ISOFDIS31000风险管理最终发布版中文翻译稿

理特立风险和

/

或部 分风险的通用方法，而不是取代这些标准。

This In ter national Standard is not inte nded for the purpose of certificati on.

本标准不适合认证目的。

2

Terms and definitions

术语和定义

For the purposes of this document, the following terms and definitions apply.

下列术语和定义适用本文件。

2.1

risk

风险

effect of uncertainty on objectives

不确泄性对目标的阻碍

NOTE 1 An effect is a deviation from the expected

—

positive and/or negative.

注

1:

阻碍是与预期的偏差一一积极和

/

或消极

NOTE 2 Objectives can have different aspects (such as financial, health and safety, and environ mental goals) and

can apply at differe nt levels (such as strategic, orga nizatio n

?

wid

已

project, product and process)

?

注

2

：

目标能够有不同方而

(

如财务，健康和安全，以及环境目标

)

，能够表达在不同的层

次

(

如

战略，组织范畴，项目，产品和流程

)

。

NOTE 3 Risk is often characterized by referenee to potential

events

(2.19) and

consequences

(2.20), or a combi

nation of these

?

注

3

：

风险通常被描述为潜在事件

(2.19)

和后果

(2.20),

或它们的组合。

NOTE 4 Risk is often expressed in terms of a combinatio n of the con sequences of an eve nt

(ineluding changes in circumstances) and the associated

likelihood

(2.21) of occurrenee.

注

4

：

风险往往表达了对事件后果

(

包括环境的变 化

)

和相关的可能性概率

(2.21)

。

NOTE 5 Un certainty is the state, eve n partial, of deficie ncy of informatio n related to, understanding or

knowledge of an event, its consequenee, or likelihood

?

[ISO Guide 73:201& definition 1.1]

2.2risk management^

险治理

coordinated activities to direct and control an organization with regard to risk (2.1)

一个组织对风险的指挥和操纵的一系列和谐活动

[ISO Guide 73:201& definition 2.1]

2.3risk management framework

风险治理框架

set of components that provide the foundations and organizational arrangements for designing,

implementing,

monitoring

(2.30)

z

reviewing and continually improving

risk management

(2.2) throughout the organization

组织对风险治理的设计、实施、监控、检査和连续改进等进 行的一系列基础的组织安排

NOTE 1 The fou nda

廿

ons in elude the policy, objectives, mandate and commitment to man age

risk

( 2.1).

基础

包括治理风险的政策、目标、任务和承诺

NOTE 2 The orga nizatio nal arra ngeme nts include plans, relati on ships, accountabilities, resources, processes

and activities.

组织安排包括打算、关系、职 责、资源、流程和活动

NOTE 3 The risk management framework is embedded within the organization's overall strategic and operational

policies and practices.

风险治理框 架被植入到组织的整个战略和运营的

战略和实践中

[ISO Guide 73:2018, definition 2.1.1]

2.4ri$$k management policy

风险治理政策

statement of the overall intentions and direction of an organization related to

risk management

(2.2)

一个组织

对风险治理的意图和指导方向的陈述

[ISO Guide 73:201& definition 2.1.2]

2.5risk attitude

风险态度

organization's approach to assess and eventually pursue, retain, take or turn away from risk (2.1)

组织评估、追求、保留、采取或躲开风险的处理手段

[ISO Guide 73:201& definition 3.7.1.1]

2

?

6risk appetite

风险偏好

amount and type of risk (2.1) that an organization is prepared to pursue, retain or take

一个组织追求、保留或采取风险的数量和类型

[ISO Guide 73:2018, definition 3.7.1.2]

2.7risk aversion

风险规避

attitude to turn away from risk (2

?

i)

躲开风险的态度

[ISO Guide 73:201& definition 3.7.1.4]

2.8risk management plan

风险治理打算

scheme within the

risk management framework

(2.3) specifying the approach, the management components and resources

to be applied to the management of risk (2.1)

为风险治理框架方案指泄方法、治理措施、资源以用于治理风险

NOTE 1 Management comp onents typically in elude procedures, practices, assig nment of responsibilities, sequence

and timing of activities.

治理措施一样包括程序、做法、职责分配、序列

和及时的行动

NOTE 2 The risk management plan can be applied to a particular product, process and project, and part or whole of

the organ ization.

