COSO企业风险管理框架：增强价值与应对不确定性

1星需积分: 50 172 浏览量更新于2024-07-24 收藏 867KB PDF 举报

“COSO企业风险管理框架是IT治理领域的重要参考文档，适用于CISSP和CISA等资格考试的学习。该框架详细阐述了企业如何综合管理风险，以提高企业价值和效率。” COSO（ Committee of Sponsoring Organizations of the Treadway Commission，特雷德韦委员会赞助组织）企业风险管理框架是企业界广泛采用的风险管理指导原则，旨在帮助企业理解和实施全面的风险管理过程。这一框架由九个相互关联的组成部分组成，它们共同为企业提供了一种结构化的风险管理方法。 1. **定义**：COSO框架定义了企业风险管理（Enterprise Risk Management, ERM）作为一套系统性的、全面的过程，用于识别、分析、应对和监控影响组织目标实现的各种风险。 2. **内部环境**：这是风险管理的基础，包括组织的道德价值观、结构、人员、授权和责任分配，以及风险文化。 3. **目标设定**：明确企业的战略目标和运营目标，理解风险偏好和风险承受能力，这些目标应与企业的使命和愿景相一致。 4. **事项识别**：识别可能影响目标实现的内外部事项，包括市场、技术、经济、法律等方面的变化。 5. **风险评估**：对识别出的风险进行量化或定性评估，分析其可能性和影响程度。 6. **风险应对**：制定策略来处理风险，包括风险的避免、减少、转移和接受，以达到风险容量与战略的协调。 7. **控制活动**：设计和实施控制措施，以确保业务流程的有效运行，减少错误和欺诈的可能性。 8. **信息与沟通**：确保风险信息在整个组织内准确、及时地传递，同时促进透明度和报告机制。 9. **监控**：持续监督和评估风险管理的效果，包括定期的评审和改进过程。 10. **职能与责任**：清晰定义各层级管理层和员工在风险管理中的角色和职责，确保责任的落实。 COSO ERM框架强调了风险管理不仅仅是关于避免损失，还涉及抓住机会和提高决策质量。通过这个框架，企业可以更好地管理不确定性和复杂性，优化资源配置，实现合规，保护和提升企业声誉，最终实现业绩目标。同时，它也提供了预防和应对经营意外的手段，有助于企业在面对风险时做出更明智的决策。

这个定义反映了几个基本概念。企业风险管理是：

● 一个过程，它持续地流动于主体之内；

● 由组织中各个层级的人员实施；

● 应用于战略制订；

● 贯穿于企业，在各个层级和单元应用，还包括采取主体层级的风险组合观；

● 旨在识别一旦发生将会影响主体的潜在事项，并把风险控制在风险容量以内；

● 能够向一个主体的管理当局和董事会提供合理保证；

● 力求实现一个或多个不同类型但相互交叉的目标——它只是实现结果的一种

手段，并不是结果本身。

This definition is purposefully broad for several reasons. It captures key concepts

fundamental to how companies and other organizations manage risk, providing a basis

for application across types of organizations, industries, and sectors. It focuses

directly on achievement of objectives established by a particular entity. And, the

definition provides a basis for defining enterprise risk management effectiveness,

discussed later in this chapter. The fundamental concepts outlined above are discussed

in the following paragraphs.

这个定义之所以比较宽泛，是出于几个方面的原因。它抓住了对于公司和其

他组织如何管理风险至关重要的关键概念，为不同组织形式、行业和部门的应用

提供了基础。它直接关注特定主体既定目标的实现，并为界定将在本章后文中讨

论的企业管理的有效性提供了依据。以上所列示的基本概念将在下面各个段落予

以讨论。

A Process

一个过程

Enterprise risk management is not static, but rather a continuous or iterative interplay

of actions that permeate an entity. These actions are pervasive and inherent in the way

management runs the business.

