企业风险管理框架中英文版

Effectiveness

有效性

While enterprise risk management is a process, its effectiveness is a state or condition

at a point in time. Determining whether enterprise risk management is “effective” is

a

judgment resulting from an assessment of whether the eight components are present

and functioning effectively. Thus, the components are also criteria for effective

enterprise risk management. For the components to be present and functioning

properly there can be no material weaknesses, and risk needs to have been brought

within the entity’s risk appetite.

尽管企业风险管理是一个过程，

它的有效性却是在某个时点上的一种状态或

情况。确定企业风险管理是否 “有效”，是在对八个构成要素是否存在和有效运

行的评估的基础之上所作出的判断。< /p>

因此，

构成要素同时也是有效的企业风险管

理的判断标准。如果这些构成要素存在且正常运行，那么就可能没有重大缺陷，

而风险 可能已经被控制在主体的风险容量以内。

When enterprise risk management is determined to be effective in each of the four

categories of objectives, respectively, the board of directors and management have

reasonable assurance that:

? They understand the extent to which the entity’s strategic objectives are bein

g

achieved

? They understand the extent to which the entity’s operations objectives are

being achieved

? The entity’s reporting is reliabl

e

? Applicable laws and regulations

are being complied with

如果确定企业风险管理在所有四类目标上都是有效的，

那么就意味着董事会和管

理当局对下列方面的合理保证：

●

他们了解主体实现其战略目标的程度；

●

他们了解主体实现其经营目标的程度；

●

主体的报告是可靠的；

●

符合适用的法律和法规。

While in order for enterprise risk management to be deemed effective all eight

components must be present and functioning properly

–

applying the principles

described in the following chapters

–

some trade-offs may exist between components.

Because enterprise risk management techniques can serve a variety of purposes,

techniques applied relative to one component might serve the purpose of techniques

normally present in another. Additionally, risk responses can differ in the degree to

which they address a particular risk, so that complementary risk responses and

controls, each with limited effect, together may be satisfactory.

尽管为了使企业风险管理被判定有效，

所有的八个构成都必须存在和正常 运

行——运用在接下来的各章讲述的原则，

但是在构成要素之间 可能会存在着某些

权衡。

因为企业风险管理技术可以服务于许多 目的，

所运用的与一个构成要素相

关的技术，

< br>或许能服务于通常代表另一个构成要素的技术的目的。

此外，

针对特

定的风险而言，

风险应对的程度可能有所不同，

所以具有互补性的风险应对和控

制，尽管各自的效果都很有限，但是 结合起来可能是令人满意的。

The concepts discussed here apply to all entities, regardless of size. While some small

and mid-size entities may implement component factors differently than large ones,

they still can have effective enterprise risk management. The methodology for each

component is likely to be less formal and less structured in smaller entities than in

larger ones, but the basic concepts should be present in every entity.

这里所讨论的概念适用于所有的主体，

无论其 规模如何。

尽管一些中小规模

的主体在实施这些构成要素时可能 与大型主体有所不同，

但是它们仍然可能拥有

有效的企业风险管 理。

比起较大的主体而言，

在较小的主体中，

< br>各个构成要素的

方法可能不太正式和不太健全，但是在每一个主体中这些基本的概 念都应该存

在。

Enterprise risk management usually is considered in the context of an enterprise as a

whole, which involves considering its application in significant business units. There

may, however, be circumstances where the effectiveness of enterprise risk

management is to be evaluated separately for a particular business unit. In such

circumstance, in order to conclude that enterprise risk management for the unit is

effective all eight components must be present and functioning effectively in the unit.

Thus, for example, because having a board of directors with specified attributes is part

of the internal environment, enterprise risk management for a particular business unit

may be judged effective only when the unit has in place an appropriately functioning

board of directors or similar body (or the entity-level board of directors applies

requisite oversight directly to the business unit). Similarly, because the risk response

component describes taking a portfolio view of risk, for enterprise risk management

to be judged effective there must be a portfolio view of risk for that business unit.

一般把企业当作一个整体来考虑企业风险管理，

其中包括考虑它在重要的业

务单元中的应用。

但是，

也会有单独针对一个特定的业务单元去评价企业风险管

理 的有效性的情况，

在这种情况下，

为了得出这个单元的企业风险 管理有效的结

论，

所有的八个构成要素在这个单元中必须存在且 有效运行。

举例来说，

由于有

一个具有 规定特质的董事会是内部环境的一部分，

某个特定业务单元的企业风险

< br>管理，

只有当该单元拥有一个恰当运行的董事会或类似机构

（或者主体层次的董

事会对该业务单元进行必要的监督）时，才能被判定为有效。同样 地，由于对风

险应对这个构成要素的描述采取了风险组合观，

要 想使企业风险管理被判定为有

效，该业务单元也必须采取风险组合观。

< br>

Encompasses Internal Control

涵盖内部控制

Internal control is an integral part of enterprise risk management. This enterprise risk

management framework encompasses internal control, forming a more robust

conceptualization and tool for management. Internal control is defined and described

in

Internal Control

–

Integrated Framework

. Because

Internal Control

–

Integrated

Framework

is the basis for existing rules, regulations, and laws, and has stood the test

of time, that document remains in place as the definition of and framework for

internal control. While only portions of the text of

Internal Control

–

Integrated

Framework

are reproduced in this framework, the entirety of

Internal Control

–

Integrated Framework

is incorporated by reference into this framework

.

