2022年ISO_FDIS_31000_风险管理最终发布版中文翻译稿.doc

《2022年ISO_FDIS_31000_风险管理最终发布版中文翻译稿.doc》由会员分享，可在线阅读，更多相关《2022年ISO_FDIS_31000_风险管理最终发布版中文翻译稿.doc（40页珍藏版）》请在淘文阁 - 分享文档赚钱的网站上搜索。

1、ISO/FDIS 31000:2009(E)iv ISO 2009 All rights reserved本版本由YH.Liu整理，非专业翻译版。未防止理解偏向，对有异议的中文部分，请参考原文。INTERNATIONAL STANDARD ISO/FDIS31000Risk management Principles and guidelinesForeword前言ISO (the International Organization for Standardization) is a worldwide federation of national standards bodies(ISO

2、member bodies). The work of preparing International Standards is normally carried out through ISO technical committees. Each member body interested in a subject for which a technical committee has been established has the right to be represented on that committee. International organizations, govern

3、mental andnot-governmental, in liaison with ISO, also take part in the work. ISO collaborates closely with theInternational Electrotechnical Commission (IEC) on all matters of electrotechnical standardization.国际标准化组织（ISO）是各国标准化团体（ISO成员团体）组成的世界性的结合汇。制定国际标准工作通常由ISO的技术委员会完成。个成员团体假设对某技术委员会确定的工程感兴趣，均由权参加

4、该委员会的工作。与ISO保持联络的各国际组织（官方的或非官方的）也可参加有关工作。ISO与国际电工委员会（IEC）在电工技术标准化方面保持亲密合作的关系。International Standards are drafted in accordance with the rules given in the ISO/IEC Directives, Part 2.国际标准是依照ISO/IEC导则第2部分的规则起草的。The main task of technical committees is to prepare International Standards. Draft Internat

5、ional Standards adopted by the technical committees are circulated to the member bodies for voting. Publication as an International Standard requires approval by at least 75 % of the member bodies casting a vote.由技术委员会通过的国际标准草案提交各成员团体投票表决，需获得了至少3/4参加表决的成员团体的同意，国际标准草案才能作为国际标准证明发布。Attention is drawn t

6、o the possibility that some of the elements of this document may be the subject of patent rights. ISO shall not be held responsible for identifying any or all such patent rights.本标准中的某些内容有可能涉及一些专利权咨询题，这一点应引起留意，ISO不负责识别任何如此的专利权咨询题。ISO 31000 was prepared by the ISO Technical Management Board Working G

7、roup on risk management.ISO 31000由ISO技术治理委员会风险治理工作组编写。Introduction简介Organizations of all types and sizes face internal and external factors and influences that make it uncertain whether and when they will achieve their objectives. The effect this uncertainty has on an organizations objectives is “ri

8、sk”.所有类型和规模的组织都面临内部和外部要素的妨碍，使得它不能确定是否及何时实现其目的。这种对一个组织的目的妨碍的不确定性既是“风险”。All activities of an organization involve risk. Organizations manage risk by identifying it, analysing it and then evaluating whether the risk should be modified by risk treatment in order to satisfy their risk criteria.一个组织的所有活动都

9、涉及风险。组织通过识别、分析、评价风险以及处理风险，以满足他们的风险标准。Throughout this process, they communicate and consult with stakeholders and monitor and review the risk and the controls that are modifying the risk in order to ensure that no further risk treatment is required. This International Standard describes this systemat

10、ic and logical process in detail.在这个过程中，他们与利益相关者沟通协商，监测和审查风险操纵，并不断的修正风险，以确保风险处理不再是必需的。本标准详细描绘了这一系统的和符合逻辑的过程。While all organizations manage risk to some degree, this International Standard establishes a number of principles that need to be satisfied to make risk management effective. This Internation

11、al Standard recommends that organizations develop, implement and continuously improve a framework whose purpose is to integrate the process for managing risk into the organizations overall governance, strategy and planning,management, reporting processes, policies, values and culture.尽管所有的组织在某种程度上都在

