COSO企业风险管理框架：整合战略与机遇应对

1星需积分: 35 120 浏览量更新于2024-07-19 13 收藏 3.01MB PDF 举报

COSO企业风险管理框架是一个全面的系统，旨在帮助企业有效管理风险和机遇，以提升价值创造能力。该框架于2004年发布，强调了企业风险管理的核心理念是所有经营活动都是为了满足利益相关者的期望，而不确定性和风险是这一过程中不可避免的一部分。 1. **定义**：企业风险管理是将不确定性转化为机会的过程，通过评估和应对风险，确保组织能在追求增长和目标的同时，保持稳定和可持续发展。它涉及到风险容量的协调，即管理当局需考虑组织愿意承担的风险水平来制定战略。 2. **内部环境**：内部环境是风险管理的基础，包括组织的文化、价值观、治理结构、政策和流程等，这些要素对风险的识别、评估和管理具有重大影响。 3. **目标设定**：在明确风险偏好和风险容忍度后，企业应设定清晰的战略目标，这有助于在追求业务增长和风险之间找到平衡，确保资源的有效利用。 4. **事项识别**：企业风险管理涉及持续识别可能影响组织的各种潜在事项，包括外部环境变化、市场动态、运营风险等。 5. **风险评估**：评估风险的关键在于量化和定性分析，以确定每项风险的可能性和影响程度，为决策提供依据。 6. **风险应对**：企业风险管理通过提供决策支持，帮助管理层在风险回避、降低、分担或承受之间做出选择，以最小化潜在损失。 7. **控制活动**：控制措施的实施有助于预防风险事件发生，如审计、合规性检查和内部控制程序，确保组织运营的稳定。 8. **信息与沟通**：有效的信息共享和沟通在整个风险管理过程中至关重要，包括风险报告、培训和内部交流，以便于理解和响应风险。 9. **监控**：风险管理不是一次性的任务，而是需要持续监控和调整的动态过程，确保风险控制措施的有效性。 10. **职能与责任**：每个层级和部门都需要参与到风险管理中，明确职责分工，形成风险管理的协同效应。 11. **局限性**：虽然COSO框架提供了强大工具，但企业风险管理并非万能，它依赖于管理层的支持、数据的质量和外部环境的复杂性。 12. **行动指南**：企业应结合自身的具体情况，制定适合的风险管理策略，抓住风险中的机会，优化资本配置，以实现整体价值最大化。通过COSO企业风险管理框架，企业能够更好地理解、规划和执行风险管理，从而在复杂商业环境中取得竞争优势。

这个定义反映了几个基本概念。企业风险管理是：

● 一个过程，它持续地流动于主体之内；

● 由组织中各个层级的人员实施；

● 应用于战略制订；

● 贯穿于企业，在各个层级和单元应用，还包括采取主体层级的风险组合观；

● 旨在识别一旦发生将会影响主体的潜在事项，并把风险控制在风险容量以内；

● 能够向一个主体的管理当局和董事会提供合理保证；

● 力求实现一个或多个不同类型但相互交叉的目标——它只是实现结果的一种

手段，并不是结果本身。

This definition is purposefully broad for several reasons. It captures key concepts

fundamental to how companies and other organizations manage risk, providing a basis

for application across types of organizations, industries, and sectors. It focuses

directly on achievement of objectives established by a particular entity. And, the

definition provides a basis for defining enterprise risk management effectiveness,

discussed later in this chapter. The fundamental concepts outlined above are discussed

in the following paragraphs.

这个定义之所以比较宽泛，是出于几个方面的原因。它抓住了对于公司和其

他组织如何管理风险至关重要的关键概念，为不同组织形式、行业和部门的应用

提供了基础。它直接关注特定主体既定目标的实现，并为界定将在本章后文中讨

论的企业管理的有效性提供了依据。以上所列示的基本概念将在下面各个段落予

以讨论。

A Process

一个过程

Enterprise risk management is not static, but rather a continuous or iterative interplay

of actions that permeate an entity. These actions are pervasive and inherent in the way

management runs the business.