企业风险管理并不是静止的，而是渗透于一个主体的各种活动的持续的或反

复的相互影响。这些活动渗透和潜藏于管理当局经营企业的方式之中。

Enterprise risk management is different from the perspective of some observers who

view it as something added on to an entity’s activities. That is not to say effective

enterprise risk management does not require incremental effort, as it may. In

considering credit and currency risks, for example, incremental effort may be required

to develop needed models and make necessary analyses and calculations. However,

these enterprise risk management mechanisms are intertwined with an entity’s

operating activities and exist for fundamental business reasons. Enterprise risk

management is most effective when these mechanisms are built into the entity’s

infrastructure and are part of the essence of the enterprise. By building in enterprise

risk management, an entity can directly affect its ability to implement its strategy and

achieve its mission.

企业风险管理并不像一些观察家所认为的那样是加在主体活动之上的东西。

这并不是说有效的企业风险管理不要求进一步的努力，它可能会那样要求。例如，

在考虑信用和货币风险时，可能需要进一步努力去开发所需的模型和进行必要的

分析和计算。但是，这些企业风险管理机制与主体的经营活动交织在一起，为了

基本的经营理由而存在。当这些机制被构建到主体的结构之中，并成为企业核心

要件的一部分时，企业风险管理就会更加有效。通过建立企业风险管理，一个主

体能够直接影响其执行战略和实现使命的能力。

Building in enterprise risk management has important implications for cost

containment, especially in the highly competitive marketplaces many companies face.

Adding new procedures separate from existing ones adds costs. By focusing on

existing operations and their contribution to effective enterprise risk management, and

integrating risk management into basic operating activities, an enterprise can avoid

unnecessary procedures and costs. And, a practice of building enterprise risk

management into the fabric of operations helps identify new opportunities for

management to seize in growing the business.

建立企业风险管理对于抑制成本具有重要意义，尤其是在许多公司所面临的

高度竞争的市场中更是如此。在现有程序之外增加新的程序会增加成本。通过关

注现有的经营业务以及它们对有效的企业风险管理的贡献，并将风险管理整合到

基本的经营活动之中，企业就能够避免不必要的程序和成本。而且，把企业风险

管理建立在经营业务的基本构架之中的做法，可以帮助管理当局识别新的机会，

以便抓住这些机会实现业务增长。

Effected by People

由人员来实施

Enterprise risk management is effected by an entity’s board of directors, management

and other personnel. It is accomplished by the people of an organization, by what they

do and say. People establish the entity’s mission, strategy, and objectives, and put

enterprise risk management mechanisms in place.

企业风险管理由一个主体的董事会、管理当局和其他人员实施。它是通过一

个组织中的人、通过他们的言行来完成的。人制订主体的使命、战略和目标，并

使企业风险管理机制得以落实。

Similarly, enterprise risk management affects people’s actions. Enterprise risk

management recognizes that people do not always understand, communicate, or

perform consistently. Each individual brings to the workplace a unique background

and technical ability, and has different needs and priorities.

同样，企业风险管理也会影响人的行动。企业风险管理认识到人们并不总是

始终如一地理解、沟通和行动。每个人都会给工作场所带来一个独特的背景和技

术能力，他们有着不同的需要和偏好。

These realities affect, and are affected by, enterprise risk management. Each person

has a unique point of reference, which influences how he or she identifies, assesses,

and responds to risk. Enterprise risk management provides the mechanisms needed to

help people understand risk in the context of the entity’s objectives. People must

know their responsibilities and limits of authority. Accordingly, a clear and close

linkage needs to exist between people’s duties and the way in which they are carried

out, as well as with the entity’s strategy and objectives.

这些现实影响企业风险管理，同时也受到企业管理的影响。每个人都有一个

独特的参照点，它影响他或她怎样去识别、评估和应对风险。企业风险管理提供

所需的机制，帮助在主体目标的背景下去理解。人们必须知道他们的责任和权力

的局限。因此，在人们的职责和他们履行职责的方式以及主体的战略和目标之间，

需要有一个而又密切的联系。

An organization’s people include the board of directors, management and other

personnel. Although directors primarily provide oversight, they also provide direction

and approve strategy and certain transactions and policies. As such, boards of

directors are an important element of enterprise risk management.