12、治理风险，本标准规定了一些原则，以使风险治理变得有效。本标准建议，组织制定，施行和不断完善的框架，其目的是将风险治理纳入到组织的治理，战略和规划，治理，报告程序，政策，价值观和文化等综合治理的整个过程。Risk management can be applied to an entire organization, at its many areas and levels, at any time, as well as to specific functions, projects and activities.风险治理能够应用到整个组织，它的许多领域和层次，在任何时间，以及详细职能，工程和

13、活动。Although the practice of risk management has been developed over time and within many sectors in order to meet diverse needs, the adoption of consistent processes within a comprehensive framework can help to ensure that risk is managed effectively, efficiently and coherently across an organizatio

14、n. The generic approach described in this International Standard provides the principles and guidelines for managing any form of risk in a systematic, transparent and credible manner and within any scope and context.尽管在过去这段时间内的许多部门，以满足不同的需要的风险治理的做法是成熟的，但是通过采纳一致性流程的综合框架有助于确保风险治理的有效性，同时有效和连接整个组织。在本标准规

15、定的一般性的原则和方针，目的在于在任何的环境和背景下，系统的、明晰的、可靠的方式治理风险。Each specific sector or application of risk management brings with it individual needs, audiences, perceptions and criteria. Therefore, a key feature of this International Standard is the inclusion of “establishing the context” as an activity at the start

16、 of this generic risk management process. Establishing the context will capture the objectives of the organization, the environment in which it pursues those objectives, its stakeholders and the diversity of risk criteria all of which will help reveal and assess the nature and complexity of its risk

17、s.每一个详细部门或风险治理的应用都产生了单独的需要，受众，观念和标准。因而，这一国际标准的主要特点是将风险治理“环境建立”列入其治理过程的开场活动。环境建立方面将捕获该组织的目的，它所追求目的的环境，它的利益相关者和风险标准的多样性，所有这些都将协助提醒和评估风险的性质和复杂性。The relationship between the principles for managing risk, the framework in which it occurs and the risk management process described in this International Sta

18、ndard are shown in Figure 1.本标准描绘了风险治理的原则、框架、风险治理的流程之间的关系，如图1所示。When implemented and maintained in accordance with this International Standard, the management of risk enables an organization to, for example:当按照这一国际标准施行和维护时，风险的治理者需使一个组织加强，例如： increase the likelihood of achieving objectives; 增加实现目的的可能

19、性 encourage proactive management; 鼓舞主动性治理; be aware of the need to identify and treat risk throughout the organization; 在组织中，认识到识别和对待风险的需要; improve the identification of opportunities and threats; 提高的时机和威胁识别才能 comply with relevant legal and regulatory requirements and international norms; 符合有关法律及监管要

20、求和国际标准 improve financial reporting; 改良财务报告 improve governance; 改善治理 improve stakeholder confidence and trust; 提高利益相关者的决心和信任 establish a reliable basis for decision making and planning; 建立决策和规划提供可靠的根基 improve controls;加强操纵 effectively allocate and use resources for risk treatment; 有效地分配和使用资源处理风险 impr

21、ove operational effectiveness and efficiency;提高运营的效果和效率 enhance health and safety performance, as well as environmental protection; 加强健康和平安业绩，以及环境的保护; improve loss prevention and incident management; 改善防损和事件治理 minimize losses; 减少损失 improve organizational learning; and提高组织的学习才能 improve organizational

22、 resilience. 提高组织的应变才能This International Standard is intended to meet the needs of a wide range of stakeholders, including: 本标准是为了满足广大利益相关者需要，包括：a) those responsible for developing risk management policy within their organization;a）开发者对其机构内的风险治理政策负责;b) those accountable for ensuring that risk is eff

23、ectively managed within the organization as a whole or within a specific area, project or activity;b）有人对组织作为一个整体、或者某一特定范围、工程或者活动的风险治理的有效性负责;c) those who need to evaluate an organization effectiveness in managing risk; andc）有人需要对风险治理评估的有效性负责;和d) developers of standards, guides, procedures and codes o

24、f practice that, in whole or in part, set out how risk is to be managed within the specific context of these documents.d）标准，指南，程序和守则的开发者，应该对在特定的环境下风险治理整体的或部分的文件得以施行负责；The current management practices and processes of many organizations include components of risk management, and many organizations ha