企业风险管理并不是静止的，而是渗透于一个主体的各种活动的持续的或反

复的相互影响。这些活动渗透和潜藏于管理当局经营企业的方式之中。

Enterprise risk management is different from the perspective of some observers who

view it as something added on to an entity’s activities. That is not to say effective

enterprise risk management does not require incremental effort, as it may. In

considering credit and currency risks, for example, incremental effort may be required

to develop needed models and make necessary analyses and calculations. However,

these enterprise risk management mechanisms are intertwined with an entity’s

operating activities and exist for fundamental business reasons. Enterprise risk

management is most effective when these mechanisms are built into the entity’s

infrastructure and are part of the essence of the enterprise. By building in enterprise

risk management, an entity can directly affect its ability to implement its strategy and

achieve its mission.

企业风险管理并不像一些观察家所认为的那样是加在主体活动之上的东西。

开放•分享•共赢

www.cosox.cn

内部控制与全面风险管理俱乐部

Email：terence@cosox.cn

第 16 页，共 143 页

呆瓜梁山伯工作室【2009-07-24】

这并不是说有效的企业风险管理不要求进一步的努力，它可能会那样要求。例如，

在考虑信用和货币风险时，可能需要进一步努力去开发所需的模型和进行必要的

分析和计算。但是，这些企业风险管理机制与主体的经营活动交织在一起，为了

基本的经营理由而存在。当这些机制被构建到主体的结构之中，并成为企业核心

要件的一部分时，企业风险管理就会更加有效。通过建立企业风险管理，一个主

体能够直接影响其执行战略和实现使命的能力。

Building in enterprise risk management has important implications for cost

containment, especially in the highly competitive marketplaces many companies face.

Adding new procedures separate from existing ones adds costs. By focusing on

existing operations and their contribution to effective enterprise risk management, and

integrating risk management into basic operating activities, an enterprise can avoid

unnecessary procedures and costs. And, a practice of building enterprise risk

management into the fabric of operations helps identify new opportunities for

management to seize in growing the business.

建立企业风险管理对于抑制成本具有重要意义，尤其是在许多公司所面临的

高度竞争的市场中更是如此。在现有程序之外增加新的程序会增加成本。通过关

注现有的经营业务以及它们对有效的企业风险管理的贡献，并将风险管理整合到

基本的经营活动之中，企业就能够避免不必要的程序和成本。而且，把企业风险

管理建立在经营业务的基本构架之中的做法，可以帮助管理当局识别新的机会，

以便抓住这些机会实现业务增长。

Effected by People

由人员来实施

Enterprise risk management is effected by an entity’s board of directors, management

and other personnel. It is accomplished by the people of an organization, by what they

do and say. People establish the entity’s mission, strategy, and objectives, and put

enterprise risk management mechanisms in place.

企业风险管理由一个主体的董事会、管理当局和其他人员实施。它是通过一

个组织中的人、通过他们的言行来完成的。人制订主体的使命、战略和目标，并

使企业风险管理机制得以落实。

Similarly, enterprise risk management affects people’s actions. Enterprise risk

management recognizes that people do not always understand, communicate, or

perform consistently. Each individual brings to the workplace a unique background

and technical ability, and has different needs and priorities.

同样，企业风险管理也会影响人的行动。企业风险管理认识到人们并不总是

始终如一地理解、沟通和行动。每个人都会给工作场所带来一个独特的背景和技

术能力，他们有着不同的需要和偏好。

These realities affect, and are affected by, enterprise risk management. Each person

has a unique point of reference, which influences how he or she identifies, assesses,

and responds to risk. Enterprise risk management provides the mechanisms needed to

help people understand risk in the context of the entity’s objectives. People must

开放•分享•共赢

www.cosox.cn

内部控制与全面风险管理俱乐部

Email：terence@cosox.cn

第 17 页，共 143 页

呆瓜梁山伯工作室【2009-07-24】

know their responsibilities and limits of authority. Accordingly, a clear and close

linkage needs to exist between people’s duties and the way in which they are carried

out, as well as with the entity’s strategy and objectives.

这些现实影响企业风险管理，同时也受到企业管理的影响。每个人都有一个

独特的参照点，它影响他或她怎样去识别、评估和应对风险。企业风险管理提供

所需的机制，帮助在主体目标的背景下去理解。人们必须知道他们的责任和权力

的局限。因此，在人们的职责和他们履行职责的方式以及主体的战略和目标之间，

需要有一个而又密切的联系。

An organization’s people include the board of directors, management and other

personnel. Although directors primarily provide oversight, they also provide direction

and approve strategy and certain transactions and policies. As such, boards of

directors are an important element of enterprise risk management.

