ISO31000风险管理标准中文版-翻译(DOC55页)

1、ISO31000 风险管理标准中文版-翻译（DOC 55页 ）ISO/FDIS31000Risk management Principles and guidelinesForeword 前言ISO （the International Organization for Standardization） is a worldwide f ederation of national standards bodies（ISO member bodies）. The work of pre paring International Standards is normally carried out

2、through ISO technical committees. Each member body interested in a subject for which a technical committee has been established has the right to be represented on that com mittee. International organizations, governmental andnot-governmental, in liais on with ISO, also take part in the work. ISO col

3、laborates closely with theIn ternational Electrotechnical Commission （IEC） on all matters of electrotechnic al standardization.国际标准化组织（ISO）是各国标准化团体（ISO成员团体）组成的世界 性的联合汇。制定国际标准工作通常由ISO的技术委员会完成。个成员团体 若对某技术委员会确定的项目感爱好，均由权参加该委员会的工作。与ISO保持联系的各国际组织（官方的或非官方的）也可参加有关工作。ISO与国际电工委员会（IEC）在电工技术标准化方面保持紧密合作的关系。Inte

4、rnational Standards are drafted in accordance with the rules given in the ISO/IEC Directives, Part 2.国际标准是按照ISO/IEC 导则第 2部分的规则起草的。The main task of technical committees is to prepare International Standa rds. Draft International Standards adopted by the technical committees are cir culated to the mem

5、ber bodies for voting. Publication as an International Stan dard requires approval by at least 75 % of the member bodies casting a vot e.由技术委员会通过的国际标准草案提交各成员团体投票表决，需取得了至少 3/4参加表决的成员团体的同意，国际标准草案才能作为国际标准证实公布。Attention is drawn to the possibility that some of the elements of this document may be the su

6、bject of patent rights. ISO shall not be held respons ible for identifying any or all such patent rights.本标准中的某些内容有可能涉及一些专利权咨询题，这一点应引起注意，ISO 不负责识不任何如此的专利权咨询题。ISO 31000 was prepared by the ISO Technical Management Board Wor king Group on risk management.ISO 31000由ISO技术治理委员会风险治理工作组编写。Introduction 简介Or

7、ganizations of all types and sizes face internal and external factors an d influences that make it uncertain whether and when they will achieve their objectives. The effect this uncertainty has on an organization's objectives is “ risk” .所有类型和规模的组织都面临内部和外部因素的阻碍，使得它不能确定是否及何时实现其目标。这种对一个组织的目标阻碍的不确定

8、性既是“风险”。All activities of an organization involve risk. Organizations manage risk by identifying it, analysing it and then evaluating whether the risk should b e modified by risk treatment in order to satisfy their risk criteria.一个组织的所有活动都涉及风险。组织通过识不、分析、 评判风险以及处理风险，以满足他们的风险标准。Throughout this process

9、, they communicate and consult with stakeholder s and monitor and review the risk and the controls that are modifying the ri sk in order to ensure that no further risk treatment is required. This Internati onal Standard describes this systematic and logical process in detail.在那个过程中，他们与利益有关者沟通协商，监测和审

10、查风险操纵，并持续的修正风险，以确保风险处理不再是必需的。本标准详细描述了这一系统的和符合逻辑的过程。While all organizations manage risk to some degree, this International S tandard establishes a number of principles that need to be satisfied to make risk management effective. This International Standard recommends that orga nizations develop, impl

11、ement and continuously improve a framework whose purpose is to integrate the process for managing risk into the organization's overall governance, strategy and planning,management, reporting processes,p olicies, values and culture.尽管所有的组织在某种程度上都在治理风险，本标准规定了一些原则，以使风险治理变得有效。本标准建议，组织制定，实施和持续完善的框架，其

12、目的是将风险治理纳入到组织的治理，战略和规划，治理，报告程序，政策，价 值观和文化等综合治理的整个过程。Risk management can be applied to an entire organization, at its many areas and levels, at any time, as well as to specific functions, projects and a ctivities.风险治理能够应用到整个组织，它的许多领域和层次，在任何时刻，以及具体职能，项目和活动。Although the practice of risk management has