风险治理打算适用于特左的产品、流程和项目、部分或整个

组织

[ISO Guide 73:201& definition 2.1.3]

2.9risk owner

风险所有者

pers on or entity with the accountability and authority to man age the risk (2.1)

对风险治理持有权力和责任的个人或实体

[ISO Guide 73:201& definition 3.5.1.4]

2.10risk management process

风险治理流程

systematic application of management policies, procedures and practices to the activities of commu nicati ng, con

suiting, establishing the con text, and identifying, an alyzing, evaluati ng, treati ng,

monitoring

(2.30) and

reviewing

risk

(2.1)

系统的应用治理政策，

程 序和沟通协商，

在建立的风险治理环境下，

识不，

分析，

评判，

处理，

监测和审査风险

[ISO Guide 73:201& definition 3.1]

2.11

establishing the contexts

境建设

defining the exter nal and in ter nal parameters to be taken into acco unt when man aging risk, and setting the

scope and

risk criteria

(2.24) for the

risk management policy

(2.4)

界左风险治理应该考虑的外部和内部参数，并设巻风险治理政策的范畴和风险的标准

[ISO Guide 73:2018, definition 3.3.1]

2.12

oxtomal context

外部环境

external environment in which the organization seeks to achieve its objectives

NOTE External context can include:

外部环境包括

一

the cultural, social, political, legal, regulatory, financial, technological, economic, natural and

competitive environment

z

whether international, national, regional or local;

文

ft

、科

:

会、政》台、

1

去律、

< /p>

监

管、财政金融、技术、经济、自然和竞争环境，不管是国际，国 家，区域或地点

一

key drivers and trends having impact on the objectives of the organization; and

阻碍

i

亥组织的

要紧驱

动和趋势

一

relationships with, and perceptions and values of, external

stakeholders

(2.15).

夕卜部利益相

关者之

间的关系和价值观

[ISO Guide 73:2018, definition 3.3.1.1]

2.13intemal context

内部环境

internal environment in which the organization seeks to achieve its objectives

NOTE Internal context can include:

内部环境包括

一

governance, organizational structure, roles and accountabiliti es;

治理、组织结构、角色和责

任

一

policies, objectives, and the strategies that are in place to achieve them;

政策、目标、实现目

标的战

略

一

the capabilities, understood in terms of resources and knowledge (e.g. capital, time, people, processes,

systems and technologies);

能力 、资源和知识

(

如资本、时刻、人、流程、系统和技术

)

-

perceptions and values of internal stakeholders;

内部利益相关者的价值观

一

information systems, information flows and decision-making processes (both formal and informal);

信息 系

统、信息流和

(

正式的和非正式的< /p>

)

决策流程

-

relationships with, and perceptions and values of, internal stakeholders;

内部利益相关者价值

观之间的

关系

一

the organization's culture;

组织文化

-

standards, guidelines and models adopted by the organization; and

标准、指引和组织采纳的

模式

-form and extent of contractual relationships.

合同关系的形成和范畴

[ISO Guide 73:201& definition 33.1.2]

2.14communication and consultation

沟通和协商

continual and iterative processes that an organization con ducts to provide, share or obtain information and to

engage in dialogue with stakeholders (2.15) and others regarding the management of risk (2.1)

一个组织提供，共享或猎取信息，与利益相关者和苴他风险治理者连续和反复对话的流程

NOTE 1 The information can relate to the existenee, nature, form,

likelihood

(2.21), severity, evaluation,

acceptability,treatment or other aspects of the management of risk.

信息涉及存在、性

质、形 式、可能性、严

峻程度、评判、可同意性、处理或者其他与治理风险相关的方而

NOTE 2 Consultation is a two- way process of informed communication between an organization and its stakeholders

or others on an issue prior to maki ng a decisi on or determini ng a direction on a particular issue

?

Consultation is:

协商是一个组织与它的利益相关者或英他利益相关者双向沟通的过程，目的在于就以咨询

题提

早做出决策或就某一咨询题决定方向。协 商是：

一

a process which impacts on a decision through in fluence rather than power; and

通过阻碍而

非权力阻碍

决策的过程

一

an input to decision making, not joint decision making.

加入决策而非共同决策

[ISO Guide 73:201& definition 3.2.1]

2.15stakeholder^iJ

益相关者

person or organization that can affect, be affected by, or perceive themselves to be affected by a decision or

activity

能够阻碍、被阻碍或者觉得自己会被决 策或者活动阻碍的个人或组织

NOTE A decision maker can be a stakeholder.

