	standardised
R3	2.40	basic
R4	2.00	basic
R5	2.75	standardised
R6	2.00	basic

The resilience profile obtained confirms the observation formulated earlier at the maturity profile analysis stage. The high level of dimension D4 translates only into an elevated value of resilience dimension R1 (anticipation of disruptions), while the two remaining resilience dimensions—R4 (operation in degraded mode) and R6 (recovery of operations)—achieve the lowest values in the analysed profile (C_j = 2.00).

Relating this result to the cross-mapping matrix indicates that both dimensions are shaped primarily by maturity dimension D5 (risk treatment and business continuity), assessed at the basic level, with dimension D6 (competencies and communication), assessed at the same level, also making a significant contribution in the case of R4. The results obtained suggest that strengthening dimensions D5 and D6 may bring the greatest improvement in the resilience of the analysed process, in particular with respect to the capability to continue intralogistics service under limited availability of automation and to restore operations after a disruption occurs. This observation remains consistent with the physical characteristics of the analysed facility, including the limited possibility of manual access to rack slots at a height exceeding 20 m.

It should also be emphasised that, despite the highest recorded maturity level being in dimension D4, this does not translate into an increase in the value of the remaining resilience dimensions beyond R1. The case application illustrates the diagnostic advantage of retaining dimension-level profiles over relying exclusively on the aggregated maturity index. It further indicates that high maturity in a dimension of a technical nature does not compensate for limitations in resilience dimensions that depend to a greater extent on dimensions of an organisational nature.

4.5.4. Recommendations Aimed at Increasing the Resilience of the Intralogistics Service Process

On the basis of the resilience profile obtained and the analysis of the cross-mapping matrix carried out, recommendations were formulated relating primarily to maturity dimensions D5 and D6, as the dimensions with the strongest association with the lowest-scoring resilience dimensions (R4 and R6). In accordance with the benchmarking principle adopted in the method, the recommendations were determined with reference to the characteristics of the next, higher maturity level (Level 3—standardised) described for these dimensions in the maturity assessment model, without indicating levels more than one step removed from the assessed level.

With respect to dimension D5 (risk treatment and business continuity), it is recommended that formal response scenarios and a business continuity plan be developed, linked directly to the facility’s priority critical resources, including the mini-load stacker cranes and the conveyor network. In particular, it is advisable to define procedures limiting the effects of the unavailability of a single stacker crane or a conveyor section, taking into account capacity buffers that could be implemented and alternative order-fulfilment paths within the remaining, operational storage aisles. Owing to the limited possibility of manual access to rack slots above 20 m in height, it is also recommended that a documented degraded-mode operating procedure be developed, specifying the minimum set of data and actions necessary to continue fulfilling priority orders under partial unavailability of the automation system.

With respect to dimension D6 (competencies and communication), it is recommended that a systematic training programme be implemented to prepare staff to work under conditions of limited automation availability, covering in particular the operation of HMI interfaces, manual mode, and the principles of order prioritisation under disruption conditions. It is further recommended that roles and communication channels between operations, the IT department and maintenance be formally defined, together with the periodic testing of these arrangements as part of simulation exercises, which is consistent with the characteristics of the standardised level of this dimension in the maturity assessment model.

With respect to resilience dimension R6 (recovery of operations), whose low score in the analysed case results mainly from the insufficient level of dimension D5, it is additionally recommended that a recovery plan be developed specifying the target recovery time objective (RTO) for key system elements, including the WMS server and the stacker cranes, together with a procedure for testing this plan under controlled conditions.

Independently of the detailed recommendations, it is advisable to aim at levelling the maturity profile between the technical layer and the organisational–human layer. The high maturity level of dimension D4 constitutes a resource that could be used to a greater extent to strengthen the remaining resilience dimensions—in particular by using the data generated by the WMS system to feed response procedures (D5) and training programmes (D6) with information on the actual disruption scenarios recorded in the system. Such a solution would make it possible to partially compensate for the difference between technical and organisational maturity without the need to invest in new monitoring mechanisms, drawing instead on information resources already available at the analysed facility.

5. Discussion

5.1. The Risk Management Assessment Model in the RMMA-W4.0 Method Compared with Other Risk Management Models

The proposed model of risk management maturity levels in Warehouse 4.0 differs from the models discussed in the theoretical part in several important respects, which together indicate its distinct cognitive contribution, rather than merely a modification of existing solutions.