13、been developed over time and within many sectors in order to meet diverse needs, the adoption of co nsistent processeswithin a comprehensive framework can help to ensure that risk is managed effectively, efficiently and coherently across an organizatio n. The generic approach described in this Inter

14、national Standard provides the principles and guidelines for managing any form of risk in a systematic, tra nsparent and credible manner and within any scope and context.尽管在过去这段时刻内的许多部门，以满足不同的需要的风险治理的做法是成熟的，然而通过采纳一致性流程的综合框架有助于确保风险治理的有效性， 同时有效和连贯整个组织。在本标准规定的一样性的原则和方针，目的在于在任何的环境和背景下，系统的、清晰的、可靠的方式治理风险。

15、Each specific sector or application of risk management brings with it in dividual needs, audiences, perceptions and criteria. Therefore, a key feature o f this International Standard is the inclusion of “ establishing the context” a s an activity at the start of this generic risk management process.

16、 Establishin g the context will capture the objectives of the organization, the environment in which it pursues those objectives, its stakeholders and the diversity of ri sk criteria - all of which will help reveal and assessthe nature and compl exity of its risks.每一个具体部门或风险治理的应用都产生了独自的需要，受众， 观念和标准。

17、因此，这一国际标准的要紧特点是将风险治理“环境建设”列入其治理过程的开始活动。环境建设方面将捕捉该组织的目标，它所追求目标的环境，它的利益有关者和风险标准的多样性，所有这些都将关心揭示和评估风险的性质和复杂性。The relationship between the principles for managing risk, the framewor k in which it occurs and the risk management process described in this Inte rnational Standard are shown in Figure 1.本标准描述了

18、风险治理的原则、框架、 风险治理的流程之间的关系，如图1 所示。When implemented and maintained in accordance with this International Standard, the management of risk enables an organization to, for example:当按照这一国际标准实施和爱护时，风险的治理者需使一个组织加大，例如：? increase the likelihood of achieving objectives; 增加实现目标的可能性? encourage proactive manageme

19、nt; 鼓舞主动性治理;? be aware of the need to identify and treat risk throughout the organi zation; 在组织中，意识到识不和对待风险的需要;? improve the identification of opportunities and threats; 提升的机会和威逼识不能力? comply with relevant legal and regulatory requirements and internatio nal norms; 符合有关法律及监管要求和国际规范? improve financial

20、 reporting; 改进财务报告? improve governance; 改善治理? improve stakeholder confidence and trust; 提升利益有关者的信心和信任? establish a reliable basis for decision making and planning; 建立决策和规划提供可靠的根基? improve controls;力口大操纵? effectively allocate and use resources for risk treatment; 有效地分配和使用资源处理风险? improve operational e

21、ffectiveness and efficiency; 提升运营的成效和效率? enhance health and safety performance, as well as environmental pro tection; 加大健康和安全业绩，以及环境的爱护;? improve loss prevention and incident management; 改善防损和事件治理? minimize losses; 减少缺失? improve organizational learning; and 提升组织的学习能力? improve organizational resilien

22、ce. 提升组织的应变能力This International Standard is intended to meet the needs of a wide range of stakeholders, including: 本标准是为了满足宽敞利益有关者需要，包括：a) those responsible for developing risk management policy within their organization;a)开发者对其机构内的风险治理政策负责；b) those accountable for ensuring that risk is effectively

23、managed within the organization as a whole or within a specific area, project or activity;b)有人对组织作为一个整体、或者某一特定范畴、项目或者活动的风险 治理的有效性负责;c) those who need to evaluate an organization effectiveness in managing risk; andc)有人需要对风险治理评估的有效性负责；和d) developers of standards, guides, procedures and codes of practi

