GCRI · مدیریت ریسک سامانه‌ای
اطمینان و اصلاح
Assurance asks whether risk management works as described; correction makes sure that when it does not, records and decisions change. Internal audit, independent review, incident investigation and learning سامانه‌ها provide the checks. This page sets out how assurance is organised, why it can miss systemic weaknesses, and how corrections are recorded so that the evidence behind a decision stays traceable after the facts change.
Assurance and correction on the record.
Assurance and correction: how the risk develops.
Evidence, review and methods correction. The dossier below sets out how the risk develops, what is measured, where the data come from, how it is modelled and who decides.
Assurance tests what it is shown
Reviews examine the processes and records put in front of them. Risks that fall outside the scope, or between the scopes of several reviewers, go untested.
Investigations stop at the first cause
Incident reviews that end at the person or component closest to the failure miss the organisational and design conditions behind it. Those conditions remain and produce the next incident.
Corrections must reach the record
When an assumption, dataset or model proves wrong, decisions built on it need revisiting. Without versioned records, the correction is made in one place and the error persists elsewhere.
Actions decay before closure
Audit and incident actions are agreed, then deferred as priorities shift. Overdue actions accumulate and the weaknesses they were meant to fix stay open.
Risk register.
The screen a team would use to follow this subject: its measures, states and decisions. Names are examples and values are illustrative.
فهرست ریسک
Assurance and correction · Enterprise A · Review cycle Q4
ریسک باقیمانده
احتمال × پیامد، ریسک‌ها در هر خانه
شمار ریسک‌ها در هر خانه. سایه‌زنی از ردیف‌های اشتها پیروی می‌کند.
بالاتر از اشتها
| تمرکز تأمین‌کنندگان | تدارکات | بالا | ▲ 2 |
| سیل‌گرفتگی مرکز داده | عملیات | بالا | ▲ 0 |
| خطای مدل در قیمت‌گذاری | مالی | متوسط | ▲ 1 |
| از دست دادن کارکنان کلیدی | افراد | متوسط | ▼ 1 |
فرایند مدیریت ریسک، بر پایهٔ استاندارد بین‌المللی
- دامنه، زمینه، معیارهاتنظیم
- شناساییطبقه‌بندی
- تحلیلاحتمال · پیامد
- ارزیابیدر برابر اشتها
- پردازشطرح‌ها
- پایش و بازبینیKRIها
- ثبت و گزارش‌دهیهیئت
اقدام‌های پردازش ریسک
- T-11قطعهٔ حیاتی با دو منبعمسئول: تدارکات · معوق9 d تأخیر
- T-14انتقال سایت پشتیبان به بالاتر از تراز سیلمسئول: عملیاتسررسید 14 روز
- T-17اعتبارسنجی مستقل مدلمسئول: مالیسررسید 20 روز
Assurance checks that risk evidence in every domain can be trusted.
- آبپیوستگیWater safety plans are audited against their own hazard analysis.What to watchAudit findings and corrective actions
- سلامتپیوستگیContinuity plans are tested, and the tests are themselves reviewed.What to watchExercise evaluation records
- تنوع زیستیپیوستگیRestoration claims need monitoring evidence, not only plans.What to watchMonitoring against baselines
Assurance practice is designed for the مجموعهٔ روش‌ها و فنی. The Three Lines Model of 2020 separates management, risk oversight and independent assurance; verification evidence would follow NS-11 of the proposed Nexus Standards.
- Published audit and correction records.
- Lessons where assurance missed a failure.
How assurance and correction is modelled, measured and tested.
مدل، مفروضات، داده‌ها و عدم قطعیت آن، به شکلی که دانشمند یا مهندس بررسی می‌کند. ساختارها از روش‌های منتشرشده پیروی می‌کنند. مقادیر ترسیم‌شده تبیینی‌اند، نه یافته.
مدل، معادلات و مفروضات
The model structure used for assurance and correction, the assumptions it makes and how each is tested.