25、ve already adopted a formal risk management process for particular types of risk or circumstances. In such cases, an organization can decide to carry out a critical review of its existing practices and processes in the light of this International Standard.目前许多组织的治理实践和流程包括风险治理的组成部分，同时许多组织对特别类型的风险或环境下

26、已经采纳了正式的风险治理流程。在这种情况下，组织能够在本标准下开展对其现有的做法和程序严格审查。In this International Standard, the expressions “risk management” and “managing risk” are both used. In general terms, “risk management” refers to the architecture (principles, framework and process) for managing risks effectively, while “managing risk

27、” refers to applying that architecture to particular risks.在本国际标准中，“风险治理”和“治理风险”同时使用。一般来说，“风险治理”是指治理风险的有效性架构（原则，框架和流程），而“治理风险”是指运用该架构治理特定风险。40Figure 1 Relationships between the risk management principles, framework and processRisk management Principles and guidelines风险治理-原则和指导方针1 Scope范围This Interna

28、tional Standard provides principles and generic guidelines on risk management.本标准提供了风险治理的原则和一般准则。This International Standard can be used by any public, private or community enterprise, association, group or individual. Therefore, this International Standard is not specific to any industry or sector.

29、本标准可用于任何公共，私人或社区组织，协会，团体或个体。因而，这个国际标准是不针对特别行业或部门。NOTE For convenience, all the different users of this International Standard are referred to by the general term “organization”.为方便起见，本国际标准提到的所有不同的用户通用术语为“组织”。This International Standard can be applied throughout the life of an organization, and to a

30、wide range of activities, including strategies and decisions, operations, processes, functions, projects, products, services and assets.本标准可用于整个组织生活及各种活动，包括战略和决策，运营，流程，职能，范围广泛的工程，产品，效劳和资产。This International Standard can be applied to any type of risk, whatever its nature, whether having positive or

31、negative consequences.本标准能够适用于任何类型的风险，不管其性质是否有积极或消极的后果。Although this International Standard provides generic guidelines, it is not intended to promote uniformity of risk management across organizations. The design and implementation of risk management plans and frameworks will need to take into acco

32、unt the varying needs of a specific organization, its particular objectives,context, structure, operations, processes, functions, projects, products, services, or assets and specific practices employed.尽管本国际标准提供了风险治理的一般准则，但不是为了促进各组织风险治理的统一性。设计和风险治理计划和框架的施行需要考虑到特定组织的不同需要，详细做法受其特定的目的，环境，构造，业务，流程，功能，工程

33、，产品，效劳或资产等妨碍。It is intended that this International Standard be utilized to harmonize risk management processes in existing and future standards. It provides a common approach in support of standards dealing with specific risks and/or sectors, and does not replace those standards.本国际标准目的是用来协调风险治理与现有

34、的和将来的标准之间的流程。它提供了一个支持处理特定风险和/或部分风险的通用方法，而不是取代这些标准。This International Standard is not intended for the purpose of certification.本标准不合适认证目的。 2 Terms and definitions术语和定义For the purposes of this document, the following terms and definitions apply.以下术语和定义适用本文件。2.1risk 风险effect of uncertainty on objectiv

35、es不确定性对目的的妨碍NOTE 1 An effect is a deviation from the expected positive and/or negative.注1：妨碍是与预期的偏向积极和/或消极NOTE 2 Objectives can have different aspects (such as financial, health and safety, and environmental goals) and can apply at different levels (such as strategic, organization-wide, project, pro

36、duct and process).注2：目的能够有不同方面（如财务，健康和平安，以及环境目的），能够表达在不同的层次（如战略，组织范围，工程，产品和流程）。NOTE 3 Risk is often characterized by reference to potential events (2.19) and consequences (2.20), or a combination of these.注3：风险通常被描绘为潜在事件（2.19）和后果（2.20），或它们的组合。NOTE 4 Risk is often expressed in terms of a combination