The developed model differs in the object and reference level of the assessment. All the analysed reference models relate the maturity assessment either to the enterprise as a whole [20,25], or to a construction organisation or a single investment project [21,23,24], or to the supply chain and logistics processes understood in general terms, without reference to a specific process-execution technology [2,19]. None of the cited models refers directly to the warehouse process operating within the Warehouse 4.0 environment, i.e., an environment that is highly automated, digitised and integrated with IT/OT systems. The authorial model fills this gap by embedding the maturity assessment directly in the context of Intralogistics 4.0—it covers, among others, the criticality of digital resources and automation (D1), digital and infrastructural risks (D2), and human–automation interaction and degraded system operating modes (D6), none of which is identified by any of the reference models as a separate category.

The proposed model is distinguished by the number and structure of its assessment dimensions. It is based on seven dimensions (D1–D7), which constitutes an extension relative to most of the literature models presented in Section 2. It is also significant that the dimensions of the authorial model are not limited to the classic identification–analysis–response–monitoring cycle, but explicitly single out the assessment of process and resource criticality (D1) as a separate starting point for risk analysis. Unlike all the discussed models, the proposed maturity model treats the assessment of vulnerability and the effectiveness of control mechanisms (D4) as a separate, reflexive dimension, deliberately partially overlapping with the review-and-improvement dimension (D7), which is explicitly reserved in the model description as an intended functional distinction rather than a duplication of content.

The central organising category of the authorial model is process resilience, understood as the capacity to maintain the continuity of intralogistics service under conditions of disruption. Whereas the reference models consistently define maturity as the degree of formalisation and systematisation of risk management practices—culture, process, resources and implementation [18,24,25]—the authorial model links each maturity level directly with the system’s adaptive capacity: from reactively coping with the effects of failures (Level 1) to designing resilience-by-design and adaptive resource management under conditions of variability (Level 5). This approach brings the model close to the concept of risk collaboration present in the LRMM model [2], with the difference that, in place of inter-organisational collaboration, it introduces the intra-process adaptive capacity of the warehouse system as the central axis of the maturity assessment.

The assessment model forming part of the MRRA-W4.0 method differs in the terminology of its maturity levels. The naming convention adopted in the authorial model (reactive—basic—standardised—predictive—adaptive) departs from the convention dominant in the literature, that of Hillson [18] (naïve—novice—normalised/managed—optimised/natural), replicated directly or in modified form by most of the analysed models. Replacing the category “optimised” with the categories “predictive” and “adaptive” emphasises that, in the authorial model, the highest maturity level is not understood as a target state—optimal and static—but as the system’s capacity for continuous adjustment to a changing risk profile, corresponding to a dynamic rather than a purely ordinal understanding of maturity.

To position the novelty of RMMA-W4.0 established qualitatively above in a directly comparable form, Table 18 benchmarks the method against the reference models on four criteria: evaluation object, dimension setting, output form, and resilience correlation ability.

Table 18. Benchmarking matrix of RMMA-W4.0 against reference maturity models. Source: Author’s own elaboration.

Model	Evaluation Object	Dimension Setting	Output Form	Resilience Correlation Ability
RMMA-W4.0 (this article)	Warehouse 4.0 (cyber-socio-technical warehouse)	7 risk management dimensions (D1–D7), 5 levels each	Weighted quantitative score + qualitative cross-mapping with 6 resilience dimensions	Direct, via a qualitative cross-mapping matrix onto 6 resilience dimensions (R1–R6)
[2]	Logistics processes (general)	5 areas: knowledge, risk assessment, process risk management, cooperation at risk, risk monitoring	Two-stage assessment; global maturity index	None—focuses on risk management maturity, not process resilience
[36]	Warehouse (general performance, not risk-specific)	De Bruin 6-phase model (scope/design/populate/test/deploy/maintain)	Delphi expert panel	None—addresses operational maturity, not risk or resilience
[37]	Warehouse (3PL)	Operational dimensions (e.g., putaway, picking) related to efficiency	Survey; continuous and categorical variables	None—examines maturity–efficiency association, not resilience
[19]	Supply chain (SCRM)	3 dimensions: Risk Management Orientation, ERM Integration, SC Risk Collaboration	Fuzzy TOPSIS classification into predefined levels	Indirect–via risk management integration, no separate resilience dimension
[38]	Supply chain (SCRM)	3 main dimensions + sub-dimensions; 25-item instrument	EFA/CFA; cluster analysis (leaders/followers/laggards)	None—addresses SC risk management maturity, not process resilience
[39]	Tier-1 suppliers, automotive sector	Expert-panel-weighted criteria (Delphi + Likert scale)	Self-assessment questionnaire	None

None of the benchmarked models combines, in a single instrument, (a) a risk management maturity assessment specific to the cyber-socio-technical Warehouse 4.0 environment and (b) a direct, structured mechanism translating a maturity profile into a differentiated process resilience profile. The SCRM-oriented models [19,38] offer a higher degree of empirical validation than RMMA-W4.0 at its present stage of development, but do not treat process resilience as a distinct output dimension.