Ri = f(Hi, Ei, Vi, Ci)مخاطره، مواجهه، آسیب‌پذیری و ظرفیت مقابلهEAL = ∑k pk · Lkبر رویدادهای k با احتمال سالانهٔ pkxt+1 = A xt + B ut + εtA carries the couplings, u the shock, ε the error| فرض | چرا ساخته می‌شود | چگونه آزموده می‌شود |
|---|---|---|
| مخاطره و مواجهه در یک رویداد مستقل‌اند | انتگرال زیان را تحت‌کنترل نگه می‌دارد | مقایسه با برازش مفصل بر سوابق مشترک |
| جفت‌شدگی‌ها نزدیک نقطهٔ کار خطی‌اند | اجازه می‌دهد شوک‌ها از طریق A منتشر شوند | فراتر از دامنهٔ خطی آشفته کنید و مقایسه کنید |
| منحنی‌های آسیب‌پذیری میان مکان‌ها منتقل می‌شوند | منحنی‌های محلی به‌ندرت در دسترس‌اند | اعتبارسنجی در برابر زیان‌های مشاهده‌شده در جاهایی که وجود دارند |
- ورودی‌ها
- مجموعه‌داده‌های نسخه‌دار با خاستگاه
- خروجی‌ها
- توزیع‌ها، هرگز تک‌رقم‌ها
- کد
- منتشرشده با کارت مدل و آزمون‌ها
- بازتولید
- همان داده، کد، محیط و بذر
What is measured, and how well.
Each indicator carries its unit, its cadence, the kind of source behind it and the evidence label a value would carry. No values are shown: a programme supplies them under its own authority.
| Indicator | Unit | دورهٔ تکرار | Source type | برچسب |
|---|---|---|---|---|
| Principal risks covered by assurance | percent of principal risks reviewed in the cycle | annual | Assurance maps | گزارش‌شده |
| Overdue audit actions | count by age band | quarterly | Audit action tracking | گزارش‌شده |
| Incident investigations reaching organisational factors | percent of investigations | annual | Investigation reports | گزارش‌شده |
| Corrections issued to published risk evidence | count with reason recorded | continuous | Correction log | مشاهده‌شده |
| Repeat incidents | count of incidents with a previously identified cause | annual | Incident databases | مشاهده‌شده |
| Independent reviews of the risk framework | date of last external review | per review | Governance records | DECLARED |
Where the evidence comes from.
Named public datasets and institutional records, each with its licence class. Sources by agreement are used only under their terms and never republished.
| منبع | What it gives | Licence class |
|---|---|---|
| Global Internal Audit Standards | Requirements for internal audit independence, planning and reporting, from The Institute of Internal Auditors | Public, IIA terms of use |
| The IIA Three Lines Model | Roles of management, risk functions and internal audit in assurance | Public, IIA terms of use |
| National audit office reports | Independent public sector audit findings on risk and resilience | Public records, licence per office |
| Safety investigation board reports | Investigations that trace organisational and systemic factors | Public records, terms per board |
| Retraction Watch database | Records of retracted and corrected research used in evidence bases | Open, Crossref terms (to check) |
Who decides, and what the evidence serves.
ریسک سامانه‌ای Management prepares evidence. The decisions below are taken by the authorities named, under their own rules, and never by the platform.
| چه کسی تصمیم می‌گیرد | The question | Evidence this page serves |
|---|---|---|
| Audit committees | Whether assurance over principal risks is sufficient and independent | Assurance maps; overdue actions; external review dates |
| Chief audit executives | Where to direct audit effort in the next plan | Coverage gaps; repeat incidents |
| Public accounts committees and legislatures | Whether public bodies have acted on findings | Audit office reports; action status |
Outputs this topic produces
- Assurance maps that show coverage gaps across lines and reviewers
- Investigation protocols that trace organisational and design factors
- Correction and versioning procedures for published risk evidence
- Action tracking templates with ageing and escalation
What assurance experts ask.
- Is the evidence that controls work independent of the people who run them?
- Are models validated against data they were not built on, and are their limits documented?
- When an error is found, is it corrected openly, with a record of what changed and why?
- Do near misses and small failures lead to learning, or are they explained away?
- Who checks the checkers: is there a route for staff and outsiders to raise concerns that bypasses the line being reviewed?
- Are corrections traced through to every decision, report and model that relied on the flawed result?
Why assurance weakens.
