企业风险管理(ERM)流程中的步骤
识别风险
The first step in the ERM process is to identify the potential risks (and opportunities) that may affect the organization’s objectives. This step involves recognizing internal and external risks that may arise from various sources such as operations, 金融, 监管, 法律, 声誉和战略风险. 识别新的风险是管理即将出现的风险的关键.
![显示ERM过程中涉及的典型步骤的图形.](http://www.freewayrooms.com/sites/www/files/styles/tu_is_image_embedded/public/images_embedded/ERM_Process_250px.jpg?itok=5s7r_k96)
评估风险
在确定了风险之后, the next step is to assess their likelihood and 的潜在影响 on the organization’s objectives. 这一步包括根据风险发生的概率来分析风险, 的潜在影响, the speed (or velocity) that the risk might affect the organization and the adequacy of the organization’s current controls to mitigate those risks.
优先考虑风险
基于风险评估, the next step is to prioritize the risks based on their level of importance to the organization’s objectives. This step involves determining which risks require immediate attention and which risks can be managed over the long term.
制定风险缓解策略
在对风险进行优先排序之后, the next step is to develop risk management strategies that align with the organization’s objectives. This step involves developing a risk management plan that outlines how the organization will mitigate, 避免, 转移或接受每一项风险.
实施风险缓解策略
The next step is to implement the risk mitigation strategies identified in the previous step. 这一步包括将必要的流程落实到位, 管理已识别风险的政策和程序.
报告、监督和审查
ERM流程的最后一步是报告, 监督和审查所实施的风险管理策略的有效性. 这一步包括持续监控风险, 评估风险管理策略的有效性, adjusting the strategies as necessary and reporting the results in a timely manner to be useful in strategic planning.