决策者能够是利益相关者

[ISO Guide 73:201& definition 3.2.1.1]

2.16risk assessment^

险评估

overall process of

risk identification

(2.17),

risk analysis

(2.23) and

risk evaluation

(2.26)

风险识

不，风

险分析和风险评判的整个过程

[ISO Guide 73:201& definition 3.4.1]

2.17risk identification

风险识不

process of finding, recognizing and describing risks (2.1)

发觉、识不、描述风险的过程

NOTE 1 Risk identification involves the identification of

risk sources

(2.18),

events

(2.19), their causes and

their potential

consequences

(2.20)

?风险识不包括风险源的识不、风险事件的识不、 风

险缘故及潜在后果

的识不

NOTE 2 Risk identification can involve historical data, theoretical analysis, informed and expert opinions, and

stakeholders

(2.15) needs.

风险识不涉及历史数据

技术分析、知情人、专家和利

益相关者的意见

[ISO Guide 73:201& definition 3.5.1]

2.18risk source

风险源

element which alone or in combination has the intrinsic potential to give rise to risk (2.1)

单独或联合具有内在的潜在引起危险的因素

NOTE A risk source can be tangible or intangible.

一个风险源能够是有形的或者无形的

[ISO Guide 73:201& definition 3.5.1.1]

2.19event

事件

occurrence or change of a particular set of circumstances Vf J

环境的产生或者变化

NOTE 1 An event can be one or more occurrences, and can have several causes.

一个事件可能

< /p>

是一个或多个情

况组成，同时会有多种缘故

NOTE 2 An event can consist of something not happening.

一个事件可能有一些可不能发生

NOTE 3 An event can sometimes be referred to as an

—

个事件有时被

称为“偶然事

件”或“事故”

NOTE 4 An event without consequences can also be referred to as a

call

—个可不能产生后果的事件能够被称为“近乎为零”、“偶然事件”、

“ne ar hit

[ISO Guide 73:201& definition 3.5.1.2]

2.20consequence

后果

outcome of an event (2.19) affecting objectives

事件对目标的阻碍结果

NOTE 1 An event can lead to a range of consequences.

一个事件可能产生一些列的后果

NOTE 2 A consequenee can be certain or uncertain and can have positive or negative effects on objectives.

后果可

能对目 标是确定或非确定的、积极或消极的

NOTE 3 Consequences can be expressed qualitatively or quantitatively.

后果可能是质量上的，

也可能是数

量上的

NOTE 4 Initial consequences can escalate through knock-on effects.

初步的后果可能升级，产生

连锁效应

[ISO Guide 73:2018, definition 3.6.1.3]

2.21 likelihood

可能性

chance of something happening

某事发生的机会

NOTE 1 In risk management terminology, the word

happening’whether defined, measured or determined objectively or subjectively, qualitatively or quantitatively, and

described using general terms or mathematically (such as a probability or a frequency over a given time period).

在风 险治理术语中，

可能性”是指情况发生的机会，不论是界左，衡 量或客观或主观的确

定，泄性或定量、一样的或精确的描述< /p>

(

如在一泄时期内情况发生的几率和频率

)

NOTE 2 The En glish term

equivale nt of the term

?

However, in English,

interpreted as a mathematical term

?

Therefore, in risk management terminology,

that it should have the same broad interpretation as the term

?

英文

可能性”在有些语言中没有直截了当对应，而同义词

概率”经常被使用。然而，在英

语

< br>中，“概率〃通常被狭义讲明为数学术语。因此，在风险治理术语中，〃可能性〃，被富有同非

英

语国家的

[ISO Guide 73:2018, definition 3.6.1.1]

2.22risk profile

风险描述

description of any set of

risks

(2.1)

每一种风险的描述

NOTE The set of risks can con tain those that relate to the whole orga niza

廿

on, part of the organization, or

as otherwise defined.< /p>

该风险是指那些可与整个组织、组织的部分或者其他特泄部

分向关联的风险

[ISO Guide 73:201& definition 3.8.2.5J

2.23ri$$k analysis

风险分析

process to comprehend the nature of

risk

(2.1) and to determine the

level of risk

(2.25)

充分明白得风险的性质和确定风险等级的过程

NOTE 1 Risk analysis provides the basis for

risk evaluation

(2.26) and decisions about

risk treatment

(2.27).

风

险分析是风险评判和风险处理 决策的基础

NOTE 2 Risk analysis includes risk estimation.

风险分析包括风险判定

[ISO Guide 73:201& definition 3.6.1]

2.24risk criteria

风险标准

terms of reference against which the significance of a risk (2.1) is evaluated

对风险评判具有重要意义的条款

NOTE 1 Risk criteria are based on organizational objectives, and

external

(2.12) and

internal context

(2.13).M

险

标准建立以组织目 标、外部及内部环境为基础

NOTE 2 Risk criteria can be derived from standards, laws, policies and other requirements

?