Assurance tends to erode quietly. Reviews become routine, findings repeat from one cycle to the next and the people being reviewed learn what reviewers look for. Major failures often follow years of assurance reports that described controls as effective.
Too close to the work
Reviewers who depend on those they review, or who designed the controls, find fewer problems.
Checking the paperwork
Assurance that checks whether processes are documented rather than whether they work.
Unrecorded change
Methods and models changed without records, so no one can tell what earlier results relied on.
How assurance and correction work.
- 01
Model validation
Independent testing of models against data, benchmarks and expert review, using uncertainty quantification and model validation. Limits: validation is harder for models of rare events.
- 02
Internal and external audit
Independent review of controls and governance. Limits: audit samples, and its findings depend on scope.
- 03
Version control and provenance
Records of data, code and method versions behind each result. Limits: requires discipline to maintain.
- 04
Open correction
Published corrections with reasons and dates. Limits: requires a culture that values correction over reputation.
How it is studied, and what the methods cannot say.
- 01تحلیل تصمیم در شرایط عدم قطعیتMulti-criteria treatment choice · Decision trees for contingent plansApplied here
- 02احتمال و آمارFrequency and severity modelling · Dependence between risks · Combining data and judgementApplied here
- 03کمّی‌سازی عدم قطعیت و اعتبارسنجی مدلPropagating input uncertainty · Separating kinds of uncertainty · Deep uncertainty framingApplied here
Where this page’s references lead.
نهادها و اسنادی که این صفحه بر پایهٔ آن‌ها خوانده می‌شود. وضعیت و ویراست‌ها تغییر می‌کنند؛ هر پیوند به نهاد صادرکننده می‌رود.
پرسش و پاسخ.
What does assurance mean in risk management?
Why trace organisational factors in investigations?
How are corrections handled on these pages?
Why publish corrections openly?
Is assurance the same as audit?
Can the platform provide assurance on my risk management?
شواهد را از همین صفحه ارسال کنید.
گزارش‌ها is the Consortium’s quarterly publication. What you know about this subject can become evidence, a case or a correction in the next edition, credited to you and published under CC BY 4.0 where it is your own work.
- ایمیلدرگاه GW-GCRIاز همین صفحه ارسال کنیدشواهد، یک اصلاحیه، یک مورد، یک روش، یک داوری، یک ترجمه یا ورودی نمایه. با برچسب این صفحه میرسد تا ویراستار مسئول آن را دریافت کند.
- Zenodoسپردهٔ بازآن را واگذار کنید و به جامعه ارائه دهیدسابقهٔ خود را با شناسهٔ ORCID خود در Zenodo منتشر کنید و سپس آن را در همانجا به جامعهٔ Reports ارسال کنید. گزینشگران آن را داوری می‌کنند؛ DOI از آنِ شما میماند.
- گزارش‌هاGCRIهمهٔ راههای مشارکت را ببینیدانواع مشارکت، نحوهٔ بررسی هر یک، اعتباری که دریافت میکنید، مجوز و آنچه هرگز پذیرفته نمیشود.
هرگز داده شخصی، جزئیات حساس زیرساخت یا چیزی را که حق اشتراکش را ندارید نفرستید. هر مشارکت پیش از استفاده داوری می‌شود؛ ارسال آن حق مؤلفی یا ویرایشی نمی‌دهد و حمایت مالی هرگز یافته‌ای را نمی‌خرد.
یک روش، یک مجموعه‌داده یا یک پرسش بیاورید.
اطلاعات و درخواست‌ها امروز باز است. هر درخواست یک شمارهٔ پیگیری می‌گیرد و گام بعدی را مشخص می‌کند؛ درخواست‌های عضویت، پرداخت‌ها، تخصیص رایانش و ثبت‌نام‌ها تنها زمانی باز می‌شوند که تیم، شرایط و ظرفیت داوری آن‌ها فراهم باشد.
اسناد حقوقی.
نقشه‌ها، داده‌ها و ارقام این سایت برای زمینه و اطلاعات عمومی نشان داده می‌شوند. توصیه، پیش‌بینی یا هشدار نیستند؛ حدود این اطلاعات در سلب مسئولیت‌ها و اعلامیه‌های داده بیان شده است.