24、ce tha t, in whole or in part, set out how risk is to be managed within the specifi c context of these documents.d)标准，指南，程序和守则的开发者，应该对在特定的环境下风险治理 整体的或部分的文件得以实施负责；The current management practices and processes of many organizations i nclude components of risk management, and many organizations have a

25、lready adopted a formal risk management process for particular types of risk or ci rcumstances. In such cases, an organization can decide to carry out a critical review of its existing practices and processesin the light of this Internation al Standard.目前许多组织的治理实践和流程包括风险治理的组成部分，同时许多组织对专门类型的风险或环境下差不多

26、采纳了正式的风险治理流程。在这种情形 下，组织能够在本标准下开展对其现有的做法和程序严格审查。In this International Standard, the expressions “ risk managemen” t and “ managing risk” are both used. In general terms, “ risk managemen”t ref ers to the architecture (principles, framework and process) for managing risks effectively, while “ managing

27、 risk” refers to applying that architecture to p articular risks.在本国际标准中，“风险治理”和“治理风险”同时使用。一样来讲，“风 险治理”是指治理风险的有效性架构（原则，框架和流程），而“治理风险” 是指运用该架构治理特定风险。a) Creates' valueb) Integral part &t Organkzatioma) processesMandatamudcommitment *4-21Part of <d«ciiii0n makingd) Explicitly addresses

28、uncertainty&l SystomaUe. filruclured and timelyf Bas«di on th« best available informal iong Tal* lore dhj Tak+事 liu«Ti>hi 力力4 cunurvl hKtm i nto accounli) Tran4par-Hnt Hind iinczlur整Imj) lDynnim4Cu itoratliva and rqisponsivQi t。*h 口k，PaGilitates continuall imprnvemeil and eriha

29、ncoriierit of the arganizDtionPrinciples for mnngingrisk(Clauso 3)Framework for managingrisk(Clau» 4)Ri»k awe。喋零wet(S4JEstnbliBhirkg 1th« context (53)CM6) 84 号HC8ME £9= uenEUJOuRlik Identiflcalion (5.4.2) 4Ri主k 总r18aliys话(5_4-3)卜Riisk tranimont (5 5)*-Risk evaluation(544)Precess

30、fewr managing risk(Glause 5)Figure 1 Relationships between the risk management principles, framework and processRisk management Principles and guidelines风险治理-原则和指导方针1 Scope范畴This International Standard provides principles and generic guidelines on risk management.本标准提供了风险治理的原则和一样准则。This Internationa

31、l Standard can be used by any public, private or comm unity enterprise, association, group or individual. Therefore, this InternationalStandard is not specific to any industry or sector.本标准可用于任何公共，私人或社区组织，协会，团体或个体。因此，那 个国际标准是不针对专门行业或部门。NOTE For convenience, all the different users of this Internatio

32、nal Stan dard are referred to by the general term “ organization” .为方便起见，本国际标准提到的所有不同的用户通用术语为“组织”。This International Standard can be applied throughout the life of an org anization, and to a wide range of activities, including strategies and decision s, operations, processes,functions, projects, pro

33、ducts, services and assets.本标准可用于整个组织生活及各种活动，包括战略和决策，运营，流程， 职能，范畴广泛的项目，产品，服务和资产。This International Standard can be applied to any type of risk, whatever its nature, whether having positive or negative consequences.本标准能够适用于任何类型的风险，不管其性质是否有主动或消极的后 果。Although this International Standard provides generi

34、c guidelines, it is no t intended to promote uniformity of risk management across organizations. T he design and implementation of risk management plans and frameworks wil l need to take into account the varying needs of a specific organization, its particular objectives,context, structure, operatio

35、ns, processes,functions, project s, products, services, or assets and specific practices employed.尽管本国际标准提供了风险治理的一样准则，但不是为了促进各组织风险治理的统一性。设计和风险治理打算和框架的实施需要考虑到特定组织的不同需要，具体做法受其特定的目标，环境，结构，业务，流程，功能，项目，产品，服务或资产等阻碍。It is intended that this International Standard be utilized to harmonize ri sk management p