5.2. Discussion of the Results Obtained from the Implementation of the RMMA-W4.0 Method at a Real Facility

The case study carried out makes it possible to address three issues significant from the point of view of the cognitive and applied value of the proposed RMMA-W4.0 method: (1) the validity of the method’s three-layer structure relative to existing approaches to risk management maturity assessment, (2) the implications arising from the discrepancy between technical and organisational maturity revealed at the analysed facility, and (3) the limitations of the adopted approach, which set the directions for further research.

5.2.1. The Added Value of the Method’s Three-Layer Structure

Existing risk management maturity models, including those modelled on the CMMI structure, typically focus on assessing risk management dimensions as an end in itself, without relating the result obtained to a specific operational effect, namely the process’s capacity to survive and continue operating under conditions of disruption. The integration proposed in this paper of the maturity assessment model with the resilience components by means of matrix analysis represents an attempt to fill this gap. The results of the case study confirm the practical usefulness of this approach: the aggregated maturity index alone (M_w = 2.60) did not reveal which of the six resilience dimensions were weakest at the analysed facility, and this information could only be obtained at the stage of applying the cross-mapping matrix. The decomposition of the assessment into a maturity profile and the resilience profile derived from it should therefore be regarded as a significant methodological element, enabling the transition from a diagnosis of the state of risk management practices to conclusions of an operational nature, directly useful to those managing the facility.

5.2.2. The Discrepancy Between Technical and Organisational Maturity

The maturity profile obtained in the case study revealed a clear asymmetry between dimension D4 (vulnerability assessment and monitoring), which achieved the highest level in the analysed set, and dimensions D2, D5, D6 and D7, assessed at the basic level. This result remains consistent with observations formulated in the literature on the implementation of Industry 4.0 technologies, which indicate that existing research and implementation practice have concentrated predominantly on the technological layer, largely neglecting the human factor in the systems being designed, which leads to lower-than-expected operational effectiveness [40]. This asymmetry reinforces the broader proposition that technological advancement should not be interpreted as organisational transformation in itself; rather, its operational value depends on complementary human and organisational capabilities [41]. This conceptual interpretation is compatible with broader digital-transformation evidence, where digital and organisational mechanisms have been shown to play differentiated roles in transformation processes.

It is significant that, in the analysed case, the high maturity level of dimension D4 translated into an increase in only one resilience dimension (R1—anticipation of disruptions), without compensating for the low level of the remaining resilience dimensions. This observation suggests that, in highly automated environments such as the analysed AS/RS-class facility, the capacity to anticipate disruptions is not a sufficient condition for process resilience—it requires supplementation with the capacity to actually operate under conditions of limited automation availability, which corresponds in the method to dimension R4. This is of particular significance in facilities with a high storage height, where physical, manual access to resources is by definition limited, and where, consequently, the capacity for early detection of a disruption does not automatically translate into the capacity to absorb it or to continue the process in degraded mode.

5.2.3. Implications for Managers of Warehouse 4.0 Facilities

From a practical perspective, the result of the case study indicates that investments in the development of monitoring and prediction systems, although justified and highly rated within the maturity model, should not be treated as a sufficient mechanism for building process resilience. The recommendations formulated on the basis of the analysed profile—relating primarily to dimensions D5 and D6—indicate that strengthening the resilience of highly automated warehouses requires the parallel development of business continuity procedures and of staff competencies for working under emergency conditions, irrespective of the level of technological advancement of the infrastructure itself. The RMMA-W4.0 method, through the application of the cross-mapping matrix, makes it possible to formulate such recommendations in a targeted manner—indicating the specific maturity dimensions requiring strengthening in relation to a specific, poorly assessed resilience dimension, rather than being limited to a general postulate of improving risk management.