一个组织中的人包括董事会、管理当局和其他人员。尽管董事主要是提供监

督，他们也提供指导，审批战略和特定的交易与政策。因此，董事会是企业风险

管理的一个重要的要素。

Applied in Setting Strategy

应用于战略制订

An entity sets out its mission or vision and establishes strategic objectives, which are

the high-level goals that align with and support its mission or vision. An entity

establishes a strategy for achieving its strategic objectives. It also sets related

objectives it wants to achieve, flowing from the strategy, cascading to entity business

units, divisions, and processes.

一个主体设定其使命或愿景，并制订战略目标，它们是协调和支撑其使命或

愿景的高层次的目的。主体为了实现其战略目标而制订战略。它还设定所希望实

现的相关目标，上至战略，下至主体的业务单元、分部和流程。

Enterprise risk management is applied in strategy setting, in which management

considers risks relative to alternative strategies. For instance, one alternative may be

to acquire other companies in order to grow market share. Another may be to cut

sourcing costs in order to realize higher gross margin percentage. Each of these

strategic choices poses a number of risks. If management selects the first strategy, it

may have to expand into new and unfamiliar markets, competitors may be able to gain

share in the company’s existing markets, or the company might not have the

capabilities to effectively implement the strategy. With the second, risks include

having to use new technologies or suppliers, or form new alliances. Enterprise risk

management techniques are applied at this level to assist management in evaluating

and selecting the entity’s strategy and related objectives.

企业风险管理应用于战略制订之中，此时管理当局考虑与备选战略相关的风

险。举例来说，一个选择可能是收购其他公司以扩大市场份额。另一个可能是削

减采购成本以实现更高的毛利率。这些战略选择中的每一个都会带来许多风险。

如果管理当局选择第一个战略，就可能必须向新的和不熟悉的市场拓展，竞争者

开放•分享•共赢

www.cosox.cn

内部控制与全面风险管理俱乐部

Email：terence@cosox.cn

第 18 页，共 143 页

呆瓜梁山伯工作室【2009-07-24】

就可能会占取公司目前市场的份额，或者公司可能没有能力去有效地实施这一战

略。对于第二个而言，风险包括必须利用新的技术或供应商，或者建立新的联盟。

企业风险管理技术被应用在这个层次上，以帮助管理当局评价和选择该主体的战

略和相关的目标。

Applied Across the Enterprise

应用贯穿于企业

In applying enterprise risk management, an entity should consider its entire scope of

activities. Enterprise risk management considers activities at all levels of the

organization, from enterprise-level activities such as strategic planning and resource

allocation, to business unit activities such as marketing and human resources, to

business processes such as production and new customer credit review. Enterprise risk

management also applies to special projects and new initiatives that might not yet

have a designated place in the entity’s hierarchy or organization chart.

在应用企业风险管理时，主体应该考虑其全部活动。企业风险管理考虑组织

的各个层级的活动，从诸如战略和资源配置等企业层次的活动，到诸如市场营销

和人力资源等业务单元的活动，再到诸如生产和新客户信用评价等经营流程。企

业风险管理还应用于特殊项目和目前在主体的层级和组织结构图中还没有一个

明确位置的新的活动。

Enterprise risk management requires an entity to take a portfolio view of risk. This

might involve each manager responsible for a business unit, function, process, or

other activity developing an assessment of risk for the activity. The assessment may

be quantitative or qualitative. With a composite view at each succeeding level of the

organization, senior management is positioned to make a determination whether the

entity’s overall risk portfolio is commensurate with its risk appetite.

企业风险管理要求主体对风险采取组合的观念。这可能要求负责一个业务单

元、职能机构、流程或其他活动的每一名管理人员对各自的活动形成一个风险评

估。这种评估可能是定量的，也可能是定性的。高层管理当局采用复合的观念看

待组织中的所有层级，以便确定该主体的整体风险组合是否与它的风险容量相

称。

Management considers interrelated risks from an entity-level portfolio perspective.

Risks for individual units of the entity may be within the units’ risk tolerances, but

taken together may exceed the risk appetite of the entity as a whole. Or, conversely,

potential events may represent an otherwise unacceptable risk in one business unit,

but with an offsetting effect in another. Interrelated risks need to be identified and

acted on so that the entirety of risk is consistent with the entity’s risk appetite.