风险标准能够从标准、法律、政策和其他要求中产生

[ISO Guide 73:201& definition 3.3.13]

2.25level of risk

风险等级

magnitude of a

risk

(2.1), expressed in terms of the combination of

consequences

(2.20) and their

likelihood

(2.21)

风险的重要度，所风险组合所产生的后果和其可能 性

[ISO Guide 73:2018, definition 3.6.1.8]

2.26 risk evaluation

风险评判

process of comparing the results of

risk analysis

(2.23) with

risk criteria

(2.24) to determine whether the risk

(2.1) and/or its magnitude is acceptable or tolerable

对比风险分析和风险标准的过程，以决迩风险及其级数是否能够同意和容忍

NOTE Risk evaluation assists in the decision about

risk treatment

(2.27).

风险评判关心风险处

理决策

[ISO Guide 73:201& definition 3.7.1]

2.27risk treatment

风险处理

process to modify

risk

(2.1)

修正风险的流程

NOTE 1 Risk treatment can involve:

风险处理包括：

一

avoiding the risk by deciding not to start or continue with the activity that gives rise to the risk;

通 过

躲开或停止能够产生风险的活动幸免风险

-taking or increasing risk in order to pursue an opportunity;

为

了追求机遇采取或增加风险

-

removing the

risk source

(2.18);

排除风险源

-

changing the

likelihood

(2

?

21);

改变可能性

-

changing the

consequences

(2.20);

改变后果

一

shari ng the risk with another party or parties (in cludi ng con tracts and risk fin ancing); and

与英

他

团体 风险共担

(

包括合同、风险融资

)

-

retaining the risk by informed choice.

通过知情坚持风险

NOTE 2 Risk treatments that deal with negative consequences are some

廿

mes referred to as

；

?

对消极后果的风险处理能够归为“ 风险缓和”、“风险排除”、“风险预防”和“风险减

小”

NOTE 3 Risk treatment can create new risks or modify existing risks.

风险处理可能产生新的风险或修正已存在的风险

[ISO Guide 73:201& definition 3.8.1]

2.28control

操纵

measure that is modifying risk (2

?

1)

修正风险的措施

NOTE 1 Con trols in elude any process, policy, device, practice, or other actions which modify risk.

操纵包括任何流程、政策、策略、时刻或苴他修正风险的行动

NOTE 2 Controls may not always exert the intended or assumed modifying effect.

操纵可能不总是符合产生预期或假左的修正成效

[ISO Guide 73:201& definition 3.8.1.1]

2.29residual risk

剩余风险

risk

(2.1) remaining after

risk treatment

(2.27)

通过风险处理后仍旧存在的 风险

NOTE 1 Residual risk can contain unidentified risk

?剩余的风险包括未识不的风险

NOTE 2 Residual risk can also be known as

?剩余风险也能够成为风险残留

[ISO Guide 73:201& definition 3.8.1.6]

2.30monitoring

监控

continual checking, supervising, critically observing or determining the status in order to identify change from

the performance level required or expected

不断检査，监督，审慎地观看或明确现状，以确保识不与要求的或预期的绩效的变化情形

NOTE Monitoring can be applied to a

risk management framework

(2.3),

risk management process (2.10), risk(2.1)

or control (2 .28).lEi

控适用于风险治理框架、风险治理流程、风险和操纵

< br>

[ISO Guide 73:201& definition 3.8.2.1]

2.31 review^

査

activity undertaken to determine the suitability, adequacy and effectiveness of the subject matter to achieve

established objectives

釆取适当、足 够、有效的活动以保证已设目标的达成

NOTE Review can be applied to a

risk management framework

(2.3),

risk management process

(2.10), risk (2.1) or

control

(2.28).

检査 适用于风险治理框架、风险治理流程、风险和操纵

[ISO Guide 73:201& definition 3.8.2.2J

3

Principles

原则

For risk management to be effective, an organization should at all levels comply with the principles below

?

为了确保风险治理富有 成效，组织的各个层而应该遵循以下原则。

a)

Risk management creates and protects valu?

?风险治理制造并爱护价值

Risk management contributes to the demonstrable achievement of objec

廿

ves and improvement of performs nee in,

for example, human health and safety, security, legal and regulatory complia ng public acceptanee, environmental

protection, product quality, project management, efficiency in operations’governance and reputation.

风险治理有助于目标达成和 绩效的明显改善，例如，人类健康和安全，保安，法律和法规

遵从

性，公众同意性，环保，产品质量，项目治理，运营效率，治理和声誉。