Appendix C

describes the relationship between enterprise risk management and internal control.

内部控制是企业风险管理不可分割的一 部分。

这份企业风险管理框架涵盖了

内部控制，

从而构建一个更强有力的概念和管理工具。

内部控制是在

《内部控制

——整合框架》中加以定义和讲述的。因为《内部控制——整合框架》是现 行规

则、

监管和法律的基础，

而且经受 了时间的检验，

因此那份文件中对内部控制的

定义和框架依然有 效。

尽管

《内部控制——整合框架》

的 正文中只有一部分被本

框架所引用，

但是本框架通过参考的方式 把整个

《内部控制——整合框架》

融合

了进来。附录

C

讲述了企业风险管理与内部控制之间的关系。

Enterprise Risk Management and the Management Process

企业风险管理与管理过程

Because enterprise risk management is part of the management process, the enterprise

risk management framework components are discussed in the context of what

management does in running a business or other entity. But not everything

management does is a part of enterprise risk management. Many judgments applied in

management’s decision making a

nd related management actions, while part of the

management process, are not part of enterprise risk management. For example: < /p>

因为企业风险管理是管理过程的一部分，

所以企业风险管理框架的 构成要素

是在管理当局如何经营企业或其他主体的背景下加以讨论的。

< br>但是并不是管理当

局所做的每一件事情都是企业风险管理的一部分。

管理当局在决策和相关的管理

活动中所运用的许多判断，

尽管是管理过程的一部分，

但是并不是企业风险管理

的一部 分。例如：

? Ensuring there is an appropriate process for objective setting is a critical componen

t

of enterprise risk management, but the particular objectives selected by management

are not part of enterprise risk management.

? Responding to risks,

based on an appropriate assessment of the risks, is a part of

enterprise risk management, but the specific risk responses selected and the associated

allocation of entity resources are not.

? Establishing and executing control activities to help ensure th

e risk responses

management selects are effectively carried out is a part of enterprise risk management,

but the particular control activities chosen are not.

●

确保有一个恰当的目标设定过程是企业风险管理的一个重要的构成要素，

但是

管理当局所选定的选定目标并不是企业风险管理的一部分。

●

根据对风险的恰当评估 去应对风险是企业风险管理的一部分，

但是所选定的具

体风险应 对和主体资源的相应配置却不是。

●

确定的执行控制活动以帮助确保管理当局选择的应对得以有效实施是企业风

险管理的一部分，但是所选定的特定的控制活动却不是。

In general, enterprise risk management involves those elements of the management

process that enable management to make informed risk-based decisions, but the

particular decisions selected from an array of appropriate choices do not determine

whether enterprise risk management is effective. However, while the specific

objectives, risk responses, and control activities selected are a matter of management

judgment, the choices must result in reducing risk to an acceptable level, as

determined by risk appetite and reasonable assurance regarding achievement of entity

objectives.

总之，

企业风险管理包括管理过程中那些保证管理当局作出知情的风险决策

（

informed risk-based decisions

）的 要素，但是从一系列合适的选项中选定

的特定决策并不能决定企业风险管理是否有效。< /p>

管理选定的具体目标、

风险应对

和控制活 动与管理当局的判断有关，

但是这些选择必须最终把风险降低到一个可

< br>以接受的水平——这个水平取决于风险容量，以及有关实现主体目标的合理保

证。

2

内部环境

2. INTERNAL ENVIRONMENT

Chapter Summary: The internal environment encompasses the tone of an organization,

influencing the risk consciousness of its people, and is the basis for all other

components of enterprise risk management, providing discipline and structure.

Internal environment factors include an entity’s risk management philosophy; its ris

k

appetite; oversight by the board of directors; the integrity, ethical values, and

competence of the entity’s people; and the way management assigns authority an

d

responsibility, and organizes and develops its people.

本章摘要 ：

内部环境包含组织的基调，

它影响组织中人员的风险意识，< /p>

是企

业风险管理所有其他构成要素的基础，

为其他要素提供约束和结构。

环境因素包

括主体的风险管理理 念、它的风险容量、董事会的监督、主体中人员的诚信、首

先价值胜任能力，以及管理当 局分配权力和职责、组织和开发其员工的方式。

The internal environment is the basis for all other components of enterprise risk

management, providing discipline and structure. It influences how strategies and

objectives are established, business activities are structured, and risks are identified,

assessed, and acted upon. And it influences the design and functioning of control

activities, information and communication systems, and monitoring activities.

内部环境是企业风险管理所有其他构 成要素的基础，

为其他要素提供约束和

结构。

< br>它影响着战略和目标如何制订、

经营活动如何组织以及如何识别、

评估风

险并采取行动。

它还影响着控制活动、