37、of the consequences of an event (including changes in circumstances) and the associated likelihood (2.21) of occurrence.注4：风险往往表达了对事件后果（包括环境的变化）和相关的可能性概率（2.21）。NOTE 5 Uncertainty is the state, even partial, of deficiency of information related to, understanding or knowledge of an event, its conseque

38、nce, or likelihood.ISO Guide 73:2009, definition 1.12.2risk management风险治理coordinated activities to direct and control an organization with regard to risk (2.1)一个组织对风险的指挥和操纵的一系列协调活动ISO Guide 73:2009, definition 2.12.3risk management framework风险治理框架set of components that provide the foundations and o

39、rganizational arrangements for designing, implementing,monitoring (2.30), reviewing and continually improving risk management (2.2) throughout the organization 组织对风险治理的设计、施行、监控、检查和持续改良等进展的一系列根底的组织安排NOTE 1 The foundations include the policy, objectives, mandate and commitment to manage risk (2.1).根底包

40、括治理风险的政策、目的、任务和承诺NOTE 2 The organizational arrangements include plans, relationships, accountabilities, resources, processes and activities.组织安排包括计划、关系、职责、资源、流程和活动NOTE 3 The risk management framework is embedded within the organizations overall strategic and operational policies and practices.风险治理框架

41、被植入到组织的整个战略和运营的战略和实践中ISO Guide 73:2009, definition 2.1.12.4risk management policy风险治理政策statement of the overall intentions and direction of an organization related to risk management (2.2) 一个组织对风险治理的意图和指导方向的陈述ISO Guide 73:2009, definition 2.1.22.5risk attitude风险态度organizations approach to assess and

42、 eventually pursue, retain, take or turn away from risk (2.1)组织评估、追求、保存、采取或避开风险的处理手段ISO Guide 73:2009, definition 3.7.1.12.6risk appetite风险偏好amount and type of risk (2.1) that an organization is prepared to pursue, retain or take一个组织追求、保存或采取风险的数量和类型ISO Guide 73:2009, definition 3.7.1.22.7risk aversi

43、on风险躲避attitude to turn away from risk (2.1)避开风险的态度ISO Guide 73:2009, definition 3.7.1.42.8risk management plan风险治理计划scheme within the risk management framework (2.3) specifying the approach, the management components and resources to be applied to the management of risk (2.1)为风险治理框架方案指定方法、治理措施、资源以用于

44、治理风险NOTE 1 Management components typically include procedures, practices, assignment of responsibilities, sequence and timing of activities.治理措施一般包括程序、做法、职责分配、序列和及时的行动NOTE 2 The risk management plan can be applied to a particular product, process and project, and part or whole of the organization.风险

45、治理计划适用于特定的产品、流程和工程、部分或整个组织 ISO Guide 73:2009, definition 2.1.32.9risk owner风险所有者person or entity with the accountability and authority to manage the risk (2.1)对风险治理持有权力和责任的个人或实体ISO Guide 73:2009, definition 3.5.1.42.10risk management process风险治理流程systematic application of management policies, proced

46、ures and practices to the activities of communicating,consulting, establishing the context, and identifying, analyzing, evaluating, treating, monitoring (2.30) and reviewing risk (2.1)系统的应用治理政策，程序和沟通协商，在建立的风险治理环境下，识别，分析，评价，处理，监测和审查风险ISO Guide 73:2009, definition 3.12.11establishing the context环境建立de

47、fining the external and internal parameters to be taken into account when managing risk, and setting the scope and risk criteria (2.24) for the risk management policy (2.4)界定风险治理应该考虑的外部和内部参数，并设置风险治理政策的范围和风险的标准ISO Guide 73:2009, definition 3.3.12.12 external context外部环境external environment in which t

48、he organization seeks to achieve its objectivesNOTE External context can include:外部环境包括 the cultural, social, political, legal, regulatory, financial, technological, economic, natural and competitive environment,whether international, national, regional or local;文化、社会、政治、法律、监管、财政金融、技术、经济、自然和竞争环境，不管是国际，国家，区域或地点 key drivers and trends having impact on the objectives of the organization; and妨碍该组织的主要驱动和趋势 relationships with, and perceptions and values of, external stakeholders (2.15).与外部利益相关者之间的关系和价值观