36、rocessesin existing and future standards. It provides a com mon approach in support of standards dealing with specific risks and/or sect ors, and does not replace those standards.本国际标准目的是用来和谐风险治理与现有的和以后的标准之间的流程。它提供了一个支持处理特定风险和/或部分风险的通用方法，而不是取代这些标准。This International Standard is not intended for the

37、purpose of certificatio n.本标准不适合认证目的。2 Terms and definitions 术语和定义For the purposes of this document, the following terms and definitions apply.下列术语和定义适用本文件。2.1 risk 风险effect of uncertainty on objectives不确定性对目标的阻碍NOTE 1 An effect is a deviation from the expected positive and/or negative.注 1：阻碍是与预期的偏差

38、主动和/或消极NOTE 2 Objectives can have different aspects (such as financial, health and safety, and environmental goals) and can apply at different levels (such as strategic, organization-wide, project, product and process).注 2：目标能够有不同方面(如财务，健康和安全，以及环境目标)，能够体现在不同的层次(如战略，组织范畴，项目，产品和流程)。NOTE 3 Risk is ofte

39、n characterized by reference to potential events (2. 19) and consequences(2.20), or a combination of these.注 3： 风险通常被描述为潜在事件( 2.19) 和后果 ( 2.20) ， 或它们的组合。NOTE 4 Risk is often expressed in terms of a combination of the cons equences of an event (including changes in circumstances) and the associated l

40、ikelihood (2.21) of occurrence.注 4：风险往往表达了对事件后果(包括环境的变化)和有关的可能性概率(2.21) 。NOTE 5 Uncertainty is the state, even partial, of deficiency of informat ion related to, understanding or knowledge of an event, its consequence,or l ikelihood.ISO Guide 73:2009, definition 1.12.2 risk management风险治理coordinated

41、 activities to direct and control an organization with regard t o risk (2.1)一个组织对风险的指挥和操纵的一系列和谐活动ISO Guide 73:2009, definition 2.12.3 risk management framework 风险治理框架set of components that provide the foundations and organizational arrang ements for designing, implementing,monitoring (2.30), reviewi

42、ng and continua lly improving risk management (2.2) throughout the organization组织对风险治理的设计、实施、 监控、 检查和连续改进等进行的一系列基础的组织安排NOTE 1 The foundations include the policy, objectives, mandate and co mmitment to manage risk (2.1).基础包括治理风险的政策、目标、任务和承诺NOTE 2 The organizational arrangementsinclude plans, relation

43、ships, ac countabilities, resources, processesand activities.组织安排包括打算、关系、职 责、资源、流程和活动NOTE 3 The risk management framework is embedded within the organ ization's overall strategic and operational policies and practices 风险治理框架 被植入到组织的整个战略和运营的战略和实践中ISO Guide 73:2009, definition 2.1.12.4 risk manage

44、ment policy 风险治理政策statement of the overall intentions and direction of an organization relate d to risk management (2.2) 一个组织对风险治理的意图和指导方向的陈述ISO Guide 73:2009, definition 2.1.22.5 risk attitude 风险态度organization's approach to assessand eventually pursue, retain, take or t urn away from risk (2.1)

45、组织评估、追求、保留、采取或躲开风险的处理手段ISO Guide 73:2009, definition 3.7.1.12.6 risk appetite风险偏好amount and type of risk (2.1) that an organization is prepared to pursu e, retain or take一个组织追求、保留或采取风险的数量和类型ISO Guide 73:2009, definition 3.7.1.22.7 risk aversion 风险规避attitude to turn away from risk (2.1)躲开风险的态度ISO Gui

46、de 73:2009, definition 3.7.1.42.8 risk management plan 风险治理打算scheme within the risk management framework (2.3) specifying the appr oach, the management components and resources to be applied to the manag ement of risk (2.1)为风险治理框架方案指定方法、治理措施、资源以用于治理风险NOTE 1 Management components typically include pr