管理当局从主体层次组合的角度考虑相互关联的风险。主体中单个单元的风

险可能在该单元的风险容限范围之内，但是凑到一起可能会超出该主体作为一个

整体的风险容量。或者刚好相反，潜在事项在一个业务单元中可能意味着不可接

受的风险，但是在其他业务单元中存在抵消效应。相互关联的风险需要识别和发

挥作用，以便使整体风险符合主体的风险容量。

开放•分享•共赢

www.cosox.cn

内部控制与全面风险管理俱乐部

Email：terence@cosox.cn

第 19 页，共 143 页

呆瓜梁山伯工作室【2009-07-24】

Risk Appetite

风险容量

Risk appetite is the amount of risk, on a broad level, an entity is willing to accept in

pursuit of value. It reflects the entity’s risk management philosophy, and in turn

influences the entity’s culture and operating style. Many entities consider risk appetite

qualitatively, with such categories as high, moderate, or low, while others take a

quantitative approach, reflecting and balancing goals for growth, return, and risk. A

company with a higher risk appetite may be willing to allocate a large portion of its

capital to such high-risk areas as newly emerging markets. In contrast, a company

with a low risk appetite might limit its short-term risk of large losses of capital by

investing only in mature, stable markets.

风险容量是一个主体在追求价值的过程中所愿意承受的广泛意义的风险的

数量。它反映了主体的风险管理理念，进而影响主体的文化和经营风格。许多主

体采用诸如高、适中或低之类的分类定性地考虑风险容量，而其他主体则采用定

量的方法，反映和平衡增长、报酬和风险目标。具有较高风险容量的公司可能愿

意把它的大部分资本配置到诸如新兴市场等高风险领域。反过来，具有低风险容

量的公司可能会仅仅投资于成熟的、稳定的市场，以便限制其短期的巨额资本损

失风险。

Risk appetite is directly related to an entity’s strategy. It is considered in strategy

setting, as different strategies expose an entity to different risks. Enterprise risk

management helps management select a strategy that aligns anticipated value creation

with the entity’s risk appetite.

风险容量与一个主体的战略直接相关。它在战略制订过程中予以考虑，因为

不同的战略会使主体面临不同的风险。企业风险管理可以帮助管理当局选择一个

将期望的价值创造与主体的风险容量相协调的战略。

Risk appetite guides resource allocation. Management allocates resources among

business units and initiatives with consideration of the entity’s risk appetite and the

unit’s plan for generating desired return on invested resources. Management considers

its risk appetite as it aligns its organization, people, and processes, and designs

infrastructure necessary to effectively respond to and monitor risks.

风险容量指导资源配置。管理当局通过考虑主体的风险容量和业务单元为实

现投入资源的期望报酬而制订的计划，把资源配置到业务单元和活动之中。管理

当局考虑容量，使其与组织、人员和流程相适应，并设计的基础结构以便有效地

应对和监控风险。

Risk tolerances relate to the entity’s objectives. Risk tolerance is the acceptable level

of variation relative to achievement of a specific objective, and often is best measured

in the same units as those used to measure the related objective.

风险容限与主体的目标相关。风险容限是相对于实现一项具体目标而言，可

以接受的偏离程度，它通常最好采用那些与度量相关目标相同的单位进行度量。

In setting risk tolerance, management considers the relative importance of the related

开放•分享•共赢

www.cosox.cn

内部控制与全面风险管理俱乐部

Email：terence@cosox.cn

第 20 页，共 143 页

呆瓜梁山伯工作室【2009-07-24】

剩余142页未读，继续阅读

Abney

粉丝: 0
资源: 1

COSO企业风险管理框架：整合战略与机遇应对

COSO企业风险管理整体框架(中文版)-2017

COSO风险管理框架中文版.pdf

COSO-ERM-FAQ 2017

coso2017风险管理中文版电子版

it risk mangement and coso

软通动力mag内控与bcg

C语言编程立体像对的空间前方交会（分别已知两像片的外方位元素和内方位元素）的严密共线方程计算窗口程序

COSO-基于2017ERM的环境、社会和治理风险管理框架-2018.2.pdf

COSO内部控制新框架2013版

coso内部控制呆瓜系列

最新资源