一个组织中的人包括董事会、管理当局和其他人员。尽管董事主要是提供监

督，他们也提供指导，审批战略和特定的交易与政策。因此，董事会是企业风险

管理的一个重要的要素。

Applied in Setting Strategy

应用于战略制订

An entity sets out its mission or vision and establishes strategic objectives, which are

the high-level goals that align with and support its mission or vision. An entity

establishes a strategy for achieving its strategic objectives. It also sets related

objectives it wants to achieve, flowing from the strategy, cascading to entity business

units, divisions, and processes.

一个主体设定其使命或愿景，并制订战略目标，它们是协调和支撑其使命或

愿景的高层次的目的。主体为了实现其战略目标而制订战略。它还设定所希望实

现的相关目标，上至战略，下至主体的业务单元、分部和流程。

Enterprise risk management is applied in strategy setting, in which management

considers risks relative to alternative strategies. For instance, one alternative may be

to acquire other companies in order to grow market share. Another may be to cut

sourcing costs in order to realize higher gross margin percentage. Each of these

strategic choices poses a number of risks. If management selects the first strategy, it

may have to expand into new and unfamiliar markets, competitors may be able to gain

share in the company’s existing markets, or the company might not have the

capabilities to effectively implement the strategy. With the second, risks include

having to use new technologies or suppliers, or form new alliances. Enterprise risk

management techniques are applied at this level to assist management in evaluating

and selecting the entity’s strategy and related objectives.

企业风险管理应用于战略制订之中，此时管理当局考虑与备选战略相关的风

险。举例来说，一个选择可能是收购其他公司以扩大市场份额。另一个可能是削

减采购成本以实现更高的毛利率。这些战略选择中的每一个都会带来许多风险。

如果管理当局选择第一个战略，就可能必须向新的和不熟悉的市场拓展，竞争者

就可能会占取公司目前市场的份额，或者公司可能没有能力去有效地实施这一战

略。对于第二个而言，风险包括必须利用新的技术或供应商，或者建立新的联盟。

企业风险管理技术被应用在这个层次上，以帮助管理当局评价和选择该主体的战

略和相关的目标。

Applied Across the Enterprise

应用贯穿于企业

In applying enterprise risk management, an entity should consider its entire scope of

activities. Enterprise risk management considers activities at all levels of the

organization, from enterprise-level activities such as strategic planning and resource

allocation, to business unit activities such as marketing and human resources, to

business processes such as production and new customer credit review. Enterprise risk

management also applies to special projects and new initiatives that might not yet

have a designated place in the entity’s hierarchy or organization chart.

在应用企业风险管理时，主体应该考虑其全部活动。企业风险管理考虑组织

的各个层级的活动，从诸如战略和资源配置等企业层次的活动，到诸如市场营销

和人力资源等业务单元的活动，再到诸如生产和新客户信用评价等经营流程。企

业风险管理还应用于特殊项目和目前在主体的层级和组织结构图中还没有一个

明确位置的新的活动。

Enterprise risk management requires an entity to take a portfolio view of risk. This

might involve each manager responsible for a business unit, function, process, or

other activity developing an assessment of risk for the activity. The assessment may

be quantitative or qualitative. With a composite view at each succeeding level of the

organization, senior management is positioned to make a determination whether the

entity’s overall risk portfolio is commensurate with its risk appetite.

企业风险管理要求主体对风险采取组合的观念。这可能要求负责一个业务单

元、职能机构、流程或其他活动的每一名管理人员对各自的活动形成一个风险评

估。这种评估可能是定量的，也可能是定性的。高层管理当局采用复合的观念看

待组织中的所有层级，以便确定该主体的整体风险组合是否与它的风险容量相

称。

Management considers interrelated risks from an entity-level portfolio perspective.

