The organization decides where they need to be based on business goals. Not every process needs to be Level 5.
The assessor assigns a level based on the evidence. For example, if a process is documented but staff are not following the documentation, the process might be rated or Level 2 (Managed) depending on consistency. cobit maturity levels