5.2.4. Study Limitations and Directions for Further Research

The case study presented is illustrative in nature and has limitations that should be taken into account when interpreting the results obtained. First, the maturity levels adopted for the individual dimensions D1–D7 and the contribution coefficients c_ij applied in the cross-mapping matrix are specific in character, established for the specificity of the studied facility. The numerical results obtained in the case study should therefore be treated as a demonstration of the method’s operation, rather than as a form of its scientific validation. Second, the adopted method of determining the weights w_i and the coefficients c_ij, despite the definition of universal principles for their assignment, retains a certain margin of subjectivity. In the presented case study, both the weights and the contribution coefficients were established through a working consultation between the author and a single practitioner expert (the manager of the assessed facility), aimed at verifying the correctness of the assumptions adopted for the model, rather than through a formalised, multi-expert scoring procedure. Also, no internal validity test across facilities of different scale and business profile, and no inter-rater consistency analysis for multiple evaluators assessing the same warehouse, have been conducted. Similarly, the five-level criteria defined for the seven maturity dimensions were derived primarily from the author’s synthesis of the literature and standards (in particular ISO 31000:2018), rather than from independent expert validation at the present stage of model development. The cross-mapping matrix likewise remains purely qualitative, using a three-level, two-tier association scale (●/◐/empty). No quantitative analysis of potential collinearity or mutual interference between the maturity dimensions has been performed, since no quantitative data enabling such an analysis are yet available. Accordingly, the challenge of increasing the objectivity of their determination could be taken up through the application of structured group decision-making techniques, such as, for example, the Analytic Hierarchy Process (AHP), applied by an implementation team comprising multiple independent assessors. This would make it possible to establish a universal standard for use by teams that are just beginning to apply the RMMA-W4.0 method, and would enable a quantitative analysis of collinearity and mutual interference between dimensions D1–D7 and R1–R6 on a larger sample of warehouses. Third, the proposed method, in its current form, concludes its operation at the stage of determining the resilience profile and identifying the areas requiring strengthening. It does not include a gap analysis between the actual level and the required level, the determination of which requires a separate methodology based on an analysis of process criticality and downtime tolerance specific to a given facility. The development of such a methodology, together with associated decision rules assigning the size of the identified gap to corresponding improvement actions, will constitute the main direction of the author’s further research. A further direction for research remains the empirical validation of the method on a sample of real warehouse facilities, making it possible to verify the accuracy of the adopted cross-mapping matrix and the stability of the resilience profiles obtained under conditions of real operational variability.

5.2.5. Boundary Conditions for the Aggregation Index and the Influence of External Supply Chain Disruptions

The weighted maturity index (Mw) and the resilience-dimension levels (C_j) computed in Layer 2 and Layer 3 are compensatory by construction: a low score on one dimension can be offset by higher scores on others within the same weighted sum. It is therefore necessary to identify the conditions under which this compensatory aggregation loses interpretive value. Two scenarios call for abandoning reliance on the aggregated indices in favour of the underlying dimension-level profile. First, a high compensability risk between dimensions arises when a critically low score on a single dimension is masked by high scores on the remaining dimensions within the same weighted sum, so that the aggregated result no longer signals the presence of a severe, isolated weakness. Second, aggregation loses interpretive value when a dimension with a comparatively low score exerts a disproportionately large influence on critical intralogistics functions, such that its practical impact on process continuity is far greater than its numerical weight in the index would suggest. In both scenarios, the composite index (Mw or C_j) should be treated as a summary indicator only, and decision-making should instead rely on the disaggregated maturity and resilience profiles. This boundary-condition analysis is presented here as a conceptual, design-level heuristic rather than as an empirically validated decision rule.

A further boundary condition concerns the method’s scope. The RMMA-W4.0 method, as currently formulated, concentrates on risk sources and resilience capabilities internal to the warehouse process and does not directly incorporate disturbances originating upstream or downstream in the supply chain—such as supplier failures, transport disruptions, or demand shocks propagating from adjacent supply chain links. Such external disturbances can materially affect the intralogistics service process even where internal risk management maturity is high, since some resilience-relevant contingencies (e.g., the availability of alternative suppliers or carriers) lie outside the warehouse’s direct control. Extending the risk source map and the resilience dimensions to explicitly capture upstream/downstream supply chain disturbances, and examining how such external shocks interact with the internally oriented maturity and resilience profiles developed here, constitutes a relevant direction for future development of the method.

6. Conclusions

The aim of this paper was to design a risk management maturity assessment method aimed at supporting the resilience of the intralogistics service process in a Warehouse 4.0 environment. In response to this aim, a three-layer RMMA-W4.0 (Risk Management Maturity Assessment for Warehouse 4.0) method was developed, integrating a risk source map, a maturity assessment model, and intralogistics service process resilience components by means of matrix analysis (cross-mapping).

The proposed method fills a gap identified in the existing literature, in which risk management maturity models treat the assessment of managerial practices as an end in itself, without relating its result to a specific operational effect in the form of the process’s capacity to function under conditions of disruption. The solution adopted decomposes the assessment into two complementary profiles, linked through the cross-mapping mechanism detailed in Section 4.2, Section 4.3 and Section 4.4. This approach makes it possible not only to determine the maturity level of risk management practices, but also to indicate which of these practices most strongly condition specific resilience capabilities of the process, and thus which areas require priority strengthening. The present findings demonstrate the analytical feasibility and diagnostic potential of RMMA-W4.0 in one operational context; they do not yet establish the general validity, reliability, or predictive accuracy of the method across Warehouse 4.0 facilities.