Risks for individual units of the entity may be within the units’ risk tolerances, but

taken together may exceed the risk appetite of the entity as a whole. Or, conversely,

potential events may represent an otherwise unacceptable risk in one business unit,

but with an offsetting effect in another. Interrelated risks need to be identified and

acted on so that the entirety of risk is consistent with the entity’s risk appetite.

管理当局从主体层次组合的角度考虑相互关联的风险。主体中单个单元的风

险可能在该单元的风险容限范围之内，但是凑到一起可能会超出该主体作为一个

整体的风险容量。或者刚好相反，潜在事项在一个业务单元中可能意味着不可接

受的风险，但是在其他业务单元中存在抵消效应。相互关联的风险需要识别和发

挥作用，以便使整体风险符合主体的风险容量。

Risk Appetite

风险容量

Risk appetite is the amount of risk, on a broad level, an entity is willing to accept in

pursuit of value. It reflects the entity’s risk management philosophy, and in turn

influences the entity’s culture and operating style. Many entities consider risk appetite

qualitatively, with such categories as high, moderate, or low, while others take a

quantitative approach, reflecting and balancing goals for growth, return, and risk. A

company with a higher risk appetite may be willing to allocate a large portion of its

capital to such high-risk areas as newly emerging markets. In contrast, a company

with a low risk appetite might limit its short-term risk of large losses of capital by

investing only in mature, stable markets.

风险容量是一个主体在追求价值的过程中所愿意承受的广泛意义的风险的

数量。它反映了主体的风险管理理念，进而影响主体的文化和经营风格。许多主

体采用诸如高、适中或低之类的分类定性地考虑风险容量，而其他主体则采用定

量的方法，反映和平衡增长、报酬和风险目标。具有较高风险容量的公司可能愿

意把它的大部分资本配置到诸如新兴市场等高风险领域。反过来，具有低风险容

量的公司可能会仅仅投资于成熟的、稳定的市场，以便限制其短期的巨额资本损

失风险。

Risk appetite is directly related to an entity’s strategy. It is considered in strategy

setting, as different strategies expose an entity to different risks. Enterprise risk

management helps management select a strategy that aligns anticipated value creation

with the entity’s risk appetite.

风险容量与一个主体的战略直接相关。它在战略制订过程中予以考虑，因为

不同的战略会使主体面临不同的风险。企业风险管理可以帮助管理当局选择一个

将期望的价值创造与主体的风险容量相协调的战略。

Risk appetite guides resource allocation. Management allocates resources among

business units and initiatives with consideration of the entity’s risk appetite and the

unit’s plan for generating desired return on invested resources. Management considers

its risk appetite as it aligns its organization, people, and processes, and designs

infrastructure necessary to effectively respond to and monitor risks.

风险容量指导资源配置。管理当局通过考虑主体的风险容量和业务单元为实

现投入资源的期望报酬而制订的计划，把资源配置到业务单元和活动之中。管理

当局考虑容量，使其与组织、人员和流程相适应，并设计的基础结构以便有效地

应对和监控风险。

Risk tolerances relate to the entity’s objectives. Risk tolerance is the acceptable level

of variation relative to achievement of a specific objective, and often is best measured

in the same units as those used to measure the related objective.

风险容限与主体的目标相关。风险容限是相对于实现一项具体目标而言，可

以接受的偏离程度，它通常最好采用那些与度量相关目标相同的单位进行度量。

In setting risk tolerance, management considers the relative importance of the related

剩余142页未读，继续阅读

红烧平鱼

粉丝: 0
资源: 1

COSO企业风险管理框架：增强价值与应对不确定性

coso内部控制呆瓜系列

COSO-ERM-FAQ 2017

COSO企业风险管理框架（中英文对照版）

COSO企业风险管理框架解析

COSO企业风险管理框架.pdf

新版COSO企业风险管理框架.doc

COSO企业风险管理框架：中文解读

COSO企业风险管理框架：理解和应用

COSO企业风险管理框架：概述与关键要素

COSO企业风险管理框架与内部控制理论解读

最新资源