47、ocedures, practice s, assignment of responsibilities, sequence and timing of activities.治理措施 一样包括程序、做法、职责分配、序列和及时的行动NOTE 2 The risk management plan can be applied to a particular prod uct, process and project, and part or whole of the organization.风险治理打算 适用于特定的产品、流程和项目、部分或整个组织ISO Guide 73:2009, defi

48、nition 2.1.32.9 risk owner 风险所有者person or entity with the accountability and authority to manage the ris k (2.1)对风险治理持有权力和责任的个人或实体ISO Guide 73:2009, definition 3.5.1.42.10 risk management process风险治理流程systematic application of management policies, procedures and practices to the activities of commun

49、icating,consulting, establishing the context, and id entifying, analyzing, evaluating, treating, monitoring (2.30) and reviewing risk (2.1)系统的应用治理政策，程序和沟通协商，在建立的风险治理环境下，识不，分析，评判，处理，监测和审查风险ISO Guide 73:2009, definition 3.12.11 establishing the context 环境建设defining the external and internal parameters

50、 to be taken into account w hen managing risk, and setting the scope and risk criteria (2.24) for the risk management policy (2.4)界定风险治理应该考虑的外部和内部参数，并设置风险治理政策的范畴和风险的标准ISO Guide 73:2009, definition 3.3.12.12 external context 外部环境external environment in which the organization seeks to achieve its obje

51、 ctivesNOTE External context can include:外部环境包括? the cultural, social, political, legal, regulatory, financial, technological, economic, natural and competitive environment,whether international, nationa l, regional or local;文化、社会、政治、法律、监管、财政金融、技术、经济、 自然和竞争环境，不管是国际，国家，区域或地点? key drivers and trends h

52、aving impact on the objectives of the organi zation; and阻碍该组织的要紧驱动和趋势? relationships with, and perceptions and values of, external stakeholde rs (2.15).与外部利益有关者之间的关系和价值观ISO Guide 73:2009, definition 3.3.1.12.131 nternal context 内部环境internal environment in which the organization seeks to achieve its

53、obje ctivesNOTE Internal context can include:内部环境包括? governance, organizational structure, roles and accountabilities;治理、组织结构、角色和责任? policies, objectives, and the strategies that are in place to achieve th em;政策、目标、实现目标的战略? the capabilities, understood in terms of resources and knowledge (e.g. capit

54、al, time, people, processes,systems and technologies);能力、资源和知识(如资本、时刻、人、流程、系统和技术)? perceptions and values of internal stakeholders内部禾1J益有关者的价 值观? information systems, information flows and decision-making processes (both formal and informal); 信息系统、信息流和(正式的和非正式的)决策流程? relationships with, and percepti

55、ons and values of, internal stakeholder s;内部利益有关者价值观之间的关系? the organization's culture;组织文化? standards, guidelines and models adopted by the organization; and 标 准、指引和组织采纳的模式? form and extent of contractual relationships.合同关系的形成和范畴ISO Guide 73:2009, definition 3.3.1.22.132 ommunication and consult

56、ation 沟通和协商continual and iterative processes that an organization conducts to provid e, share or obtain information and to engage in dialogue with stakeholders (2.15) and others regarding the management of risk (2.1)一个组织提供，共享或猎取信息，与利益有关者和其他风险治理者连续和反复对话的流程NOTE 1 The information can relate to the exis

57、tence, nature, form, likeli hood (2.21), severity, evaluation, acceptability,treatment or other aspects of th e management of risk.信息涉及存在、性质、形式、可能性、严峻程度、评判、 可同意性、处理或者其他与治理风险有关的方面NOTE 2 Consultation is a two-way process of informed communication between an organization and its stakeholders or others

58、on an issue prior to making a decision or determining a direction on a particular issue. Consultati on is:协商是一个组织与它的利益有关者或其他利益有关者双向沟通的过程，目的在于就以咨询题提早做出决策或就某一咨询题决定方向。协商是：? a process which impacts on a decision through influence rather than power; and通过阻碍而非权力阻碍决策的过程? an input to decision making, not joint deci